PCI DSS
In one sentence
The security standard for any business that accepts credit-card payments, set by the card brands.
The Payment Card Industry Data Security Standard applies to any organization that stores, processes, or transmits cardholder data. Even small merchants must meet a level of it (often via a self-assessment questionnaire), and it overlaps with general cyber hygiene.
Why it's on your cyber insurance application
Card-accepting SMBs may see PCI questions; the controls overlap heavily with cyber-application requirements.
What this looks like in practice
The useful question isn't whether PCI applies, it's how much of it does. If your card payments go through a hosted checkout and no card data touches your systems, your self-assessment is short and your cyber application answer is stronger. If you key cards into a terminal on your own network, that's a different conversation worth having with your processor.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
Where this comes up by trade
Some trades get asked about this harder than others, usually because a rule or a claim pattern already points at it. These pages have that detail.
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.