PCI DSS
Payment Card Industry Data Security Standard. Required of any organization that stores, processes, or transmits cardholder data. The current major version (4.0) tightens authentication requirements and adds MFA for non-console administrative access.
PCI DSS 4.0 pushed authentication requirements up sharply: MFA for all access into the cardholder data environment rather than just remote administrative access, and stronger password rules where passwords remain. For identity teams the practical impact is scoping, since every account that can reach the environment is in scope, including service accounts and vendor support access.
See also: compliance guides, MFA, what is PAM, retail and e-commerce identity
Related on Start with Identity
- GlossaryPSD2
Revised Payment Services Directive. EU regulation requiring Strong Customer Authentication for electronic payments and enabling open banking. SCA mandates two-f
- GuideIdentity Controls for PCI DSS
PCI DSS identity controls are the requirements in [PCI DSS v4.0.1](/regulations/united-states/pci-dss/) that decide who and what can reach cardholder data and h
- GlossaryAge Verification
Age verification is a check that establishes a user's exact age, or that they are over a threshold such as 18, from an authoritative source like a government ID
- GlossaryAML
Anti-Money Laundering. The set of regulations and processes used to detect and report suspicious financial activity. AML programs sit on top of KYC and include
- GuideCustomer Identity Verification Guide: KYC, Document Verification, and Fraud Prevention
Implement customer identity verification with KYC processes, document verification, liveness detection, progressive profiling, and fraud prevention strategies.
- GuideGDPR for identity systems: what the regulation actually requires
GDPR makes your identity system the place where privacy obligations either work or fail. The identity store holds the canonical user record, so it is where data