The PCI Data Security Standard
PCI DSS is a set of technical and operational standards developed to protect payment card data. Adopted by payment card networks and applicable to all entities that process, store or transmit Cardholder Data and/or Sensitive Authentication Data, the goal of PCI DSS is to promote safe payments worldwide.
| Goals | PCI DSS Requirements |
|---|---|
| Build and Maintain a Secure Network and Systems | - Install and maintain a firewall configuration to protect Cardholder data - Do not use vendor-supplied defaults for system passwords and other security parameters |
| Protect Cardholder Data | - Protect stored Cardholder data - Encrypt transmission of Cardholder data across open, public networks |
| Maintain a Vulnerability Management Program | - Protect all systems against malware and regularly update antivirus software or programs - Develop and maintain secure systems and applications |
| Implement Strong Access Control Measures | - Restrict access to Cardholder data by business need to know - Identify and authenticate access to system components - Restrict physical access to Cardholder data |
| Regularly Monitor and Test Networks | - Track and monitor all access to network resources and Cardholder data - Regularly test security systems and processes |
| Maintain an Information Security Policy | - Maintain a policy that addresses information security for all personnel |
New! PCI DSS 4.0 coming March 2024
Watch this On-Demand Webinar or download this helpful reference guide to learn more.
- Comply with the current PCI Data Security Standard
- Only store Cardholder Data needed to process American Express Card transactions
- Use only PCI-approved Payment Devices
- Report your PCI DSS compliance status to American Express, as required
- Notify American Express of a Data Incident within 72 hours
- Adhere to applicable data incident management obligations resulting from a Data Incident
A Cardholder data compromise occurs when Cardholder data is lost or stolen. American Express Targeted Analysis Program (TAP) provides early identification of potential Card data losses impacting your business.
You can also download our Cardholder Data Compromise Action Guide.
Please follow these steps if you have identified a Data Incident at your business.
Step 1:
Fill out the Merchant Data Incident Initial Notice Form and email to EIRP@aexp.com within 72 hours after the Data Incident is discovered
Step 2:
Conduct a thorough investigation; this may require you to hire a Payment Card Industry (PCI) Forensic Investigator.
Step 3:
Promptly provide us with all compromised American Express® Card numbers.
Step 4:
Work with us to help resolve any issues arising from the Data Incident.
View Section 3 of the Data Security Operating Policy for more details on Data Incident Management Obligations.
Have more questions?
US: (888) 732-3750 (toll free)
International: +1 (602) 537-3021
We’re here to help.
American Express offers Data Security Incident Notification Services1 to help you inform American Express Card Members who have been affected by a Data Incident at your business.2
We can:
- Help you reach affected American Express Card Members by working with us and an authorized print vendor who can send out notices3
- Put you in contact with vendors who can help with various other services, such as call center management and return mail handling
- Put you in contact with a credit reporting agency that can help offer ID-theft- protection services to the affected American Express Card Members
Have more questions? dataincidentservices@aexp.com.
You’re required to regularly report your PCI DSS status, whether you are compliant or non-compliant. Reporting on time, regardless of status, can prevent a nonrefundable, non-validation data-security fee.
The standard PCI validation documents are universal which means you can use the same validation document to report to all the payment brands. The PCI DSS status reporting requirements are determined by the number of American Express Card transactions you process in a given year.
These reporting requirements apply to both Merchants and Service Providers.
| Annual Card Transactions | 2.5 million or more American Express Card transactions (or if you’ve been designated a Level 1 by American Express) |
| Audience | Merchant or Service Provider |
| Is Reporting Required or Optional? | Required |
| Assessment Needed | Annual On-site Assessment |
| What Documentation is Required4 | Report on Compliance Attestation of Compliance (ROC AOC) Other acceptable documentation: American Express STEP Attestation6 |
| Who Conducts the Assessment | Qualified Security Assessor (QSA) or Self-certified |
| Reporting Frequency | Annually |
| Annual Card Transactions | 50,000 to 2.5 million American Express Card transactions |
| Audience | Merchant or Service Provider |
| Is Reporting Required or Optional? | Required |
| Assessment Needed | Annual Self-Assessment External Network Vulnerability Scan |
| What Documentation is Required4 | Self-Assessment Questionnaire (SAQ) ASV Scan Report Attestation of Scan Compliance (AOSC) Other acceptable documentation:
|
| Who Conducts the Assessment | SAQ: Self-certified Scan Report: Approved Scanning Vendor (ASV) |
| Reporting Frequency | SAQ: Annually Scan Report: Every 90 days |
| Annual Card Transactions | 10,000 to 50,000 American Express Card transactions |
| Audience | Merchant only |
| Is Reporting Required or Optional? | If required by American Express, otherwise optional |
| Assessment Needed | Annual Self-Assessment External Network Vulnerability Scan |
| What Documentation is Required4 | Self-Assessment Questionnaire (SAQ) ASV Scan Report Attestation of Scan Compliance (AOSC) Other acceptable documentation:
|
| Who Conducts the Assessment | SAQ: Self-certified Scan Report: Approved Scanning Vendor (ASV) |
| Reporting Frequency | SAQ: Annually Scan Report: Every 90 days |
| Annual Card Transactions | Below 10,000 American Express Card transactions |
| Audience | Merchant only |
| Is Reporting Required or Optional? | If required by American Express, otherwise optional |
| Assessment Needed | Annual Self-Assessment |
| What Documentation is Required4 | Self-Assessment Questionnaire (SAQ) ASV Scan Report Attestation of Scan Compliance (AOSC) Other acceptable documentation:
|
| Who Conducts the Assessment | SAQ: Self-certified Scan Report: Approved Scanning Vendor (ASV) |
| Reporting Frequency | SAQ: Annually Scan Report: Every 90 days |
To view more details, see Section 4 in the Data Security Operating Policy.
What is Security Technology Enhancement Program (STEP)?
The Security Technology Enhancement Program (STEP)6 is a way for American Express to recognize Merchants that deploy additional security technologies to improve the security of Cardholder Data and Sensitive Authentication Data.
Merchants who qualify for STEP (as determined by American Express):
- Submit only an annual STEP Attestation form as their annual PCI validation documentation
- Will not be required to submit any other annual PCI document (ROC or SAQ) or a quarterly vulnerability scan
View our frequently asked questions to learn more and see if you qualify.
How to report your PCI compliance status
SecureTrust is the program administrator of the American Express PCI Compliance Program. You can use SecureTrust™ PCI Manager to upload or create your required PCI DSS validation documents.
Log in to your SecureTrust PCI Manager account at: https://portal.securetrust.com
Need Help? Check out these short training modules to learn more about reporting your PCI compliance status. Note: please open in Acrobat Reader to ensure the links work.
If you have questions about your account, your status, how to use SecureTrust PCI Manager, or if you are no longer the data security contact for your business, please contact SecureTrust at americanexpresscompliance@securetrust.com or call (866) 659-9016 (available 24/7/365) or (312) 267-3208.
Check out these helpful resources to help protect your business:
To make sure payment card data is as secure as possible, visit the PCI Security Standards Council document library for specifications, tools and resources.
Get a better understanding of data security basics, from firewalls to chip technology.
View industry articles and information to help your business protect payment data.
The Payment Card Industry Data Security Standard (PCI DSS) is the payments industry technical and operational criterion that works to protect card data environment. The PCI DSS is developed and managed by the PCI Security Standards Council. Visit the PCI Security Standards Council site to learn more.
Being compliant with the PCI DSS helps to ensure you are protecting your company and your customers from a data compromise. When you accept American Express Cards, you agree to our American Express® Card Acceptance Agreement, including the American Express Data Security Operating Policy (DSOP), which requires compliance with the PCI DSS.
A non-validation fee may be charged for failing to report your PCI DSS compliance status to American Express in a timely manner. You are required to report to us, on time, regardless of your status. Please note that the fee is for failing to report, not because of non-compliance.
You could be assessed a nonrefundable, Data Incident non-compliance fee.
A non-compliance fee not to exceed $100,000 USD could be assessed.
Yes. Your bank or processor is reporting to Visa/MasterCard on your behalf, but you also have a relationship with American Express. The PCI Validation Documentation is universal, however, so you can report to us using the same documents you use to report to your bank or processor.
Yes. Outsourcing may change the scope of your assessment, but you are still required to complete and report an annual assessment once a year and, if applicable, external quarterly network scans every 90 days.
Unfortunately, no. We don’t have access to other security providers. The good news is that the PCI Validation Documentation is universal. You can download and submit to us the same documents you are using to report to your bank or processor.
1 For US Merchants only
2 Only customers with an American Express Card issued by American Express will be available for notification through this service. Services are not available for customers using American Express Cards issued by other financial institutions, nor for holders of cards other than American Express Cards.
3 You will be responsible for payment to third parties for the costs of these services.
4 The standard PCI validation documents are universal. You can use the same validation document to report to all the payment brands.
5 Each payment brand defines their levels differently.
6 American Express Security Technology Enhancement Program is available to eligible Merchants only. Service Providers are not eligible for STEP.
