Set the security scope
Define the services, systems, data, locations, and third parties covered by the chosen framework.
01INFORMATION SECURITY & IT COMPLIANCE
PCI DSS.
PCI DSS: Security requirements for organizations that store, process, or transmit payment card data. The right scope and assessment route depends on your activities, operating locations, and applicable requirements.
Explore requirementsCERTIFICATION AREA
Information Security & IT Compliance
STANDARD OR SCHEME
PCI DSS
ASSESSMENT
Scope-specific
02 STANDARD OVERVIEW
What it addresses.
Security requirements for organizations that store, process, or transmit payment card data.
The applicable framework depends on the data you handle, the services you provide, customer commitments, and regulatory obligations.
03 SCOPE & REQUIREMENTS
What PCI DSS covers.
The applicable scope depends on your organization, products or services, operating sites, and the requirements of the selected standard or scheme.
- 01
Define systems, information, services, locations, and third parties that fall within the selected security or compliance scope.
- 02
Assess relevant threats, vulnerabilities, privacy obligations, control requirements, and evidence expectations.
- 03
Implement and monitor controls, record their operation, and resolve findings through a managed improvement process.
04 BUSINESS VALUE
Why organizations pursue it.
The right certification depends on your requirements, scope, and business context. A clear fit can help turn external expectations into practical ways of working.
- Identify and prioritize security or privacy gaps
- Improve evidence of control operation
- Strengthen risk and incident management
- Support customer and regulatory commitments
- Clarify responsibility for information assets
- Build confidence with customers and business partners
05 WHO IT’S FOR
Where it can apply.
Technology providers, data processors, payment-related businesses, and organizations handling customer or personal information.
Commonly applicable sectors
- SaaS and technology providers
- Financial and payment services
- Healthcare and health technology
- Cloud, hosting, and data services
- Business process outsourcing
- Organizations handling personal or payment data
Applicability and obligations should be confirmed against the current standard, local law, market, customer contract, and your organization’s scope.
06 TYPICAL JOURNEY
From requirements to assessment.
Assess risks and controls
Review assets, threats, privacy duties, control requirements, and evidence expectations.
Implement and gather evidence
Operate controls, document their use, and track remediation of identified gaps.
Complete the assessment
The relevant assessor or auditor evaluates the defined scope using the selected framework or test method.
07 PREPARATION
Prepare for the right assessment.
Use the selected standard or scheme and your confirmed scope to guide preparation.
Confirm the framework, assessment type, system boundaries, business services, and customer or regulatory commitments.
Inventory relevant data and assets; review access, risk treatment, incident response, change management, and supplier controls.
Collect evidence of control operation, complete internal reviews, and track remediation before the external assessment or test.
08 FREQUENTLY ASKED QUESTIONS
Before you begin.
How do we choose the right framework?
Start with the services you provide, information you handle, customer commitments, applicable laws, and target markets. These determine whether a security standard, privacy framework, audit report, or technical test is relevant.
Does a readiness review guarantee a successful assessment?
No. Readiness work can identify and help address gaps, but the outcome depends on the organization’s controls and the independent assessor’s findings.
How often should security controls be reviewed?
Review frequency depends on the framework, risk, business changes, customer requirements, and legal obligations. Maintain ongoing monitoring rather than treating assessment as a one-time activity.
Can security and privacy frameworks be combined?
Some frameworks share controls and can be coordinated to reduce duplicated work. The scope and evidence requirements still need to be mapped for each framework separately.
NEXT STEP