Free reference · PCI DSS v4.0.1

PCI DSS glossary

Short, accurate definitions of the terms that come up in every PCI DSS conversation. Each entry says what the term means, why it matters to your assessment, and where to read more.

Find your SAQ All guides

Terms and abbreviations

AoC — Attestation of ComplianceAn Attestation of Compliance (AoC) is the signed declaration that accompanies a completed SAQ or Report on Compliance, stating the assessment result for the entity and the environment assessed.ASV — Approved Scanning VendorAn Approved Scanning Vendor (ASV) is an organisation approved by PCI SSC to perform the external vulnerability scans required by PCI DSS Requirement 11.3.2.Cardholder data — CHDCardholder data means the Primary Account Number and, when stored with it, cardholder name, expiration date and service code.CDE — Cardholder Data EnvironmentThe cardholder data environment (CDE) is the people, processes and technologies that store, process or transmit cardholder data or sensitive authentication data, plus any system components that connect to or could affect the security of those systems.Compensating controlA compensating control is an alternative measure used when an entity cannot meet a PCI DSS requirement as stated, because of a legitimate technical or documented business constraint.ISA — Internal Security AssessorAn Internal Security Assessor (ISA) is an employee of an organisation who has completed the PCI SSC Internal Security Assessor programme and can perform internal PCI DSS assessments for their own employer.Merchant levels — Validation levelsMerchant levels are set by the payment brands, not by PCI SSC, and determine how compliance must be validated. Level 1 merchants require a Report on Compliance; lower levels may be eligible to self-assess.P2PE — Point-to-Point EncryptionA PCI-listed Point-to-Point Encryption (P2PE) solution encrypts card data inside a validated point-of-interaction device and decrypts it only inside the solution provider's secure environment, so the merchant never handles clear-text account data.PAN — Primary Account NumberThe Primary Account Number (PAN) is the payment card number that identifies the issuer and the cardholder account. It is the defining element of cardholder data — if PAN is present, PCI DSS applies.PCIP — Payment Card Industry ProfessionalThe Payment Card Industry Professional (PCIP) is an entry-level PCI SSC individual qualification that demonstrates foundational knowledge of the PCI DSS and the payment security ecosystem.POI device — Point-of-Interaction deviceA point-of-interaction (POI) device is the hardware that captures payment card data through direct physical interaction with the card — a terminal, PIN pad or card reader.QSA — Qualified Security AssessorA Qualified Security Assessor (QSA) is an individual certified by the PCI Security Standards Council, employed by a QSA Company, who is authorised to perform PCI DSS assessments and sign the resulting report.ROC — Report on ComplianceA Report on Compliance (ROC) is the detailed assessment report produced by a QSA (or a qualified Internal Security Assessor) documenting how every applicable PCI DSS requirement was tested and the result.SAD — Sensitive Authentication DataSensitive authentication data (SAD) is full track data, card verification codes (CAV2/CVC2/CVV2/CID) and PINs or PIN blocks. SAD must never be retained after authorisation, even if encrypted.SAQ — Self-Assessment QuestionnaireA Self-Assessment Questionnaire (SAQ) is a PCI SSC validation tool that lets an eligible merchant or service provider assess its own PCI DSS compliance. There are ten SAQ types in v4.0.1, each with its own eligibility criteria and set of requirements.Segmentation — Network segmentationSegmentation isolates the cardholder data environment from the rest of the network so that out-of-scope systems cannot reach it. PCI DSS does not require segmentation, but it is the usual way to keep scope small.SPoC — Software-based PIN Entry on COTSA PCI-listed SPoC solution pairs a PCI-listed approved PTS Secure Card Reader-PIN with a commercial off-the-shelf phone or tablet so PIN entry can happen on the consumer device screen.Targeted risk analysis — TRAA targeted risk analysis (TRA) is the documented analysis PCI DSS v4.x requires when an entity chooses the frequency of a periodic activity, or uses the customised approach.Tokenisation — TokenizationTokenisation replaces the Primary Account Number with a surrogate value (a token) that has no exploitable value outside the tokenisation system, reducing where card data lives.TPSP — Third-Party Service ProviderA third-party service provider (TPSP) is any external party that stores, processes or transmits account data on the entity's behalf, or that could otherwise affect the security of account data.

Know the terms — now find the right SAQ

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer, and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Definitions paraphrased from the PCI DSS v4.0.1 standard and the PCI SSC Glossary of Terms, Abbreviations and Acronyms. Independent summary; not endorsed by PCI SSC.