PCI Data Security Standard (PCI DSS) - v1 - Large Organizations

Sep 12, 2026

PCI DSS for Large Organizations provides guidance for applying the PCI Data Security Standard within organizations that have complex structures, multiple stakeholders, and varied payment relationships. It covers roles and ownership, planning PCI DSS assessments, managing mergers and acquisitions, coordinating multiple acquirers and payment channels, and handling multiple audits and compliance cycles. The document also details education and awareness practices, and operational controls such as asset management, system hardening, access control, vulnerability assessment, and patch management.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages37

Reading Time13 min

AccessFree to download

Executive Summary

Introduction

Audience

Navigating this Document

Terminology

Characteristics of Large Organizations

Roles, Responsibilities, and Ownership

Determining Roles, Responsibilities, and Ownership

Documenting Ownership, Roles, and Responsibilities

Responsibilities in Planning PCI DSS Assessments

Mergers and Acquisitions

Pre-purchase and Due Diligence

Existing Compliance and Integration

Multiple Acquirers and Payment Channels

Acquirer Relationships

Compliance Agreements and Expectations

Reporting Multiple Payment Channels

Example of Multiple Acquirers and Payment Channels

Multiple Audits and Assessments

Compliance Cycles and Assessments

Education and Awareness

Defining Roles

Determine PCI DSS Knowledge Areas

Developing Training Materials

Delivering Training

Measuring Success

Systems Management to Maintain PCI DSS Compliance

Asset Management

System Hardening

Access Control

Vulnerability Assessment

Patch Management

Local Laws, Regulations, and Standards

Standard: PCI Data Security Standard (PCI DSS) Date: February 2020 Author: PCI DSS for Large Organizations Special Interest Group PCI Security Standards Council Information Supplement: PCI DSS for Large Organizations Document Changes | Date | Version | Description | | --- | --- | --- | | February 2020 | 1.0 | Initial release. | Table of Contents 1 Executive Summary........................................................................................................................................... 4 2 Introduction ........................................................................................................................................................ 5 2.1 Audience ....................................................................................................................................................... 5 2.2 Navigating this Document ............................................................................................................................. 5 2.3 Terminology................................................................................................................................................... 6 3 Characteristics of Large Organizations .......................................................................................................... 7 4 Roles, Responsibilities, and Ownership ......................................................................................................... 8 4.1 Determining Roles, Responsibilities, and Ownership ................................................................................... 8 4.2 Documenting Ownership, Roles, and Responsibilities ............................................................................... 10 4.3 Responsibilities in Planning PCI DSS Assessments .................................................................................. 11 5 Mergers and Acquisitions ............................................................................................................................... 13 5.1 Pre-purchase and Due Diligence ................................................................................................................ 13 5.2 Existing Compliance and Integration .......................................................................................................... 13 6 Multiple Acquirers and Payment Channels................................................................................................... 15 6.1 Acquirer Relationships ................................................................................................................................ 15 6.2 Compliance Agreements and Expectations ................................................................................................ 15 6.3 Reporting Multiple Payment Channels ........................................................................................................ 15 6.4 Example of Multiple Acquirers and Payment Channels .............................................................................. 16 7 Multiple Audits and Assessments ................................................................................................................. 17 7.1 Compliance Cycles and Assessments ........................................................................................................ 17 8 Education and Awareness .............................................................................................................................. 19 8.1 Defining Roles ............................................................................................................................................. 19 8.2 Determine PCI DSS Knowledge Areas ....................................................................................................... 20 Customer-service Agents ............................................................................

FAQs

Who is the guidance intended for when applying PCI DSS in large organizations?

The document targets organizations that apply PCI DSS in environments with complex ownership, responsibilities, and payment relationships. It also addresses internal groups involved in assessments, training, and operational security management.

How does the document address mergers and acquisitions under PCI DSS?

It explains how to handle pre-purchase due diligence and how to integrate existing compliance into the acquiring organization. The focus is on maintaining PCI DSS alignment during change.

What systems and processes are covered to maintain PCI DSS compliance over time?

It outlines ongoing controls including asset management, system hardening, access control, vulnerability assessments, and patch management to sustain compliance between assessments.

Sep 12, 2026

Upload by wps_ap_test_251126_0180