Thanks for clarifying, seregine. You're correct that a successful vulnerability scan is not conclusive evidence of compliance with the PCI DSS. It's one of th

Thanks for clarifying, seregine. You're correct that a successful vulnerability scan is not conclusive evidence of compliance with the PCI DSS. It's one of the many components of meeting compliance with the PCI DSS. Many requirements are taken into consideration as part of any individual organization's compliance with the PCI DSS. The Payment Card Industry Data Security Standard (PCI DSS) is an industry standard for anyone who stores, processes or transmits cardholder data (think: credit card numbers). The standard itself covers 12 key requirements for protecting cardholder data with many sub-requirements under each section. All organizations that store, process, or transmit cardholder data are required to be compliant with the PCI DSS. Based on certain elements, primarily including transaction volume, will determine an organizations "level". Every level is required to comply with the same requirements, but each level may have a different requirement to validate their compliance. Typically, larger organizations are required to have an onsite audit conducted and smaller organizations are able to self-assess.