Compliance · PCI DSS
PCI DSS
The security standard for any organisation that stores, processes or transmits payment card data.
What it is
Protecting cardholder data, proportionate to your volume.
PCI DSS sets the controls for handling cardholder data. Your obligations depend on transaction volume and how you handle card data, from a Self-Assessment Questionnaire (SAQ) up to a full Report on Compliance (ROC) signed off by a QSA.
The standard is maintained by the PCI Security Standards Council and organised as twelve requirements under six goals, from building and maintaining a secure network to regularly monitoring and testing it.
Who needs it
Anyone touching card data.
Any merchant or service provider that stores, processes or transmits cardholder data is in scope, including companies that assume their payment provider handles all of it.
Current version
PCI DSS v4 is fully in force.
Version 4 became the only active version of the standard in 2024, and its future-dated requirements became mandatory after 31 March 2025. If your last assessment was planned around the old version, expect new work.
- Multi-factor authentication for all access into the cardholder data environment
- Targeted risk analyses to justify how often certain controls are performed
- Managing and monitoring the scripts on payment pages, for many e-commerce merchants
- Authenticated internal vulnerability scanning
Levels and validation
How you prove compliance depends on your level.
Merchant levels are set by the card brands, based mainly on annual transaction volume, and your acquiring bank confirms which applies and how you must validate. Service providers have their own levels.
- The highest-volume merchants and service providers validate with a Report on Compliance from a Qualified Security Assessor (QSA)
- Most other merchants validate with the Self-Assessment Questionnaire that matches how they take payments
- Many organisations also need quarterly external vulnerability scans by an Approved Scanning Vendor (ASV)
Scope reduction
The cheapest control is the one you no longer need.
Every system that stores, processes or transmits card data, or can affect its security, is in scope. Shrinking that footprint is usually the fastest way to make PCI DSS manageable.
- Hosted payment pages or embedded payment fields, so card data never touches your servers
- Tokenisation, so the systems you run hold tokens rather than card numbers
- Point-to-point encryption for card-present payments
- Network segmentation that keeps the cardholder data environment small, and tested to prove it
How we help
Reduce the scope, then prove it.
- Scope the environment and, crucially, reduce that scope wherever possible
- Implement the required controls and assemble evidence
- QSA assessment delivered through certified assessment partners where a ROC is needed
- Maintain controls and evidence continuously between assessments
FAQ
Questions buyers actually ask
- Not automatically. Outsourcing payments can shrink your scope dramatically, often down to one of the shorter Self-Assessment Questionnaires, but you remain responsible for validating compliance for whatever is left, including the website or systems that hand customers over to the provider.
- A Self-Assessment Questionnaire (SAQ) is how most merchants validate: you assess yourself against the requirements that apply to your payment setup. A Report on Compliance (ROC) is a full assessment by a Qualified Security Assessor, required for the highest-volume merchants and service providers.
- Version 4 replaced 3.2.1 in 2024, and its future-dated requirements became mandatory after 31 March 2025. Notable changes include multi-factor authentication for all access into the cardholder data environment, targeted risk analyses, authenticated internal scanning, and controls over scripts on payment pages for many e-commerce merchants.
- The card brands define the levels, mainly by annual transaction volume, and your acquiring bank tells you which level applies and how you must validate. If you are unsure, your acquirer is the authoritative source.
- A Qualified Security Assessor (QSA) is a company certified by the PCI Security Standards Council to perform PCI DSS assessments. An Approved Scanning Vendor (ASV) is certified to run the quarterly external vulnerability scans many organisations need. Threat Protect delivers QSA assessment through certified assessment partners where a ROC is required.
Handling card data?
We’ll help you work out your real scope first. It is usually smaller, and cheaper, than companies expect.
Book a call