PCI DSS is the global data security standard for any organisation that stores, processes, or transmits payment card data, currently governed by version 4.0.1 and built around 12 core requirements. As of 31 March 2025, dozens of previously "future-dated" 4.0.1 requirements, including targeted risk analyses and expanded multi-factor authentication, became fully enforceable. Non-compliant organisations face monthly fines from card brands ranging from roughly 5,000to5,000 to 100,000, on top of forensic investigation costs if a breach occurs. Compliance validation and evidence live in two places: your Report on Compliance or Self-Assessment Questionnaire. The part most organisations underbuild is incident response documentation and readiness.