Payment and financial data security rules apply when you store, process or transmit card data, or when you supply technology to banks, insurers and other financial firms. PCI DSS is contractual, enforced through the card brands and acquirers. DORA, NYDFS Part 500 and the GLBA Safeguards Rule are regulations, and DORA reaches the ICT providers that financial firms depend on.
5 items in this category
4 related from other categories
Oct 30, 2026 statuses last checked
At a glance
Payment and financial data security compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
PCI DSS is the security standard for any organization that stores, processes or transmits payment card data, or can affect the security of that environment. It has 12 principal requirements, from network security and secure configuration to access control, logging, testing and policy. It is not a law; it is required by contracts with the card brands, acquirers and payment partners. Depending on volume and role you validate with a self-assessment questionnaire or a report on compliance by a QSA.
What it covers, who needs it and why
What it covers
The cardholder data environment and every system connected to it or able to affect it, including service providers such as hosting, payment and SaaS vendors.
Who needs it
Merchants, payment processors, and IT and SaaS providers whose systems touch card data or the cardholder data environment.
Why it matters
Non-compliance can mean fines from the acquirer, higher fees or losing the ability to take cards, plus liability after a breach.
Key objectives
Protect stored and transmitted card data
Maintain secure systems and software
Restrict and monitor access
Test security regularly and keep a security policy
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
PCI Security Standards Council; enforced by the card brands and acquiring banks
Current version
PCI DSS v4.0.1 (June 2024). The future-dated requirements of v4.0 became mandatory on 31 March 2025.
PCI Software Security Framework: Secure Software Standard and Secure SLC Standard
The PCI Secure Software Standard sets security requirements for payment software that stores, processes or transmits card data, and the Secure Software Lifecycle (Secure SLC) Standard assesses how a vendor develops and maintains it. Software validated by an assessor appears on the PCI SSC list, which merchants and acquirers use when choosing payment applications. It replaced the older PA-DSS program.
What it covers, who needs it and why
What it covers
Payment software design, sensitive data protection, authentication, attack resistance, vendor security guidance, and the vendor's development lifecycle.
Who needs it
Vendors of payment applications, POS software, payment gateways and SDKs that handle card data.
Why it matters
Merchants and acquirers prefer or require listed software, and it simplifies their own PCI DSS scope.
Key objectives
Build payment software securely
Protect card data inside the application
Give merchants validated choices
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
PCI Security Standards Council
Current version
Part of the PCI Software Security Framework, which replaced PA-DSS (retired in 2022).
Regulation EU financial sector and its ICT providers
DORA
Digital Operational Resilience Act, Regulation (EU) 2022/2554
DORA sets a single set of digital operational resilience rules for EU banks, insurers, investment firms, payment institutions and other financial entities. It requires an ICT risk management framework, classification and reporting of major ICT incidents, resilience testing (including threat-led penetration testing for larger firms), and close management of ICT third-party risk, with mandatory contract terms. ICT providers designated as critical are overseen directly by EU supervisors.
What it covers, who needs it and why
What it covers
ICT risk management, incident reporting, testing, third-party contracts and the register of ICT providers, plus oversight of critical ICT providers.
Who needs it
EU financial entities, and every IT, cloud and SaaS vendor that supports their critical or important functions.
Why it matters
Financial customers must put DORA contract terms, audit rights and exit plans into vendor agreements.
Key objectives
Withstand and recover from ICT disruption
Report major incidents consistently
Control dependence on ICT providers
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; national financial supervisors and the European Supervisory Authorities
Current version
Applies from 17 January 2025. The first list of critical ICT third-party providers was designated in late 2025.
New York Department of Financial Services cybersecurity requirements, 23 NYCRR Part 500
Part 500 requires banks, insurers and other businesses licensed by New York DFS to run a cybersecurity program based on a risk assessment, with a CISO, written policies, access controls including multi-factor authentication, an asset inventory, encryption, incident response and continuity plans, annual security awareness training and third-party service provider policies. Covered entities report cybersecurity events within 72 hours and certify compliance each year by 15 April. Vendors feel it through contract requirements.
What it covers, who needs it and why
What it covers
Information systems and nonpublic information of DFS-licensed entities, and the service providers they rely on.
Who needs it
DFS-licensed financial services firms and the IT and SaaS providers that serve them.
Why it matters
DFS actively enforces it, and the annual certification is signed by the CEO and CISO.
Key objectives
Protect nonpublic information
Ensure governance and accountability
Require timely incident notice
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
New York State Department of Financial Services (DFS)
Current version
Second amendment adopted November 2023; the last phased requirements took effect on 1 November 2025.
FTC Standards for Safeguarding Customer Information, 16 CFR Part 314, under the Gramm-Leach-Bliley Act
The Safeguards Rule requires non-bank financial institutions under FTC jurisdiction (lenders, tax preparers, car dealers that finance, fintechs and others) to run a written information security program. It names a qualified individual, requires a risk assessment, access controls, encryption, multi-factor authentication, secure development, monitoring and testing, staff training, service provider oversight and a written incident response plan. Breaches affecting 500 or more consumers must be reported to the FTC within 30 days.
What it covers, who needs it and why
What it covers
Customer information held by covered financial institutions and their service providers.
Who needs it
Non-bank financial institutions in the US, broadly defined, and the IT and software vendors they use.
Why it matters
The FTC enforces it, and service provider oversight is an explicit requirement that reaches vendors.
Key objectives
Protect customer information
Require a documented security program
Notify the FTC of significant breaches
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
US Federal Trade Commission (FTC)
Current version
Updated rule in force since June 2023; breach notification to the FTC since 13 May 2024.
System and Organization Controls 1 report on controls relevant to user entities' internal control over financial reporting
A SOC 1 report tells a customer's financial auditor whether a service provider's controls can be relied on for the customer's financial reporting. It matters when your system processes transactions, payroll, billing or other data that ends up in a customer's financial statements. Like SOC 2, it comes as Type I (design at a date) or Type II (operating effectiveness over a period) and is issued by a CPA firm. It is not a security report and does not replace SOC 2.
What it covers, who needs it and why
What it covers
Control objectives you define around transaction processing and the IT general controls that support them (access, change management, operations).
Who needs it
Payroll, billing, payment, fund administration, ERP hosting and other providers whose output affects customers' financial statements, often at the request of SOX-regulated customers.
Why it matters
Without one, a customer's auditor may have to test your controls directly, which is slow and disruptive for both sides.
Key objectives
Describe the service and control objectives
Show controls are designed to meet them
Test operating effectiveness over a period (Type II)
Sarbanes-Oxley Act of 2002, Sections 302 and 404, with the COSO internal control framework
The Sarbanes-Oxley Act requires public companies to maintain and assess internal control over financial reporting. Section 404 requires management to report on those controls, and for larger filers an external auditor attests to them. Because financial data lives in IT systems, auditors test IT general controls: access to systems, change management, computer operations and program development. SOX does not apply to private IT vendors directly, but customers pass its control demands to them, often by asking for a SOC 1 report.
What it covers, who needs it and why
What it covers
IT general controls over systems that affect financial reporting: user access and segregation of duties, change management, operations, backups and interfaces.
Who needs it
US-listed companies and the IT and SaaS providers that host or run their financial systems.
Why it matters
Weak IT controls are a common cause of reported material weaknesses, and officers personally certify the reports.
Key objectives
Reliable financial reporting
Documented and tested internal controls
Accountability of executives for reported figures
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Congress; SEC and PCAOB
Current version
The 2002 Act; most companies assess internal control against the COSO 2013 framework.
Reserve Bank of India directions on IT governance, cyber security, technology risk and IT outsourcing for regulated entities
RBI requires banks, NBFCs, payment system operators and other regulated entities to govern IT and cyber risk at board level: an IT strategy and IT risk committees, information security and cyber resilience programs, business continuity and disaster recovery, IS audit, and controlled outsourcing of IT services and cloud, with audit and access rights for RBI. IT vendors serving Indian banks and NBFCs inherit many of these duties through contracts. RBI consolidated its instructions into entity-wise directions from late 2025, so the exact source depends on the type of entity.
What it covers, who needs it and why
What it covers
IT governance, information and cyber security, technology risk, BCP and DR, IS audit, and outsourcing of IT services for RBI-regulated entities.
Who needs it
Indian banks, NBFCs and payment entities, and the IT, cloud and SaaS vendors that serve them.
Why it matters
RBI supervises compliance closely, and vendor contracts must carry its audit and access rights.
Key objectives
Board-level IT governance
Managed IT and cyber risk
Controlled outsourcing
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Reserve Bank of India (RBI)
Current version
The 2023 Master Direction on IT governance (effective 1 April 2024) set the current rules. In late 2025 RBI began consolidating its instructions into entity-wise directions (for NBFCs, a 2026 cybersecurity and technology risk direction), so the guide cites the direction that applies to each entity type.
Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities
SEBI's CSCRF replaces earlier cybersecurity circulars with one framework for stock exchanges, depositories, brokers, mutual funds, portfolio managers and other regulated entities. It sorts entities into categories by size and importance and sets standards across the governance, identify, protect, detect, respond and recover functions, including a security operations center, periodic VAPT, cyber audits and incident reporting. Third-party service providers, including IT vendors, must meet requirements passed down through contracts.
What it covers, who needs it and why
What it covers
Cyber governance, risk, security controls, monitoring, incident response and recovery for SEBI-regulated entities and their technology providers.
Who needs it
Indian securities market entities and the software, cloud and managed security providers that serve them.
Why it matters
It is mandatory for regulated entities and audited, and vendors must support evidence requests.
Key objectives
Cyber resilience across the securities market
Proportional controls by category
Regular testing and audit
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Securities and Exchange Board of India (SEBI)
Current version
Circular of 20 August 2024, with compliance deadlines extended into 2025 and later clarifications.
Train your team on payment and financial data security requirements
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
