Where to Find Key Resources on the PCI Security Standards Council Site

The PCI Security Standards Council (PCI SSC) site, pcisecuritystandards.org, organizes its most-used resources around four entry points on the homepage: the Document Library for standards and supplements, training pages for ISA/QSA and other programs, the "Find a Provider or Solution" directory, and the Merchant Resource Center, with the Newsroom covering announcements. Use this guide if you need a specific standard, want to check training options, are looking for a qualified assessor or vendor, or need merchant-facing guidance.

Document Library: standards, supplements, and revisions

The Document Library is the place to retrieve official publications. The homepage's "Search the Document Library" link is the direct route.

What you can expect to find there, based on current homepage highlights:

• PCI DSS v4.0.1 — a limited revision published to address stakeholder feedback and questions received since PCI DSS v4.0.
• PCI Key Management and Operations (KMO) Standard v1.0 — a new standard for entities involved in the use of cryptographic keys.
• Security Considerations for AI Systems — a new information supplement addressing the security of artificial intelligence systems.
• PCI PIN Transaction Security (PTS) Point of Interaction (POI) Modular Security Requirements v7.0 — listed as just published and available in the Document Library.
• PCI DSS and NIST CSF mapping resource — a mapping that helps organizations align security efforts and streamline control management.

A practical approach: search by document name or acronym rather than browsing, since the library spans standards, supplements, and mapping resources across several programs. If you are unsure which document applies, start from the standard family (DSS, PTS, PIN, KMO) and then check for supplements.

Training and certification (ISA and QSA)

Training is run through the training subdomain (training.pcisecuritystandards.org), and the homepage promotes it in two ways:

• "Attend Training" — the general entry point for training programs.
• "Become an ISA or QSA in Kuala Lumpur" — an example of regional training scheduled alongside the Asia-Pacific Community Meeting, with a "More information" link for details.

If your goal is to qualify as an Internal Security Assessor (ISA) or Qualified Security Assessor (QSA), use the training entry point and check whether a session is scheduled alongside a Community Meeting near you — the site explicitly bundles training with these events. The mailing list signup (linked from the homepage as "Join Now" under "Unlock Exclusive Updates") is described as a way to receive training opportunities and event updates.

Find a Provider or Solution

The "Find a Provider or Solution" link on the homepage is the directory for locating assessors and vendor offerings. Use it when you need to identify a qualified assessor or a solution rather than read a standard. The site does not describe the directory's filters on the homepage, so treat the link as the starting point and refine your search within the directory itself.

Merchant Resource Center and Newsroom

• Merchant Resource Center — aimed at merchants who need practical guidance on payment security rather than the full standards text. Start here if you are a merchant trying to understand what applies to you.
• Newsroom — the "Visit the PCI SSC Newsroom" link collects announcements, including newly published documents and program updates.

Events and community participation

The homepage currently promotes:

• Europe Community Meeting — registration open, described as "almost here."
• 2026 Community Meetings — registration open, with a call to mark calendars.
• Call for Speakers — a notification email list for speaking opportunities at upcoming PCI SSC events.

Community Meetings are also where regional training (such as the Kuala Lumpur ISA/QSA session) is co-located, so check the events listings if you want training and networking in one trip.

Other resources worth knowing

• 2025 PCI SSC Annual Report — the Council's first annual report, covering 2025 progress and the future of payment security.
• Standards Updates & RFCs — the section where revisions and requests for comments are announced; this is where the PCI DSS v4.0.1 revision is described.
• Mailing list and blog — signups are available for the PCI SSC mailing list and the PCI Perspectives blog, both useful for tracking new publications.

Quick reference

One caution: the homepage highlights change frequently (the current items include the KMO standard, the AI supplement, and the PTS POI v7.0 publication), so confirm details on the linked page rather than relying on the homepage summary.