ZCybersecurity

Compliance › PCI DSS

PCI DSS

PCI DSS: what it requires, how compliance is validated and who should help

Your acquirer, processor or a customer has asked for PCI DSS compliance. This guide explains what the standard requires, who actually enforces it, what changed in version 4.0.1, how to find your level and SAQ, what drives the cost and how to choose help, before you request a single quote.

Tell Us What You NeedSee the compliance path

Free for buyers · provider-funded introductions · Updated October 2026

PCI DSS at a glance
What it isA security standard for organizations that handle payment card data
Written byThe PCI Security Standards Council
Enforced byPayment brands and acquirers, not the Council
Current versionPCI DSS v4.0.1, published 11 June 2024
Structure12 requirements under six goals
ValidationA SAQ, or an assessor report, as your acquirer requires
Legally requiredMainly contractual, set through your acquirer
Start here

Where are you in the PCI DSS process?

Pick the question you are stuck on and jump straight to it.

01 · Just asked

My acquirer asked for PCI compliance

Work out what is being requested and who is asking.

What PCI DSS is →02 · Your level

Which level and which SAQ am I?

How levels and questionnaires map to the way you take cards.

Levels and SAQs →03 · Which version

Which version applies today

Version 3.2.1 is retired. See what 4.0.1 requires now.

The current version →04 · The route

How compliance works

Eight steps from mapping card data to annual revalidation.

The compliance path →05 · The bill

What drives the cost

The levers that move the price, with no invented figures.

Cost drivers →06 · The team

Who should help

QSA, scanning vendor, consultant and platform: who does what.

Choosing help →
The basics

What PCI DSS is, and what it is not

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for organizations that store, process or transmit payment card data, or that can affect the security of the systems that do. It is written and maintained by the PCI Security Standards Council (PCI SSC).

Two points surprise first-time buyers. First, the Council does not enforce compliance. It says that is carried out by the individual payment brands, and it points you to your acquirer or the brands for your validation requirements. Second, it is mainly a contractual obligation, passed down from the brands through your acquirer or processor.

It applies to merchants of every size, payment service providers, processors and any company whose systems touch card data, including SaaS and e-commerce businesses.

Signs you need it now

  • The contract: your acquirer or processor asks for evidence of compliance.
  • The new channel: you are about to take cards online or in person.
  • The enterprise buyer: a customer asks a service provider for an Attestation of Compliance.
  • The renewal: your annual validation is coming due.
  • The version: your last assessment was against an older version.
Who decides

Who sets, who enforces and who you answer to

Most confusion about PCI comes from not knowing who the rules come from.

Who sets and enforces PCI DSSWho sets and enforces PCI DSS. The PCI Security Standards Council writes PCI DSS and qualifies assessors, and does not enforce compliance or set penalties. The payment brands run the compliance programs and set the validation rules and any penalties. Your acquirer, which is your bank, tells you your level and what to submit, and passes brand rules on. You build and keep the controls and validate with a self-assessment questionnaire or an assessor report. Ask your acquirer or payment brand what you must submit.PCI SSCWrites PCI DSS andqualifies assessors.Does not enforceor fine.Payment brandsRun the complianceprograms, set thevalidation rulesand any penalties.Your acquirerYour bank. Tells youyour level and whatto submit, andpasses brand rules on.YouBuild and keep thecontrols. Validatewith a SAQ or anassessor report.standardrulescontractAsk your acquirer or payment brand what you must submit.
The Council writes the standard. The brands and your acquirer decide what you submit.

The Council qualifies assessors and does not receive copies of compliance reports. It does not set assessor fees. To find out what you must submit and by when, contact your acquirer or payment brand. Source: the PCI Security Standards Council.

What is inside

The 12 PCI DSS requirements under six goals

A structure with 12 headline requirements. The detail sits in the sub-requirements. For a longer walk-through, read the PCI DSS 4.0 requirements guide.

The 12 PCI DSS requirements under six goalsThe twelve PCI DSS requirements grouped under six goals. Secure network and systems: 1 network security controls, 2 secure configurations. Protect account data: 3 protect stored account data, 4 encrypt data in transit. Vulnerability management: 5 protect against malware, 6 secure systems and software. Strong access control: 7 restrict access by need to know, 8 identify and authenticate users, 9 restrict physical access. Monitor and test networks: 10 log and monitor all access, 11 test security regularly. Information security policy: 12 policies and programs.Secure network and systems1Network security controls2Secure configurationsProtect account data3Protect stored account data4Encrypt data in transitVulnerability management5Protect against malware6Secure systems and softwareStrong access control7Restrict access by need to know8Identify and authenticate users9Restrict physical accessMonitor and test networks10Log and monitor all access11Test security regularlyInformation security policy12Policies and programsSix goals, twelve requirements. Each has sub-requirements an assessor tests.
The 12 requirements, grouped under the six goals.
PCI DSS terms explained
TermWhat it meansWhere it comes from
RequirementOne of 12 principal requirements, such as protecting stored account dataPCI DSS
Sub-requirementA detailed test under a requirement, which an assessor checksPCI DSS
Defined approachMeeting a requirement exactly as writtenPCI DSS
Customized approachMeeting the stated objective with different controls, with extra documentationIntroduced in PCI DSS v4.0
SAQSelf-Assessment Questionnaire used to validate compliancePCI SSC documents, required by your acquirer or brand
ROCReport on Compliance written by a QSA after an on-site assessmentAssessor, where your acquirer or brand requires it
AoCAttestation of Compliance, the signed summary you submitYou or your assessor
Version

PCI DSS v4.0.1: what changed and why v3.2.1 no longer applies

If an older page tells you to prepare for v4.0 deadlines, it is out of date.

PCI DSS v3.2.1, v4.0 and v4.0.1 compared
Itemv3.2.1v4.0v4.0.1
StatusRetired 31 March 2024Retired 31 December 2024Current
PublishedEarlier versionMarch 202211 June 2024
What it didThe previous baselineReorganized the standard, added the customized approach and added 64 new requirements, 51 of them future-datedA limited revision: corrections and clarifications, with no new or deleted requirements
Future-dated requirementsNot applicableTreated as best practice until the dateMandatory from 31 March 2025, the date unchanged from v4.0

Dates are from the PCI Security Standards Council. A 2026 request for comments on v4.0.1 has been reported by industry sources. That is not a new version, and current assessments run against v4.0.1. Check the Council website for the latest before you plan.

Levels and SAQs

Which PCI level and SAQ apply to you

Your level decides how you validate. Your acquirer decides your level.

Typical PCI merchant levels and validation
LevelCommonly published triggerTypical validation
Level 1More than about 6 million card transactions a yearAn on-site assessment by a QSA with a Report on Compliance, plus external scans
Level 2About 1 million to 6 millionA SAQ, with scans where the SAQ requires them
Level 3About 20,000 to 1 million e-commerce transactionsA SAQ, with scans where the SAQ requires them
Level 4Below the Level 3 volumesA SAQ, as your acquirer requires
Service providersSeparate levels, with Level 1 commonly cited above about 300,000 transactionsOften a QSA report at the top level, and a SAQ below it

These thresholds are commonly published for Visa volumes, and other brands use their own figures. Treat them as orientation only, and ask your acquirer for your level in writing.

Which SAQ fits how you take cardsStarting points for which PCI DSS self-assessment questionnaire fits how you take cards. A fully outsourced payment page or redirect: SAQ A. Your site serves part of the payment page: SAQ A-EP. Imprint machines or dial-out terminals only: SAQ B. Standalone approved IP-connected terminals: SAQ B-IP. Keying cards into a web virtual terminal: SAQ C-VT. A payment application on your network: SAQ C. Validated point-to-point encryption terminals: SAQ P2PE. You store card data, or nothing else fits: SAQ D. These are starting points only, and your acquirer confirms which SAQ you may use.Payment page fully outsourced, or a redirectSAQ AYour site serves part of the payment pageSAQ A-EPImprint machines or dial-out terminals onlySAQ BStandalone approved IP-connected terminalsSAQ B-IPKeying cards into a web virtual terminalSAQ C-VTA payment application on your networkSAQ CValidated point-to-point encryption terminalsSAQ P2PEYou store card data, or nothing else fitsSAQ DStarting points only. Your acquirer confirms which SAQ you may use.
Which questionnaire usually fits how you take cards.

Using a hosted checkout can shrink your scope, but it does not remove your obligations. Which SAQ applies depends on how your payment page is built and how card data reaches you, so confirm it with your acquirer before you assume the shortest one. For every SAQ type and the level thresholds, read the PCI levels and SAQ guide.

The route

How PCI DSS compliance works: 8 steps from scoping to annual revalidation

You do most of the work. A QSA does the assessment only where it is required.

The PCI DSS compliance path in eight stepsThe PCI DSS compliance path in eight steps. One, confirm with your acquirer your level and the validation you owe. Two, map card data: find every system that stores, processes or transmits it. Three, reduce scope by outsourcing, tokenising or segmenting to shrink the card data environment. Four, run a gap assessment against PCI DSS v4.0.1. Five, remediate gaps and build the policies and evidence. Six, validate with a self-assessment questionnaire or a QSA report on compliance where required. Seven, submit the Attestation of Compliance as your acquirer instructs. Eight, keep it going with scans, reviews and annual revalidation. Scope drives the work, so shrink it before you assess.1ConfirmAsk your acquirer foryour level and thevalidation you owe2Map card dataFind every system thatstores, processes ortransmits card data3Reduce scopeOutsource, tokeniseor segment to shrinkthe card data zone4Gap assessmentTest current controlsagainst PCI DSSv4.0.15RemediateFix gaps and buildthe policies andevidence6ValidateA SAQ, or a QSAreport (ROC) whererequired7SubmitSend the Attestationof Compliance as youracquirer instructs8Keep it goingScans, reviews andannual revalidationScope drives the work. Shrink it before you assess.
The eight-step path, from confirming your level to annual revalidation.
PCI DSS compliance path: step, what happens and who does it
StepWhat happensWho
1. ConfirmAsk your acquirer for your level and the validation you oweYou and your acquirer
2. Map card dataTrace every system, person and process that touches card dataYou
3. Reduce scopeOutsource, tokenize or segment so fewer systems are in scopeYou
4. Gap assessmentTest current controls against PCI DSS v4.0.1You, a consultant or a QSA
5. RemediateFix gaps, write policies and collect evidenceYou
6. ValidateComplete the SAQ, or have a QSA assess and write a ROCYou or a QSA
7. SubmitSend the Attestation of Compliance as your acquirer instructsYou
8. Keep it goingRun required scans, review controls and revalidate each yearYou
Cost

What drives the cost of PCI DSS compliance

Seven levers, in the order they usually matter.

  • Scope: how many systems, networks, people and locations touch card data.
  • Validation type: a SAQ you complete, or a QSA assessment with a Report on Compliance.
  • Channels: e-commerce, in-store, phone orders and service-provider functions each add scope.
  • Outsourcing and tokenization: a design that keeps card data off your systems can shrink the work.
  • Remediation: segmentation, multi-factor authentication, logging, encryption and patching gaps.
  • Testing: external scans where required and penetration testing and internal scanning, which the standard also covers.
  • The yearly cycle: revalidation, scans and evidence every year, not once.

Published PCI cost ranges are mostly unsourced and vary widely, so we do not repeat them. For a regional view, see the PCI DSS cost guide for India and the UAE guide. To compare quotes, give each provider the same scope and ask for a full-year price. For the seven parts of the bill, how scope moves effort and the questions to ask, read the PCI DSS compliance cost guide.

Who does what

QSA, ASV, consultant or platform: who does what in PCI DSS

Four roles that vendor content blurs together.

PCI DSS roles compared: QSA, ISA, ASV, consultant and platform
RoleWhat it doesCan it validate your compliance?
QSA (Qualified Security Assessor)A company qualified by the Council to assess you and write the Report on ComplianceYes, where a QSA assessment is required
ISA (Internal Security Assessor)A staff member trained under the Council program to support internal assessmentSupports it. Ask your acquirer what it accepts
ASV (Approved Scanning Vendor)Runs the external vulnerability scans some validation requiresOnly the scan part
ConsultantScopes, finds gaps and helps you fix themNo
Compliance platformTracks evidence, policies and tasksNo

Some firms offer several roles. That is not wrong, but ask who assesses you, whether the same firm sells the remediation and how it handles that conflict. Browse providers on our pages for PCI DSS consulting and Dubai and the UAE.

Every PCI DSS guide in one place

PCI DSS guides and provider pages

More guides are added here as they are published.

Cost
PCI DSS compliance cost: what drives the price
Levels
PCI DSS levels and SAQ types
Requirements
The 12 PCI DSS 4.0 requirements
Guide
First-timer guide to PCI DSS certification
Scope
PCI DSS network segmentation
Cost
PCI DSS cost in India
Cost
PCI DSS cost in Dubai and the UAE
Providers
PCI DSS compliance consultants
Providers
PCI DSS service in Dubai and the UAE
Related hub
ISO 27001: certification and cost
Related hub
SOC 2: audits and readiness
FAQ

PCI DSS questions buyers ask us

Short answers to the questions buyers ask before they start.

What is PCI DSS?
The Payment Card Industry Data Security Standard is a set of security requirements for organizations that store, process or transmit payment card data, or that can affect its security. The PCI Security Standards Council writes and maintains it.
Is PCI DSS a law?
Not by itself. It is mainly a contractual obligation passed down from the payment brands through your acquirer or processor. Some other rules may refer to it, so check what applies to you.
Who has to comply with PCI DSS?
Merchants of any size that accept cards, payment service providers, processors and any organization whose systems store, process or transmit card data or could affect its security.
Who enforces PCI DSS?
The payment brands and your acquirer. The PCI Security Standards Council says it does not enforce compliance or define validation reporting requirements, and points you to your acquirer or the brands.
What is the current version of PCI DSS?
PCI DSS v4.0.1, published on 11 June 2024. Version 3.2.1 was retired on 31 March 2024, v4.0 on 31 December 2024, and the future-dated requirements became mandatory on 31 March 2025.
How many PCI DSS requirements are there?
Twelve principal requirements grouped under six goals, each with sub-requirements that an assessor tests. See the PCI DSS 4.0 requirements guide.
What are the PCI DSS levels?
Merchant levels run from 1 to 4 and are based on card transaction volume, with service providers having their own levels. Brands set the thresholds and your acquirer tells you your level, so ask for it in writing.
What is a SAQ, a ROC and an AoC?
A SAQ is a self-assessment questionnaire. A ROC is a Report on Compliance written by a QSA after an on-site assessment. An AoC is the signed Attestation of Compliance you submit. Which you need depends on your acquirer and level, and validation is generally repeated each year.
Do I need a QSA?
Only if your acquirer or payment brand requires an assessor-led validation, which is typical at the highest level. Many smaller organizations validate with a SAQ. Ask your acquirer.
Does using Stripe, Shopify or another hosted checkout make me PCI compliant?
It can reduce your scope, but it does not remove your obligations. You usually still validate, often with a shorter SAQ, depending on how you integrate. Confirm with your acquirer.
How much does PCI DSS compliance cost?
It depends on scope, validation type, channels, remediation and testing, and it repeats each year. We do not quote ranges, because published figures are mostly unsourced. See the India cost guide and the UAE cost guide.
What happens if I am not compliant?
The Council does not fine organizations. Consequences come from the brands and your acquirer under their programs, which can include fees or restrictions. Ask your acquirer what applies to you.
Start here

Start with the requirement, not the assessor.

Requirement→Scope→Price→Matched provider
Tell Us What You Need

Free for buyers · provider-funded introductions · Reviewed October 2026 by the ZCyberSecurity compliance team

\n
Scroll to Top