PCI DSS is structured around twelve core requirements covering network security, access control, encryption, monitoring, vulnerability management, and security policy. The controls that apply to your organisation depend on how you handle card data and the volume of transactions you process, which determines your merchant level and the corresponding validation requirements.

For many small and medium-sized organisations, the most important step is scoping: establishing exactly where card data flows, which systems are in scope, and how to reduce that scope as much as possible. Minimising the cardholder data environment is one of the most effective ways to reduce both compliance burden and risk.

Validation typically involves completing a Self-Assessment Questionnaire, the appropriate form of which depends on your payment environment, and in some cases an on-site assessment by a Qualified Security Assessor.