If you process online payments by credit or debit card, you fall under PCI DSS (Payment Card Industry Data Security Standard). This standard was drawn up by the major payment networks (Visa, Mastercard, American Express) and applies to every company that processes, stores or transmits payment card data.
PCI DSS is not a law but a contractual obligation. Your payment provider or acquirer requires compliance. If you do not comply and a breach occurs, your ability to take payments can be suspended and considerable fines imposed. Version 4.0 of the standard, fully in force since 2024, sets higher requirements than its predecessor.
PCI DSS
Every company that processes, stores or transmits payment card data. In practice that means:
Even if you do not store card data yourself but pass it to a payment gateway, you sit in the lowest compliance level (SAQ A), yet you still have to be able to show that your environment is secure.
The obligations
PCI DSS is built from 12 requirements, grouped into six objectives:
Our contribution
From firewall to quarterly scan: these are the technical measures in our packages that fill in the PCI DSS requirements.
01
Website and domain protection through a WAF (web application firewall) and DDoS protection provide the network security layer PCI DSS requires. Malicious traffic is filtered before it reaches your systems.
02
SSL/TLS certificate monitoring ensures all data traffic is encrypted, a direct PCI DSS requirement for protecting cardholder data in transit.
03
PCI DSS requires regular vulnerability scans of network and systems. Guardian offers an annual automated scan. Sentinel offers a quarterly scan, matching higher PCI DSS risk levels.
04
The password manager helps replace default passwords with strong, unique ones per account, a basic PCI DSS requirement.
05
PCI DSS requires annual security training for staff. Security awareness training in the Sentinel package fills that obligation directly.
Please note
Orange Warriors delivers technical security measures that contribute to compliance. We do not issue certification and we are not a legal adviser. Whether you fully meet a guideline also depends on organisational measures, policy and documentation that fall outside our services.
PCI Security Standards Council (pcisecuritystandards.org)FAQ
Yes, but your compliance level is lower (SAQ A or SAQ A-EP). You do not have to secure card data yourself because the gateway does that, but you do have to be able to show that your own environment, your website and network, is secure.
Your payment provider can suspend your ability to take payments. In a breach where card data leaked, the payment networks can impose fines of 5,000 to 100,000 euros a month until you are compliant.
Guardian offers the basic technical measures: firewall, SSL/TLS and an annual vulnerability scan. Sentinel adds quarterly scans, security awareness training and broader monitoring. Which level you need depends on your SAQ level.
Free scan
Guardian covers the basics of PCI DSS, Sentinel the full level. In a free scan we see which level fits your web shop.
