IT Glossary
PCI DSS protects payment card data across everyone who handles it. Learn what version 4.0 requires on access, including the six-month review rule.
August 7, 2026
PCI DSS (Payment Card Industry Data Security Standard) is the security standard governing any organization that stores, processes, or transmits payment card data. It is maintained by the PCI Security Standards Council and enforced contractually by the card brands and acquiring banks rather than by law. The current version is 4.0, which replaced version 3.2.1 on 31 March 2024.
Earlier versions left review frequency to interpretation. Version 4.0 states it: user accounts and related access privileges are reviewed at least every six months, and the review has to confirm that access remains appropriate to the job function. This became a mandatory requirement in March 2025. For companies already running quarterly access reviews it changes nothing. For those reviewing once a year, it is a gap that surfaces at the next assessment.
A European e-commerce company has scoped its cardholder data environment to six systems and reviews access to them annually. The version 4.0 assessment asks for two reviews in the last twelve months, per account, with evidence that inappropriate access was removed. Adding the second cycle is straightforward. Producing the evidence per account, across six systems and their administrative roles, is where the manual approach stops scaling. Corma runs those campaigns and keeps the revocation proof attached to each line.
Any merchant, service provider, or processor that stores, processes, or transmits cardholder data, at a validation level set by annual transaction volume.
No. It is a contractual standard imposed by the card brands through acquiring banks. Non-compliance leads to fines, higher fees, or the loss of card processing ability.
At least once every six months, for all user accounts and related access privileges, under Requirement 7.2.4.
Yes, through network segmentation and by not storing cardholder data at all. Reducing scope is usually the cheapest compliance decision a company can make.
