What is PCI DSS?
PCI DSS was developed to encourage and enhance payment card account data security. It gives a baseline of technical and operational requirements and is maintained by the PCI Security Standards Council. It is an industry standard rather than a statute, and compliance programs are run by payment brands and acquirers.
The current version is PCI DSS v4.0.1, published in June 2024 as a limited revision of v4.0 with no added or deleted requirements. Version 4.0 was retired on 31 December 2024, and the future-dated requirements of v4.x took effect on 31 March 2025. Check the PCI SSC document library for any newer version.
The standard's physical security requirements include protecting card-reading devices from tampering and substitution. In v4.x this includes keeping a list of devices, periodic inspections of devices and training that covers verifying the identity of anyone claiming to be repair or maintenance personnel before giving them access.
Requirement 12.8 covers third-party service providers. A customer must manage and oversee those relationships, have appropriate agreements and monitor each provider's compliance status at least annually. Using a third party does not remove the customer's responsibility, and when a provider performs a requirement for the customer, that requirement stays in scope of the customer's assessment.
How it touches on-site IT work
- POS terminals and card readers: replacing, moving or repairing a terminal changes the device list and creates a tamper and substitution risk. Serial numbers, identity checks and a record of each swap matter.
- Verified visitors: a store should be able to confirm that a technician is expected, who sent them and what they are meant to do before giving access.
- Network and server work: switches, firewalls and servers in the cardholder data environment can affect payment security. Access should be limited to the task, approved and recorded.
- No card data in field records: field work seldom needs card numbers. Engineers should not ask for, record, photograph or paste card data into tickets.
- Media and retired devices: terminals, drives and spares that held card data need custody records and a defined wipe or destruction route.
- Responsibility split: the customer needs to know which requirements the provider handles and which stay with the customer.
What you can agree in a written scope
- A responsibility matrix that shows which PCI DSS requirements the provider handles, which the customer keeps and which are shared.
- A visit verification routine: advance notice of the named engineer, a work order reference and an ID check before access to a terminal.
- Recording serial numbers and locations of terminals installed, swapped or removed, and updating the customer's device list.
- A rule that no card data is requested, recorded, photographed or entered into tickets.
- Least-privilege, approved and logged access for work in the cardholder data environment.
- Reporting of suspected tampering or substitution, with a named contact and a time target.
- Subcontractor terms: approval first, and the same verification and handling rules passed down.
- Evidence for the customer's assessor, such as visit logs, work orders and device records, and how long they are kept.
- A written statement of the provider's responsibility for account data security where its work could affect it.
Questions to ask any field services provider
- Which PCI DSS requirements, if any, do you manage for us, and which stay with us?
- Can you provide your own PCI DSS compliance evidence if you are a service provider in scope?
- How do we verify that a technician is genuine before they touch a terminal?
- How do you record terminals swapped, moved or removed?
- Do your engineers ever see or record card data, and what is the rule if they do?
- How do you handle media and devices that may hold card data?
- Which subcontractors work on our sites, and under what rules?
This page is general information and not legal advice. Deploris does not claim certification or compliance status here. Confirm what applies to you with your own counsel or compliance team.