Act no: N/A

Type: Industry Standard

Purpose: Defines technical and operational security requirements to protect cardholder data and reduce payment card fraud.

All entities that store, process, or transmit cardholder data, or can impact the security of the cardholder data environment (CDE).

Retailers, E-commerce platforms, Payment gateways.

• Protect systems against vulnerabilities: Implement a process to identify and manage vulnerabilities through risk-based assessments and threat intelligence [PCI DSS Requirement 6.3.1]
• Ensure secure configurations: Harden systems against known threats and disable insecure services [PCI DSS Requirement 2.2]
• Protect against phishing and email threats: Enforce controls to prevent email spoofing and unauthorized mail use [PCI DSS Requirement 10.5.1.2]

Fines imposed by card brands or banks, ranging from thousands to millions of rands depending on breach severity and compliance history.

N/A

Not applicable under South African law, but may affect compliance with related laws like POPIA or FIC Act.

Trust in an organisation and its brand can be significantly damaged, leading to the potential loss of customers, contracts, and licence eligibility.

CyberProfiler: Your External Vulnerability Scan

Performs a safe, external scan of your public digital footprint to detect security weaknesses visible to attackers.

• Vulnerability Management: Helps identify exploitable weaknesses before attackers do [PCI DSS Requirement 6.3.1]
• System Hardening: Reveals outdated services or misconfigurations that violate security baselines [PCI DSS Requirement 2.2]

DMARC: Stop Email Spoofing and Protect Your Brand

Enforces domain-based email authentication to block spoofing, stop phishing, and boost email deliverability.

• Email Security: Reduces risk of phishing and spoofed emails impersonating card-processing systems [PCI DSS Requirement 10.5.1.2]
• Preventive Controls: Strengthens trust in outbound communications by enforcing DMARC reject/quarantine policies [PCI DSS Requirement 10.5.1.2]

• PCI Security Standards Council (PCI SSC): pcisecuritystandards.org/
• Michalsons: PCI DSS Compliance

(Links verified and active as of May 2025)

Where appropriate, we link to Michalsons’ expertly maintained legal resources and plain-language explanations. We gratefully acknowledge their role in making South African legislation more accessible and understandable.