What Standards and Resources Does the PCI Security Standards Council Publish?

Updated

The PCI Security Standards Council (PCI SSC) publishes the core payment data security standards—most notably PCI DSS, now at v4.0.1—alongside newer standards such as the PCI Key Management and Operations (KMO) Standard v1.0, information supplements (including one on AI system security), and mapping resources like the PCI DSS–NIST CSF alignment. If you handle cardholder data, operate cryptographic key infrastructure, or build payment terminals, the site's Document Library is where you find the specification that applies to you.

Core standards you are most likely to need

PCI DSS v4.0.1

The primary data security standard for organizations that store, process, or transmit cardholder data. PCI SSC describes v4.0.1 as a limited revision to v4.0, issued to address stakeholder feedback and questions received since v4.0 was published. If you are already working from v4.0, the practical step is to check the revision notes rather than restart your program.

PCI Key Management and Operations (KMO) Standard v1.0

A newly published standard "designed for entities involved in the use of cryptographic keys." This is relevant if your environment generates, distributes, stores, or retires keys protecting payment data—not just if you run payment applications.

PCI PTS POI Modular Security Requirements v7.0

Part of the PIN Transaction Security (PTS) family, covering Point of Interaction (POI) modular security requirements. This applies to terminal and acceptance-device vendors rather than merchants.

Information supplements and mapping resources

Resource What it is for Who should read it
Security Considerations for AI Systems New information supplement addressing security of AI systems Teams deploying AI in or near payment environments
PCI DSS and NIST CSF mapping Shows how the two frameworks align to streamline control management Organizations already maintaining a NIST CSF program
PCI PTS HSM requirements and device approval expiration updates Reminder of extended security requirements and approval expiration dates for HSM v4 and v3 devices Hardware security module vendors and integrators

Information supplements are guidance, not new requirements—treat them as interpretation aids when your assessor or internal team asks how a standard applies to a technology the standard does not name directly.

Training, events, and provider lookup

Beyond documents, the site is an operational entry point:

  • Training and qualification — become an ISA (Internal Security Assessor) or QSA (Qualified Security Assessor); sessions are scheduled alongside regional Community Meetings, such as the Kuala Lumpur training tied to the Asia-Pacific meeting.
  • Community Meetings — registration is open for the Europe Community Meeting and for 2026 meetings.
  • Find a Provider or Solution — look up assessors and validated products rather than choosing vendors blind.
  • Merchant Resource Center — a starting point if you are a merchant rather than an assessor or vendor.
  • Document Library — the authoritative index for every standard, supplement, and revision.

How to decide where to start

  1. Identify your role: merchant, service provider, assessor, or terminal/HSM vendor. The applicable standard differs sharply between them.
  2. Check whether a revision affects you: if you are mid-implementation on PCI DSS v4.0, review the v4.0.1 limited revision before changing scope.
  3. Use mappings only if you already run the paired framework: the NIST CSF alignment saves effort for teams with an existing CSF program; otherwise it adds a second vocabulary.
  4. Verify device and provider status through the provider lookup and PTS approval listings, especially where expiration dates have been extended.

One caveat worth noting: the site promotes mailing-list and blog subscriptions, but the pages reviewed do not state terms for training or event pricing—confirm costs and eligibility on the specific registration page rather than assuming access is unrestricted.