PCI DSS includes 12 principal requirements organized under six control objectives: build secure networks, protect account data, maintain vulnerability management programs, implement access controls, monitor and test networks regularly, and maintain information security policies.

The PCI DSS is a set of security requirements created by major payment card brands to protect cardholder data throughout its lifecycle. Organizations that accept, transmit, or store payment card information must implement technical and operational controls defined in PCI DSS v4.0.1.

PCI DSS defines four merchant levels and two service provider levels based on annual transaction volume. Level 1 merchants process over 6 million transactions and require onsite QSA assessments. Levels 2-4 handle fewer transactions with reduced validation requirements but maintain identical security obligations. Service providers follow separate classification with Level 1 processing over 300,000 transactions annually requiring mandatory QSA audits.