International standard

PCI DSS (Payment Card Industry Data Security Standard) compliance

Payment Card Industry Data Security Standard

The PCI Security Standards Council is a global organization that maintains, evolves, and promotes security standards for organizations handling credit card data.

It explicitly requires all merchants using mobile payments to protect cardholder data by maintaining a secure environment. PCI DSS notes that mobile devices are not inherently secure and must be reinforced with additional protection measures.

What the regulation says

PCI DSS requirements applying to mobile devices and apps handling credit card data

Requirement 5

Protect all systems against malware using up-to-date anti-malware solutions. Malware can infiltrate systems through various channels, including the internet, emails, mobile devices, or storage media.

Requirement 6

Develop and maintain secure systems and applications. Vulnerabilities can grant attackers unauthorized access. Security patches must be applied immediately to fix flaws and protect cardholder data from exploitation.

How to comply

To comply with PCI DSS, organizations must secure all mobile applications handling cardholder data.

Runtime Application Self-Protection (RASP) strengthens application security by detecting and blocking threats in real time during app execution. It adds an essential layer of defense beyond traditional security controls.

Application Security Testing (AST) complements RASP by analyzing source code to identify and remediate vulnerabilities before they are exploited.

Other regulations

GDPR ISO 27001:2022 NIS2 DORA PSD2 DPA HIPAA CISA Checklist PIPEDA FTC Act SOC 2 Cyber Resilience Act

Get compliant

Our experts help you assess your exposure and cover mobile risk as part of your compliance programme.