PCI Compliance: The 12 Requirements and What 2026 Changed

By The Uptime Report editorial team · Last updated September 2026

PCI compliance means meeting the PCI DSS security standard that any business handling card data must follow. It carries 12 core requirements, and non-compliance is costly: card brands levy monthly fines of roughly $5,000 to $100,000 on non-compliant organizations.

What is PCI compliance?

PCI compliance means adhering to the Payment Card Industry Data Security Standard (PCI DSS), a set of controls that protect cardholder data. It applies to any organization that processes, stores, or transmits credit card information. The standard contains 12 requirements, and the major card brands require compliance from anyone handling card transactions. Non-compliance is expensive: StrongDM reports monthly fines of $5,000 to $100,000, plus forensic costs if a breach occurs.

What are the PCI DSS requirements?

The 12 requirements group into six control objectives: build and maintain a secure network, protect cardholder data, maintain a vulnerability management program, implement strong access control, regularly monitor and test networks, and maintain an information security policy. Each requirement carries specific, auditable controls, from encryption to access logging.

What changed for PCI compliance in 2026?

The current version is PCI DSS 4.0.1, and a large set of previously future-dated requirements became fully enforceable on March 31, 2025. Two 2026 changes matter most: multi-factor authentication is now required for all administrative access to the cardholder data environment, and SMS-based one-time passwords are no longer accepted, so you must use phishing-resistant MFA. You must also maintain a full inventory of scripts on payment pages, justify each, and use automated tamper detection.

What does non-compliance cost?

Beyond the $5,000 to $100,000 monthly fines, non-compliance can bring increased transaction fees, forensic investigation costs after a breach, and the loss of the ability to process cards at all. For most businesses, the cost of compliance is far smaller than the cost of losing card-processing capability, which is why many bring in a provider to manage it (Venn covers the full requirement set).

Frequently asked questions

What is PCI compliance?

Adherence to the PCI DSS standard that protects cardholder data. It applies to any business that processes, stores, or transmits credit card information.

How many PCI DSS requirements are there?

Twelve core requirements, grouped into six control objectives covering network security, data protection, access control, monitoring, and policy.

What changed in PCI compliance for 2026?

Phishing-resistant MFA is now required for admin access (SMS OTP is no longer accepted), and you must inventory and verify every script on payment pages.

What does PCI non-compliance cost?

Monthly fines of $5,000 to $100,000 from card brands, plus forensic costs after a breach and possible loss of card-processing ability.

Who must be PCI compliant?

Any organization that processes, stores, or transmits credit card data, regardless of size.

What is the current PCI DSS version?

PCI DSS 4.0.1, with many previously future-dated requirements enforceable since March 31, 2025.