PCI DSS compliance has four merchant levels and four service provider levels, determined by annual transaction volume:

Merchant Levels:

• Level 1: 6+ million Visa/Mastercard transactions annually (requires full audit with QSA)
• Level 2-4: Fewer transactions (can use Self-Assessment Questionnaires)

Service Provider Levels:

• Level 1: Store, process, or transmit 300,000+ transactions annually (requires full audit)
• Level 2-4: Fewer transactions (can use SAQ-D with penetration testing)

The level determines your validation requirements - from simple questionnaires to comprehensive audits with penetration testing and vulnerability scans.

Yes, if you process or transmit cardholder data - even without storing it. PCI DSS applies to any organization that accepts, processes, stores, or transmits credit card information.

Common scenarios requiring compliance:

• Payment processing through your application
• Transmitting payment data to third parties
• Having cardholder data flow through your systems temporarily
• Using payment processors (you still need to validate your environment)

The specific requirements depend on how payment data flows through your systems. Even with a "pass-through" model, you'll likely need SAQ-A or SAQ-A-EP compliance.

The 12 PCI DSS requirements are organized into six control objectives:

Build and Maintain Secure Networks:

1. Install and maintain firewall configuration

2. Don't use vendor-supplied defaults for passwords/security

Protect Cardholder Data:

3. Protect stored cardholder data

4. Encrypt transmission of cardholder data across networks

Maintain Vulnerability Management:

5. Use and regularly update anti-virus software

6. Develop and maintain secure systems and applications

Implement Strong Access Control:

7. Restrict access to cardholder data by business need-to-know

8. Assign unique ID to each person with computer access

9. Restrict physical access to cardholder data

Regularly Monitor and Test Networks:

10. Track and monitor all access to network resources and cardholder data

11. Regularly test security systems and processes

Maintain Information Security Policy:

12. Maintain policy that addresses information security for personnel

Annual validation is required for all PCI DSS compliance levels, but the validation method varies:

Ongoing Requirements:

• Quarterly vulnerability scans by Approved Scanning Vendor (ASV)
• Continuous monitoring of security controls
• Immediate remediation of critical vulnerabilities

Annual Validation:

• Level 1: Full audit by Qualified Security Assessor (QSA) + penetration testing
• Level 2-4: Self-Assessment Questionnaire (SAQ) completion
• Service Providers Level 1: Full audit + penetration testing
• Service Providers Level 2-4: SAQ-D + penetration testing

Important: Changes to your environment may trigger re-validation outside the annual cycle.

PCI Security Standards Council (PCI SSC):

• Creates and maintains PCI DSS standards
• Manages the qualification programs for QSAs and ASVs
• Non-profit organization founded by major payment brands
• Develops technical standards and best practices

Payment Brands (Visa, Mastercard, American Express, etc.):

• Enforce PCI DSS compliance requirements
• Set fines and penalties for non-compliance
• Manage compliance validation and reporting
• Each brand has specific compliance programs and requirements

In practice: PCI SSC sets the rules, payment brands enforce them. You validate compliance through payment brand programs, but follow PCI SSC standards.