PCI DSS

Who has to comply

Merchants, service providers, acquirers, issuers and any other entity that stores, processes or transmits cardholder data or sensitive authentication data, or that could affect its security.

Which validation applies (a QSA Report on Compliance or a Self-Assessment Questionnaire) is set by each card brand and the acquirer, usually by annual transaction volume; merchant and service provider levels are card-brand rules, not part of PCI DSS.

What you have to write

Documents on this site that PCI DSS requires or expects, each with who must have it, the review cycle and the obligations that cite it.

• Business Continuity and Disaster Recovery Plan Information security
• Incident Response Plan Information security

What the assessor asks to see

CDE scope, network and data flow diagrams; asset inventory; information security policy and procedures per requirement; firewall and configuration standards; encryption and key management documentation; vulnerability scan and penetration test reports; access control lists and MFA evidence; log samples and daily review records; change control records; secure development evidence; physical security records; awareness training; incident response plan and test; third-party service provider list and responsibility matrix; prior ROC, SAQ and AOC.

Where the requirement sits: 12.1.1 policy reviewed annually; 12.6.3 awareness training at hire and annually with acknowledgment; 12.10 IR plan. Technical: 5, 10 (logging), 11 (scanning)

Self-Assessment Questionnaires under v4.0.1

Ten SAQs exist: SAQ A (card-not-present, fully outsourced payment page; since March 31, 2025 the merchant must confirm its site is not susceptible to attacks from scripts that could affect its e-commerce system, and external ASV scans every three months are included), SAQ A-EP (e-commerce where the merchant site affects the payment page), SAQ B (imprint or standalone dial-out terminals), SAQ B-IP (standalone PTS-approved IP-connected terminals), SAQ C (payment application systems connected to the internet), SAQ C-VT (virtual terminal on a single computer), SAQ P2PE (validated P2PE solution only), SAQ SPoC (software-based PIN entry on COTS), SAQ D for Merchants (all other merchants) and SAQ D for Service Providers (the only SAQ for eligible service providers).

Eligibility is set by the SAQ instructions and the acquirer.

Version timeline

PCI DSS v3.2.1 was retired March 31, 2024. v4.0.1 was published June 11, 2024 as a limited revision correcting v4.0, which was retired December 31, 2024. The 51 requirements that were best practice under v4.0 became mandatory on March 31, 2025.

Check the PCI SSC document library for any later revision.