PCI DSS and AI
In this episode of InfoSec Insider, Alastair Stewart and Tibor Laczko, both Senior Consultants and Qualified Security Assessors (QSAs) with URM, explore the PCI Security Standards Council's latest guidance on AI and what it means for organisations handling payment card data. Drawing on real-world PCI DSS assessment experience, they discuss:
- Whether tools such as GitHub Copilot, Claude and ChatGPT change PCI DSS requirements when used in payment application development.
- The risks of developers uploading logs, application data and troubleshooting information into AI platforms, and when AI tools may inadvertently become part of PCI scope.
- How AI-powered security monitoring, behavioural analytics and threat detection can strengthen logging and monitoring programmes while still requiring human oversight.
- The compliance implications of AI agents that can automatically modify cloud configurations, security groups and other production systems.
- Whether organisations can rely on AI to assess PCI evidence, review policies, identify documentation gaps and support assessment preparation.
- Why AI-generated policies and procedures still require human review, validation and organisational context.
- The significant risks associated with AI-powered customer service chatbots in payment environments, particularly where cardholder data could be entered by customers.
- How AI-driven vulnerability discovery compares with traditional vulnerability scanning and where customised approaches under PCI DSS v4.0 may be appropriate.
- The growing challenge of assessing AI systems, proving compliance and maintaining effective governance as organisations increase their reliance on AI technologies.
- And more.
Your questions matter
If there’s a PCI DSS related issue you’d like us to explore, share it with us below. We’ll use listener questions to guide future discussions and ensure our episodes tackle the challenges that matter most to businesses like yours.
About the InfoSec Insider
The InfoSec Insider podcast brings you weekly interviews with practicing senior consultants, who draw upon their extensive experience to provide detailed and practical guidance on all things information and cyber security, data protection compliance, risk management, and more. In each episode, one of our experts takes a deep-dive into a particular aspect of their area of specialism, whether that be certifying to ISO 27001, outlining some top tips for GDPR compliance, making the case for alternative approaches to pen testing, or discussing how to conduct an effective business impact analysis (BIA). Enhance your understanding and professional skillset with the InfoSec Insider podcast, brought to you by URM, the UK’s leading provider of cyber security and governance, risk management and compliance consultancy.
Contact the InfoSec Experts Today
Having assisted over 500 organisations to implement an ISMS and then achieve ISO 27001 certification since the Standard was first published in 2005, we at URM are the ideal partners to help you certify. With our fully-tailored approach, our specialists can support you through each stage of the ISO 27001 management system lifecycle, offering guidance specific to your organisation’s unique requirements.
Get in touch with our information security experts today to find out more.
InfoSec Solutions & Products
One the key requirements of ISO 27001 is the need for a robust risk assessment process which can produce repeatable and comparable results. With its proven, best practice methodology, URM’s information security risk management software, Abriska 27001, enables you to meet this requirement. We can also assist you to raise and maintain awareness among your staff with our expertly designed and engaging learning management system (LMS), Alurna.
InfoSec Training Courses
Our information security and risk management training courses can help you learn how to effectively manage information security. Our Certificate in Information Security Management Principles (CISMP) and Practitioner Certificate in Information Risk Management (PCIRM) training courses will prepare you to take the BCS (Chartered Institute for IT) administered exams, enabling you to gain industry-recognised qualifications.
Webinars & Events
URM has gained a reputation as the preeminent UK provider of live webinars, aimed at delivering valuable and practical insights to organisations looking to improve their information security, risk management, data protection etc. The webinars are delivered by our senior consultants who share hints and tips on topics such as certifying to ISO 27001 and Cyber Essentials, complying with the GDPR. All of our webinars are completely free to attend, and include an opportunity to ask questions at the end.
Learn how to design, deliver and evaluate effective business continuity exercises that strengthen resilience, validate plans and improve preparedness.
URM's experts explore the most common reasons organisations fail Cyber Essentials and Cyber Essentials Plus, and share practical advice.
Join our cyber security breakfast in Reading and discover how finance leaders can understand cyber risk and better protect their business.
Information Security FAQs
What are 4 types of information security?
If we look to guidance from Annex A of ISO 27001, then the answer is organisational, people, physical and technological. The International Standard groups information security into these 4 categories. The ‘organisational’ category requires the creation of policies, roles and responsibilities and day-to-day business activities. The ‘people’ category ensures that the most appropriate staff are employed, and that they understand what is expected of them in relation to the business’ approach to infosec. ‘Physical’ controls relate to the security of business premises, clear desk policies etc, whilst, ‘technological’ controls relate to measures that may be adopted by organisations to assist in securing information through the use of technology such as capacity management, configuration management, change management, network security, firewalls, cryptography etc.
What are the 3 principles of information security?
The three aspects that information security (infosec) seeks to protect are ‘confidentiality’, ‘integrity’ and ‘availability’. Confidentiality ensures that information is not made available or disclosed to unauthorised entities. Integrity protects the accuracy and completeness of assets, whilst Availability ensures that information is accessible and usable on demand by authorised individuals.tc.
What are information security examples?
Examples of information security include encryption, firewalls, antivirus software, multi-factor authentication (MFA), vetting of individuals, controlling access to premises / information and providing staff awareness training.
What are 5 information security policies?
Policies provide direction on your organisation’s approach to different aspects of information security management. Policies may relate to the classification of data, password management, acceptable use of assets, authentication procedures and incident response - these are five examples, but your organisation may choose to formulate a policy relating to any aspect of information security (infosec) management.
