Payment Card Industry Data Security Standard (PCI DSS)
Payment Card Industry Data Security Standard (PCI DSS)
The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard designed to protect payment card data. Developed and maintained by the PCI Security Standards Council (PCI SSC), PCI DSS establishes technical and operational requirements for protecting cardholder data and reducing payment security risks.
Who is subject to the Payment Card Industry Data Security Standard?
Compliance with the Payment Card Industry Data Security Standard applies to organizations that store, process, or transmit cardholder data or sensitive authentication data, as well as certain systems and service providers that can impact the security of the cardholder data environment (CDE). PCI DSS requirements are designed to protect payment data throughout its lifecycle.
Failure to meet PCI DSS requirements can result in significant financial and operational consequences, particularly following a data breach. Depending on contractual relationships with payment brands, acquiring banks, and other parties, consequences can include penalties, additional compliance requirements, increased processing costs, and potentially the loss of card acceptance privileges.
As more employees and contractors work remotely or in hybrid environments, protecting cardholder data also requires organizations to consider who is using authenticated company endpoints. Computers may be left unattended or accessed by unauthorized users, whether through intentional device sharing or simply because someone else gains access to an unlocked workstation. If that endpoint provides access to payment information or systems within the cardholder data environment, unauthorized use can create a significant security and compliance risk.
PCI DSS v4.0.1 places particular emphasis on identity and access controls. Requirement 8.4 requires multi-factor authentication (MFA) to secure access into the cardholder data environment, including MFA for all access into the CDE under Requirement 8.4.2, subject to the standard's applicability notes. TypingDNA Verify 2FA can be used as part of an MFA deployment by verifying users through their typing behavior. Users type 4 short words directly on their work computer, providing a phone-free authentication option without requiring additional hardware.
Where organizations continue to use SMS OTP as part of an authentication flow, TypingDNA SMS+ can help reduce exposure of the OTP itself. Instead of placing the authentication code directly in the SMS message, SMS+ sends a secure link where the user completes a short typing biometrics challenge before the OTP is revealed. The appropriate MFA design and PCI DSS applicability should still be evaluated as part of the organization's overall authentication architecture.
Authentication at login is only one part of protecting access to sensitive payment data. TypingDNA ActiveLock continuously verifies the person using a Windows or macOS company computer based primarily on typing behavior. If an unauthorized user is detected after login, ActiveLock can lock the computer or alert administrators, helping organizations reduce the risk of unauthorized endpoint access. Continuous authentication complements, rather than replaces, the MFA and access-control requirements of PCI DSS.
