Insights

Compliance with the Payment Card Industry Data Security Standard (PCI DSS) is an essential requirement for any organisation that processes, stores, or transmits payment card data. However, many companies underestimate its complexity and make mistakes that not only delay compliance but also increase the risk of security breaches.

Saying that a third-party service provider is “PCI compliant” is not a conclusion; it is the starting point for further verification.

As environments grow more complex and data volumes increase, traditional PCI DSS assessment methods are under pressure. Artificial intelligence offers a way to scale, automate, and enhance these processes, but it also introduces risks that must be carefully managed. The real challenge is not whether to use AI, but how to apply it without compromising the integrity of compliance.

For organisations aligning with ISO 27001 or PCI DSS, understanding where penetration testing is mandatory versus expected best practice is critical for both compliance and effective risk management.

The PCI Security Standards Council has released version 2.0 of the Secure Software Standard and its accompanying Program Guide, marking the most significant revision since the framework's inception in 2019. This update fundamentally reshapes how payment software is assessed and validated, introducing new terminology, expanded scope, and streamlined processes that will impact vendors, assessors, and customers across the payment ecosystem.

If your business handles credit card data, PCI DSS compliance isn’t optional—it’s critical. From retailers and e-commerce platforms to service providers and financial institutions, securing credit card data is critical to customer trust and preventing fraud.

Important Update on PCI DSS SAQ A Eligibility Criteria

The PCI Security Standards Council (PCI SSC) has published a new Frequently Asked Question (FAQ 1588) to help businesses better understand the updated eligibility criteria for Self-Assessment Questionnaire (SAQ) A under PCI DSS v4.0.1. These new requirements will take effect on April 1, 2025 and are especially important for e-commerce merchants using embedded payment pages (like iframes).

The Payment Card Industry Security Standards Council (PCI SSC) has announced significant updates to Self-Assessment Questionnaire A (SAQ A), particularly affecting e-commerce merchants. These changes, taking effect on 31 March 2025, remove certain requirements and introduce new eligibility criteria that require merchants to strengthen website security and protect against malicious script attacks.

The PCI Council has released valuable insights on Vulnerability Scans & ASV Guidance, particularly beneficial for SAQ A merchants.

We are excited to announce that Integrity360 has been selected as one of just 33 out of more than 400 organisations to join the prestigious PCI SSC Global Executive Assessor Roundtable. This selection reflects our commitment to advancing payment security and our recognition as a leader in the field.