Also called: Visa Cardholder Information Security Program, CISP
What Visa CISP is
CISP stands for Visa Cardholder Information Security Program. Visa materials use the name for a program that applies PCI DSS security requirements to entities that store or process Visa card or account data, including merchants and service providers.
CISP is a Visa program label, not a separate technical security standard. Older Visa merchant guidance describes CISP as Visa's implementation of PCI DSS. That distinction matters if a form or provider still uses the CISP name: the security work concerns protecting cardholder data and meeting applicable PCI DSS requirements.
CISP is Visa's program label; PCI DSS is the security standard your business must validate against.
How CISP relates to PCI DSS
PCI DSS is the industry security standard maintained by the PCI Security Standards Council. Visa manages its own compliance and validation requirements for participants in its payment system. In practice, CISP points to Visa's program for applying and validating PCI DSS, rather than adding a second technical standard for your business.
PCI DSS v4.0.1 is the current version as of 2026. The 51 future-dated requirements from PCI DSS v4.0 became mandatory on March 31, 2025, including controls for e-commerce payment-page scripts and multi-factor authentication for access into the cardholder data environment. A CISP label does not replace current PCI DSS validation.
What it means for your costs and risk
CISP is not a transaction fee, and the available Visa guidance does not set a CISP-specific merchant fee or statement line. Your direct concern is security exposure: failing to protect card data or complete required validation can leave your business out of compliance and increase the consequences of a data compromise.
A processor's monthly PCI non-compliance fee is a separate charge, not a Visa CISP fee. If you see that fee on your statement, check whether your business has completed its required validation and whether the charge stops after your compliance status is updated. The amount and statement wording depend on the processor.
What you can actually change
You cannot change Visa's security requirements, but you can reduce the amount of card data your business holds and keep your compliance records current. Focus on these practical steps:
- Inventory where your business stores or transmits cardholder data, and limit access to employees who need it.
- Delete card data you do not need, and protect required data with appropriate security controls.
- Complete the PCI DSS validation required for your business and retain the resulting compliance documents.
- Review your statement for a monthly PCI non-compliance fee, then confirm the validation issue is resolved if you are being charged.
- Map card data. List the systems, vendors, and locations that store, process, or transmit your customers' card information.
- Finish validation. Confirm your business has completed the PCI DSS assessment and documentation required for its situation.
- Check the fee line. If your statement includes a PCI non-compliance fee, verify that your latest compliance status has been recorded.
Frequently asked questions
What does Visa CISP stand for?
CISP stands for Visa Cardholder Information Security Program. Visa materials use the name for its program applying PCI DSS security requirements to entities that handle Visa card or account data.
Is Visa CISP the same as PCI DSS?
No. PCI DSS is the industry security standard maintained by the PCI Security Standards Council. CISP is Visa's program name for applying and validating those requirements within its payment system.
Does Visa CISP add a fee to my processing statement?
CISP is not a transaction fee, and the Visa guidance does not specify a CISP-specific merchant charge. A monthly PCI non-compliance fee from your processor is separate, so check your validation status if you see one.