PCI DSS guide
PCI DSS 4.0.1 compliance: requirements, SAQs and assessors
PCI DSS, the Payment Card Industry Data Security Standard, sets technical and operational requirements for protecting payment card data. It applies to all entities that store, process or transmit cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment.
The PCI Security Standards Council (PCI SSC) maintains the standard. The card brands and acquirers, not the Council, decide who must validate compliance and how. The current version is PCI DSS v4.0.1.
Published 6 November 2026. This guide is general information, not legal advice.
Who PCI DSS applies to
Merchants, payment processors, acquirers, issuers and service providers that handle payment card data are in scope, and so is any service provider that can affect the security of that data, such as a hosting or managed security provider. Your acquirer or the card brands tell you which validation you need, usually based on how many card transactions you handle.
The 12 requirements
- Install and maintain network security controls
- Apply secure configurations to all system components
- Protect stored account data
- Protect cardholder data with strong cryptography during transmission over open, public networks
- Protect all systems and networks from malicious software
- Develop and maintain secure systems and software
- Restrict access to system components and cardholder data by business need to know
- Identify users and authenticate access to system components
- Restrict physical access to cardholder data
- Log and monitor all access to system components and cardholder data
- Test security of systems and networks regularly
- Support information security with organizational policies and programs
What changed with v4.0.1
PCI DSS v4.0.1, published on 11 June 2024, is a limited revision that clarifies wording and adds no new requirements. Version 4.0 was retired on 31 December 2024, so v4.0.1 is the only active version.
The requirements that v4.0 marked as best practice until 31 March 2025 have been mandatory since that date. They include multi-factor authentication for all access into the cardholder data environment, authenticated internal vulnerability scans and controls over scripts on payment pages.
In January 2025 the Council revised SAQ A, the questionnaire for e-commerce merchants that fully outsource card entry. It removed the payment page script requirements from SAQ A and added an eligibility criterion: the merchant must confirm its site is not susceptible to attacks from scripts that could affect its e-commerce systems.
How validation works
- Report on Compliance (ROC): an assessment documented by a Qualified Security Assessor (QSA), or by an Internal Security Assessor (ISA) where your acquirer or the brands allow it
- Self-Assessment Questionnaire (SAQ): for entities allowed to self-assess, with the SAQ type depending on how you accept cards
- ASV scans: external vulnerability scans at least once every three months by a PCI SSC Approved Scanning Vendor (requirement 11.3.2)
- Customized approach: meeting a requirement's objective with your own controls, backed by a targeted risk analysis and reviewed by your assessor
What good PCI DSS help looks like
Most PCI work starts with scope. Reducing where card data flows, for example by using a payment provider's hosted payment page, can shrink the requirements that apply to you. Consultants and vCISOs help with scoping, gap assessments, policies and remediation; a QSA company listed by the PCI SSC performs the formal assessment.
Confirm with your acquirer which validation you need before you start, and check any assessor against the PCI SSC list of Qualified Security Assessors.
How CISO Talents helps
At launch you can post a penetration test request with PCI DSS as the compliance driver, covering the internal and external testing that requirement 11.4 asks for, or a vCISO request for the wider programme. Verified testers, consultants and firms who list PCI DSS work see it with the reason it matched, and reply in a common format.
Frequently asked questions
Who needs to be PCI DSS compliant?
Any entity that stores, processes or transmits cardholder data or sensitive authentication data, or that can affect the security of the cardholder data environment. That includes merchants of every size and their service providers. Your acquirer or the card brands decide how you validate.
What is the difference between an SAQ and a ROC?
A Self-Assessment Questionnaire (SAQ) is completed by the entity itself. A Report on Compliance (ROC) documents an assessment by a Qualified Security Assessor, or an Internal Security Assessor where allowed. Your acquirer or the card brands decide which one you need.
Is PCI DSS a law?
No. PCI DSS is an industry standard enforced through contracts with the card brands and acquirers. A few US state laws refer to it, but the obligation usually comes from your merchant or service agreement.
