pcisecuritystandards.org

The PCI Security Standards Council (PCI SSC) site, pcisecuritystandards.org, organizes its most-used resources around four entry points on the homepage: the Document Library for standards and supplements, training pages for ISA/QSA and other programs, the "Find a Provider or Solution" directory, and the Merchant Resource Center, with the Newsroom covering announcements. Use this guide if you need a specific standard, want to check training options, are looking for a qualified assessor or vendor, or need merchant-facing guidance.

Document Library: standards, supplements, and revisions

The Document Library is the place to retrieve official publications. The homepage's "Search the Document Library" link is the direct route.

What you can expect to find there, based on current homepage highlights:

• PCI DSS v4.0.1 — a limited revision published to address stakeholder feedback and questions received since PCI DSS v4.0.
• PCI Key Management and Operations (KMO) Standard v1.0 — a new standard for entities involved in the use of cryptographic keys.
• Security Considerations for AI Systems — a new information supplement addressing the security of artificial intelligence systems.
• PCI PIN Transaction Security (PTS) Point of Interaction (POI) Modular Security Requirements v7.0 — listed as just published and available in the Document Library.
• PCI DSS and NIST CSF mapping resource — a mapping that helps organizations align security efforts and streamline control management.

A practical approach: search by document name or acronym rather than browsing, since the library spans standards, supplements, and mapping resources across several programs. If you are unsure which document applies, start from the standard family (DSS, PTS, PIN, KMO) and then check for supplements.

Training and certification (ISA and QSA)

Training is run through the training subdomain (training.pcisecuritystandards.org), and the homepage promotes it in two ways:

• "Attend Training" — the general entry point for training programs.
• "Become an ISA or QSA in Kuala Lumpur" — an example of regional training scheduled alongside the Asia-Pacific Community Meeting, with a "More information" link for details.

If your goal is to qualify as an Internal Security Assessor (ISA) or Qualified Security Assessor (QSA), use the training entry point and check whether a session is scheduled alongside a Community Meeting near you — the site explicitly bundles training with these events. The mailing list signup (linked from the homepage as "Join Now" under "Unlock Exclusive Updates") is described as a way to receive training opportunities and event updates.

Find a Provider or Solution

The "Find a Provider or Solution" link on the homepage is the directory for locating assessors and vendor offerings. Use it when you need to identify a qualified assessor or a solution rather than read a standard. The site does not describe the directory's filters on the homepage, so treat the link as the starting point and refine your search within the directory itself.

Merchant Resource Center and Newsroom

• Merchant Resource Center — aimed at merchants who need practical guidance on payment security rather than the full standards text. Start here if you are a merchant trying to understand what applies to you.
• Newsroom — the "Visit the PCI SSC Newsroom" link collects announcements, including newly published documents and program updates.

Events and community participation

The homepage currently promotes:

• Europe Community Meeting — registration open, described as "almost here."
• 2026 Community Meetings — registration open, with a call to mark calendars.
• Call for Speakers — a notification email list for speaking opportunities at upcoming PCI SSC events.

Community Meetings are also where regional training (such as the Kuala Lumpur ISA/QSA session) is co-located, so check the events listings if you want training and networking in one trip.

Other resources worth knowing

• 2025 PCI SSC Annual Report — the Council's first annual report, covering 2025 progress and the future of payment security.
• Standards Updates & RFCs — the section where revisions and requests for comments are announced; this is where the PCI DSS v4.0.1 revision is described.
• Mailing list and blog — signups are available for the PCI SSC mailing list and the PCI Perspectives blog, both useful for tracking new publications.

Quick reference

One caution: the homepage highlights change frequently (the current items include the KMO standard, the AI supplement, and the PTS POI v7.0 publication), so confirm details on the linked page rather than relying on the homepage summary.

The PCI Security Standards Council (PCI SSC) publishes the core payment data security standards—most notably PCI DSS, now at v4.0.1—alongside newer standards such as the PCI Key Management and Operations (KMO) Standard v1.0, information supplements (including one on AI system security), and mapping resources like the PCI DSS–NIST CSF alignment. If you handle cardholder data, operate cryptographic key infrastructure, or build payment terminals, the site's Document Library is where you find the specification that applies to you.

Core standards you are most likely to need

PCI DSS v4.0.1

The primary data security standard for organizations that store, process, or transmit cardholder data. PCI SSC describes v4.0.1 as a limited revision to v4.0, issued to address stakeholder feedback and questions received since v4.0 was published. If you are already working from v4.0, the practical step is to check the revision notes rather than restart your program.

PCI Key Management and Operations (KMO) Standard v1.0

A newly published standard "designed for entities involved in the use of cryptographic keys." This is relevant if your environment generates, distributes, stores, or retires keys protecting payment data—not just if you run payment applications.

PCI PTS POI Modular Security Requirements v7.0

Part of the PIN Transaction Security (PTS) family, covering Point of Interaction (POI) modular security requirements. This applies to terminal and acceptance-device vendors rather than merchants.

Information supplements and mapping resources

Information supplements are guidance, not new requirements—treat them as interpretation aids when your assessor or internal team asks how a standard applies to a technology the standard does not name directly.

Training, events, and provider lookup

Beyond documents, the site is an operational entry point:

• Training and qualification — become an ISA (Internal Security Assessor) or QSA (Qualified Security Assessor); sessions are scheduled alongside regional Community Meetings, such as the Kuala Lumpur training tied to the Asia-Pacific meeting.
• Community Meetings — registration is open for the Europe Community Meeting and for 2026 meetings.
• Find a Provider or Solution — look up assessors and validated products rather than choosing vendors blind.
• Merchant Resource Center — a starting point if you are a merchant rather than an assessor or vendor.
• Document Library — the authoritative index for every standard, supplement, and revision.

How to decide where to start

1. Identify your role: merchant, service provider, assessor, or terminal/HSM vendor. The applicable standard differs sharply between them.
2. Check whether a revision affects you: if you are mid-implementation on PCI DSS v4.0, review the v4.0.1 limited revision before changing scope.
3. Use mappings only if you already run the paired framework: the NIST CSF alignment saves effort for teams with an existing CSF program; otherwise it adds a second vocabulary.
4. Verify device and provider status through the provider lookup and PTS approval listings, especially where expiration dates have been extended.

One caveat worth noting: the site promotes mailing-list and blog subscriptions, but the pages reviewed do not state terms for training or event pricing—confirm costs and eligibility on the specific registration page rather than assuming access is unrestricted.

pcisecuritystandards.org is the official site of the PCI Security Standards Council (PCI SSC), a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments worldwide. Use it as the primary source for the standards themselves (such as PCI DSS), related publications, training and qualification programs, community events, and listings of providers and solutions. It is a standards body's site, not a payment processor or a compliance-certification service.

What the site is for

The Council describes itself as a forum where the payments industry develops and promotes data security standards. That mission shapes what you find on the site:

• Standards and supporting documents — the core standards plus information supplements and mappings.
• Training and qualification — programs to become an ISA or QSA, among others.
• Events — Community Meetings in different regions, plus speaking opportunities.
• Directories — tools to find a provider or solution and to search the document library.

What you can find and do there

The homepage groups its main actions under an "I Want To" menu and a set of featured highlights. Based on the site's own listings, these include:

Recent publications highlighted on the site give a sense of the range: a new information supplement on Security Considerations for AI Systems, the PCI Key Management and Operations (KMO) Standard v1.0 for entities using cryptographic keys, and a mapping resource to align PCI DSS with NIST CSF. The site also notes a limited revision, PCI DSS v4.0.1, published to address stakeholder feedback since v4.0, and PCI PTS POI Modular Security Requirements v7.0.

How to use it for a specific task

The right entry point depends on what you need:

• Looking for the current text of a standard — start with the Document Library rather than the homepage highlights, since the library is the searchable index of published documents.
• Checking whether a product or assessor is listed — use "Find a Provider or Solution." Note that this is a listing tool; the site does not present itself as issuing compliance certifications to individual businesses.
• Planning training — the training portal is a separate subdomain (training.pcisecuritystandards.org), where you can also subscribe to the mailing list or the PCI Perspectives blog.
• Tracking changes — the Standards Updates & RFCs area and the newsroom are where revisions and new publications are announced; the DSS v4.0.1 revision is an example of a change you would catch there.

A practical example: if your team is aligning payment security controls with a broader framework, the published PCI DSS–NIST CSF mapping is the resource to open first, then confirm the underlying DSS version in the Document Library.

What to keep in mind

• The site is informational and programmatic — standards, training, events, and directories. It does not process payments or certify your organization directly.
• Pricing and access terms are not stated on the pages reviewed. Training and events involve registration, and the site offers mailing-list and blog subscriptions, but do not assume any resource is free or requires no login; check the specific page.
• Versions matter. Because the Council publishes limited revisions (as with v4.0.1) and new standards (KMO v1.0), always confirm which version a document or mapping refers to before relying on it.

The PCI Security Standards Council (PCI SSC) has recently published four updates that matter most for compliance planning: a limited revision of PCI DSS (v4.0.1), a new PCI Key Management and Operations (KMO) Standard v1.0, a new information supplement on AI system security, and extended expiration dates for PCI PTS HSM requirements and device approvals. Which one affects you depends on your role — merchants and assessors should start with PCI DSS v4.0.1, entities handling cryptographic keys with the KMO standard, organizations deploying AI in payment environments with the AI supplement, and terminal/HSM vendors with the PTS date extensions.

PCI DSS v4.0.1: A Limited Revision, Not a New Version

According to the PCI SSC site, the Council published a limited revision to PCI DSS v4.0.1 to address stakeholder feedback and questions received since v4.0 was released. The word "limited" is the key detail: this is a targeted revision rather than a restructured standard.

What this means for you:

• If you are mid-assessment against PCI DSS v4.0, check the revision notes before assuming your current documentation is unaffected.
• If you are planning a future assessment, confirm with your assessor which version applies to your validation timeline.
• The site points readers to the Standards Updates & RFCs section for the full revision details — that is the authoritative place to verify scope before changing any control documentation.

PCI Key Management and Operations (KMO) Standard v1.0

PCI SSC has published a new standard "designed for entities involved in the use of cryptographic keys." This is a standalone standard, not a PCI DSS supplement, so it applies to a specific audience: organizations that generate, store, distribute, or retire cryptographic keys in payment-related systems.

Decision guide:

Because the standard is new (v1.0), expect supporting guidance and adoption timelines to develop. Check the Document Library for the published text before committing resources.

Security Considerations for AI Systems

PCI SSC has published a new information supplement addressing the security of artificial intelligence systems. Note the document type: an information supplement provides guidance and considerations — it is not a mandatory standard with its own assessment requirements.

When this is worth your time: if your organization uses AI in or near payment data flows — for example, fraud scoring models that ingest transaction data, or chatbots that handle cardholder inquiries — the supplement gives you a structured way to think about those risks. If AI is entirely outside your payment environment, it can wait.

PCI PTS HSM Requirement and Device Approval Date Extensions

The site carries a reminder about the extension of PCI PTS HSM v4 security requirements and device approval expiration dates, as well as PCI PTS HSM v3 device approval expiration dates. This affects hardware security module vendors and anyone whose approval status depends on those dates.

Action: if you track HSM approval expirations for procurement or deployment planning, re-check your internal dates against the reminder — the extensions may move deadlines you previously recorded.

Also Worth Knowing

• PCI PTS POI Modular Security Requirements v7.0 is listed as just published in the Document Library — relevant to point-of-interaction terminal vendors.
• A PCI DSS and NIST CSF mapping resource is available for organizations that maintain controls against both frameworks and want to align them rather than duplicate effort.
• Community Meetings and training (including ISA/QSA training in Kuala Lumpur alongside the Asia-Pacific Community Meeting, and the Europe Community Meeting) are open for registration — useful if you need formal training or want direct access to PCI SSC updates.

How to Verify Any of These Updates

1. Go to pcisecuritystandards.org and open the Document Library — this is where the published texts of the KMO standard, the AI supplement, and PTS documents live.
2. For PCI DSS v4.0.1 details, use the Standards Updates & RFCs section, which the site identifies as the place for the revision announcement.
3. To confirm training or event details, use the registration links on the homepage rather than third-party summaries.
4. To find assessors or solutions, use the site's Find a Provider or Solution tool.

The main pitfall to avoid: treating the AI supplement as a compliance requirement or the PCI DSS v4.0.1 revision as a full new version. Both misreadings lead to wasted effort — check the document type and revision scope in the Document Library before adjusting your compliance program.

You can get involved with PCI SSC in four main ways: attend a regional Community Meeting, pursue ISA or QSA training (often scheduled alongside those meetings), subscribe to the mailing list or blog for updates, and respond to the Call for Speakers. The official site currently highlights the Europe Community Meeting, ISA/QSA training in Kuala Lumpur alongside the Asia-Pacific Community Meeting, and 2026 Community Meeting registration. All of these are announced and managed through pcisecuritystandards.org, so the site itself is your starting point for dates, registration, and eligibility details.

Training: Becoming an ISA or QSA

The PCI SSC site promotes training that leads to two recognized designations:

• ISA (Internal Security Assessor) – for employees of eligible organizations who assess their own PCI DSS compliance.
• QSA (Qualified Security Assessor) – for assessors at qualified security assessment firms.

The site's current example is training in Kuala Lumpur timed to coincide with the Asia-Pacific Community Meeting, which lets participants combine training with community sessions in one trip. The site does not publish prices or detailed eligibility rules on the homepage, so treat the linked "More information" page for each program as the authoritative source before you commit.

Practical steps:

1. Go to pcisecuritystandards.org and open the training item (for example, "Become an ISA or QSA in Kuala Lumpur").
2. Read the program requirements and confirm your organization or employer qualifies.
3. Register through the training portal at training.pcisecuritystandards.org.
4. Verify your registration and schedule — training dates are tied to specific events, so confirm both.

Common snag: people assume training is open to anyone. ISA and QSA programs have eligibility conditions tied to your role and employer, so check those first rather than booking travel.

Community Meetings

Community Meetings are regional events where the payments industry discusses standards updates and implementation. The site currently features:

To attend: open the meeting announcement on the homepage, follow the registration link, and complete registration before the stated deadline. Because the Europe meeting is described as "almost here," registration windows are time-sensitive — check the current announcement rather than relying on a saved link.

Staying Updated: Mailing List and Blog

Two subscription channels are listed on the site:

• Mailing list — the site describes it as a way to "receive the latest PCI SSC news, exclusive training opportunities, event updates, and more." Subscribe via the training portal's mailing-list page.
• PCI Perspectives blog — subscribe at training.pcisecuritystandards.org/subscribe-to-pci-perspectives-blog.

These are the most reliable way to learn about new training cohorts and meeting registration openings before deadlines get close.

Other Ways to Participate

• Call for Speakers — the site invites you to "sign up for our Call for Speakers notification email list to hear about exciting speaking opportunities at upcoming PCI SSC events." If you have implementation experience to share, this is a low-barrier entry point.
• Document Library and standards updates — the site's "Search the Document Library" and "Standards Updates & RFCs" sections let you follow revisions (for example, PCI DSS v4.0.1) and comment during request-for-comments periods.
• Find a Provider or Solution — useful if you are looking for a QSA firm rather than becoming one.

A Realistic Example

Suppose you work in payment security in Europe and want both training and networking. You would: check the Europe Community Meeting announcement and register; separately check whether an ISA/QSA session is scheduled near you (the Kuala Lumpur pairing shows how training and meetings are often co-located); and join the mailing list so the next 2026 meeting opening reaches you directly. That sequence avoids the most common miss — hearing about a meeting after registration has closed.

What the Site Does Not Tell You

The homepage does not list fees, exact eligibility criteria, or session agendas. Those details sit on the individual program and registration pages. Confirm cost and requirements there before making travel or budget commitments.