What is PCI Compliance? How to Make Sure Your Business is Compliant.
Learn the basics of PCI compliance, understand how it impacts businesses, and how to make your business PCI compliant.
作者
资源 Compliance with the Payment Card Industry Data Security Standards — more concisely known as PCI DSS Compliance, or simply being PCI compliant — refers to a set of rules for taking card payments securely to minimize risks of stolen card data. Every business that takes card payments–even if it’s only a few cards a month–is required by its merchant bank or platform provider to comply with PCI DSS requirements.
Chances are you’ve heard of PCI compliance, but don’t know exactly what it is or what it requires. This article is intended to help explain the basics and how PCI relates to Toast devices and services.
So what is PCI, exactly?
In the early 2000s, Visa, Mastercard, Discover, American Express, and the Japan Credit Bureau (JCB) started independently thinking about ways to help protect their cardholders. After realizing they were all trying to accomplish the same goal, the companies worked together to form the Payment Card Industry Security Standards Council (PCI SSC).
The result was version 1.0 of the PCI DSS, a set of rules and regulations that apply to every business that accepts their credit or debit cards. Over time, the security standards have been updated, culminating in the most recent version 4.0.1.
Despite changes and updates over the years, every version of PCI DSS sets the rules and regulations that businesses must follow in order to accept credit and debit cards, regardless of industry or location. It is important to note that PCI compliance today is evolving as newer solutions, like Toast, are intentionally built to reduce a business's PCI “scope” (that is, which of the requirements apply to them).
What are the PCI DSS requirements?
PCI DSS was developed to encourage and enhance payment account data security and facilitate the broad adoption of consistent data security measures globally. PCI DSS provides a baseline of technical and operational requirements designed to protect payment account data.
The table below provides a general overview of PCI DSS. Each of the PCI DSS Requirements shown on the right contains multiple Sub-requirements. There are a total of 352 requirements, so the sub-requirements are not listed here. (These individual sub-requirements are detailed within our Responsibility Guides, which our customers can access by contacting Customer Care.)
Goals | PCI DSS Requirements |
Build and Maintain a Secure Network and Systems | 1. Install and maintain network security controls 2. Apply secure configurations to all system components |
Protect Account Data | 3. Protect stored account data 4. Protect cardholder data with strong cryptography during transmission over open, public networks |
Maintain a Vulnerability Management Program | 5. Protect all systems and networks from malicious software 6. Develop and maintain secure systems and software |
Implement Strong Access Control Measures | 7. Restrict access to system components and cardholder data by the business's need-to-know 8. Identify users and authenticate access to system components 9. Restrict physical access to cardholder data |
Regularly Monitor and Test Networks | 10. Log and monitor all access to system components and cardholder data 11. Test the security of systems and networks regularly |
Maintain an Information Security Policy | 12. Support information security with organizational policies and programs |
The Guide to Restaurant Sales
In this Guide to Restaurant Sales, you’ll learn the metrics you need to measure to understand the financial health of your restaurant. Plus, you’ll get tons of great ideas that’ll help you learn how to improve sales in your restaurant.
What do I need to do to be PCI compliant?
Existing Toast customers should request a copy of the applicable Toast PCI Responsibility Guides through a Customer Care representative to learn more. The guides provide more details on which requirements are Toast’s responsibility, and which requirements the customer must meet. In some cases, a requirement must be met by both Toast and the customer – but this is explained further within the Responsibility Guide, where applicable.
It is important to note that the vast majority of Toast customers do not need to send Toast any PCI validation documentation (Self Assessment Questionnaire (SAQ) and Attestation of Compliance (AOC) documents) as Toast does not require these documents to be provided.
Why is PCI compliance important?
Adhering to PCI compliance not only protects your customers, it also significantly reduces your risk of expensive penalties and fines that can result from a security breach. Based on 2025 data, IBM estimates that a data breach, on average, costs a business a whopping $4.44M. For many businesses, data breaches can mean both financial and reputational ruin. The best way to prevent breaches is by closely following all PCI compliance requirements – it’s not just about protecting your customers, it’s about protecting yourself.
One last point: If your business is found to be out of compliance, you can face steep fines from the card brands, merchant processor, and/or acquiring bank. Needless to say, compliance is important.
Here at Toast, PCI compliance is always top of mind. Below, you can find a series of helpful resources that’ll assist in making sure your business is fully compliant. If you want to learn more about our PCI-compliant integrated point of sale and credit card processing solutions, set up time with a Toast technology expert.
List of helpful PCI compliance resources:
这篇文章有帮助吗？
免责声明：此信息仅作为一般性参考，发布并不构成认可。Toast 不保证本内容中包含的任何信息、文本、图形、链接或其他项目的准确性或完整性。Toast 不保证如果您遵循本文的任何建议，就能取得任何特定结果。您可能需要咨询专业人士，如律师、会计师或商业顾问，以获取针对您情况的具体建议。
趋势
