PCI DSS, the Payment Card Industry Data Security Standard, is a security framework for any environment that stores, processes, or transmits cardholder data. It is not a law, but a set of mandatory controls enforced by card brands and payment processors through contracts and compliance programs.
In cyber security, PCI DSS matters because payment data is a high-value target for thieves and extortion actors. If attackers reach point-of-sale systems, reservation systems, or finance systems that touch card data, PCI DSS requirements can shape containment, logging, access control, encryption, and network segmentation. Even when a hotel or retailer outsources payment processing, its own systems may still fall into scope if they can affect the security of cardholder data. Defenders use PCI DSS as a baseline to reduce breach impact and to prove that sensitive payment workflows are isolated, monitored, and protected.