The Payment Card Industry Data Security Standard — the security rules any business must follow if it touches raw card numbers. Falling short can mean fines or losing the ability to accept cards at all.