PCI-DSS
PCI-DSS is the Payment Card Industry Data Security Standard, the security baseline for any organization that stores, processes, or transmits cardholder data.
PCI-DSS isn't a law. It's a contractual requirement, enforced by Visa, Mastercard, and the other card brands through the merchant agreements a business signs to accept card payments at all.
The current version is PCI-DSS v4.0.1. It applies just as much to a mobile app taking in-app payments as it does to a physical point-of-sale terminal.
Who governs it, and why it isn't a "law"
The PCI Security Standards Council, formed in 2006 by the major card brands, maintains the standard.
Compliance isn't legally mandated the way GDPR or HIPAA are. It's a condition of accepting card payments at all, enforced through fines, restrictions, or losing the ability to process cards, applied by card brands and acquiring banks rather than a government regulator.
The 12 requirements
PCI-DSS groups its requirements into six goals:
- Build and maintain a secure network,
- Protect cardholder data,
- Maintain a vulnerability management program,
- Implement strong access control,
- Monitor and test networks regularly, and
- Maintain an information security policy.
Underneath those six sit 12 specific requirements, covering everything from firewall configuration to encrypting cardholder data in transit.
Validation: SAQ or QSA
How an organization proves compliance depends on transaction volume. Most merchants complete a Self-Assessment Questionnaire (SAQ), one of several versions depending on how payment data flows through their systems. Larger organizations undergo a formal assessment by a Qualified Security Assessor (QSA), producing a Report on Compliance (ROC).
Why it matters for mobile
A mobile app that touches card data carries every standard PCI risk, plus a few the standard never anticipated. Mobile apps didn't exist yet when PCI-DSS was first written.
PCI-DSS prohibits storing sensitive authentication data, the CVV, and full track data after authorization.
On mobile, that means auditing exactly what a payment SDK caches locally, not just what the app's own code does. Which SAQ type applies also depends on architecture: a mobile app that fully redirects to a payment processor, never touching card data directly, qualifies for a much lighter validation path (SAQ A) than one handling more of the payment flow itself. And a hardcoded API key or a missing certificate-pinning check, both classic mobile-app findings, can expose exactly the data PCI-DSS exists to protect.
Where Appknox fits
Appknox tests for the technical failure modes that actually violate PCI-DSS on mobile:
- Insecure local storage of payment data or tokens,
- Hardcoded credentials,
- Weak or missing certificate pinning that would let traffic be intercepted, and
- API endpoints that don't enforce proper authorization.
Findings map to PCI-DSS automatically, alongside Appknox's other compliance mappings.
See Appknox's compliance frameworks: Compliance at Appknox
Check out the full testing methodology: Appknox Automated Vulnerability Assessment.
Frequently asked questions
What does PCI-DSS stand for?
PCI-DSS stands for the Payment Card Industry Data Security Standard, the security baseline for any organization that stores, processes, or transmits cardholder data.
Is PCI-DSS a legal requirement?
No. It's a contractual requirement enforced by card brands and acquiring banks through merchant agreements, not a government law. Non-compliance risks fines, restrictions, or losing the ability to process card payments.
What's the current version of PCI-DSS?
PCI-DSS v4.0.1.
What's the difference between an SAQ and a QSA assessment?
A Self-Assessment Questionnaire (SAQ) is a self-reported validation most merchants complete themselves, with the specific version depending on how payment data flows through their systems. A Qualified Security Assessor (QSA) conducts a formal, independent assessment for larger organizations, producing a Report on Compliance.
Does Appknox test for PCI-DSS compliance?
Appknox tests for the technical issues that violate PCI-DSS on mobile: insecure payment data storage, hardcoded credentials, weak certificate pinning, and unauthorized API access, and maps findings to PCI-DSS automatically.
Related: What is GDPR? | What is HIPAA? | Appknox Automated Vulnerability Assessment
By Aadarsh Anand, Security Researcher, Appknox Security Research Team
Appknox is an enterprise mobile application security testing platform. This page was written by Appknox's security research team based on direct experience testing mobile payment flows for PCI-DSS-regulated merchants and payment providers.
This page was drafted with AI assistance and reviewed and verified by the Appknox security research team
.png)
