Can I Do PCI Compliance Myself? (w/Examples) + FAQs

Yes, you can handle PCI compliance yourself in most cases. The majority of businesses—especially those classified as Level 3 or Level 4 merchants processing fewer than one million card transactions annually—can complete their own Self-Assessment Questionnaire (SAQ) without hiring a Qualified Security Assessor (QSA). However, the ability to do it yourself depends on your merchant level, how you accept payments, and your technical expertise.

The Payment Card Industry Data Security Standard (PCI DSS) requires all businesses that store, process, or transmit cardholder data to maintain specific security controls. Under PCI DSS Requirement 12, organizations must document security policies and undergo annual validation. Non-compliance triggers escalating monthly fines from $5,000 to $100,000 imposed by acquiring banks and payment processors.

A striking statistic reveals the stakes: only 29% of companies remain compliant one year after their initial validation. This means 71% of businesses slip out of compliance, exposing themselves to fines, breach liability, and potential loss of payment processing privileges.

In this article, you will learn:

🔐 Which merchant level you fall under and what DIY compliance options apply to your business

📋 How to select and complete the correct Self-Assessment Questionnaire for your payment setup

💰 The real costs of DIY compliance versus hiring professionals—and when each makes sense

⚠️ Common mistakes that cause businesses to fail compliance and how to avoid them

📜 State-specific data breach notification laws that add compliance layers beyond federal PCI requirements

Understanding PCI DSS Merchant Levels

Your merchant level determines whether you can self-assess or need external auditing. The payment card brands—Visa, Mastercard, American Express, and Discover—define four merchant levels based on annual transaction volume.

Level 1: Over 6 Million Transactions Annually

Level 1 merchants face the strictest requirements. These businesses must undergo an annual on-site assessment by a PCI SSC-approved Qualified Security Assessor and complete a Report on Compliance (ROC). You cannot self-assess at this level.

Any merchant that experiences a data breach resulting in account data compromise automatically becomes Level 1, regardless of transaction volume. The card brands can also designate any merchant as Level 1 at their discretion.

Level 2: 1 Million to 6 Million Transactions Annually

Level 2 merchants can complete an annual Self-Assessment Questionnaire. However, Mastercard requires that Level 2 merchants completing SAQ A, SAQ A-EP, or SAQ D must additionally engage a QSA or Internal Security Assessor (ISA) for compliance validation.

These merchants must also conduct quarterly external vulnerability scans by an Approved Scanning Vendor (ASV) and perform annual penetration tests. Compliance involves more work than lower levels but remains largely self-directed.

Level 3: 20,000 to 1 Million Transactions Annually

Level 3 merchants have comparatively lower compliance requirements. They must complete an annual SAQ and conduct quarterly ASV scans. This level applies specifically to e-commerce merchants processing between 20,000 and one million transactions.

Most Level 3 merchants can handle compliance entirely in-house with basic technical knowledge and proper documentation practices.

Level 4: Fewer Than 20,000 Transactions Annually

Level 4 represents the lowest compliance tier. These very low-volume merchants complete an annual SAQ and may need quarterly ASV scans depending on their payment processing setup. Requirements for Level 4 merchants are the least stringent, though compliance remains mandatory.

The 12 PCI DSS Requirements Explained

PCI DSS 4.0 contains 12 core requirements organized under six security objectives. Understanding these requirements helps you determine whether your technical skills match the compliance workload.

Building and Maintaining a Secure Network

Requirement 1: Install and maintain network security controls. You must deploy firewalls and segment networks to isolate card data from other traffic. Your IT team should review firewall traffic and router configurations every six months.

Requirement 2: Apply secure configurations. Change default passwords on all systems, remove unnecessary services, and harden system settings. Failure to change vendor defaults remains one of the most common compliance failures because attackers know factory-set credentials.

Protecting Cardholder Data

Requirement 3: Protect stored account data. Unless business function requires it, do not store cardholder data. If you must store it, encrypt the data at rest, implement tokenization where possible, limit storage time, and purge data quarterly. Never store sensitive authentication data like CVV codes or full magnetic stripe data after authorization.

Requirement 4: Encrypt data in transit. Use TLS 1.2 or higher for all payment flows across open networks. Data moving between your systems and payment processors must remain encrypted throughout transmission.

Maintaining a Vulnerability Management Program

Requirement 5: Protect against malware. Deploy and maintain anti-malware software on all systems that handle card data. PCI DSS 4.0 specifies that organizations must use advanced malware protection mechanisms with detect-and-respond capabilities.

Requirement 6: Develop secure systems and applications. Keep systems patched, use secure coding practices, and manage vulnerabilities. This requirement received significant updates in PCI DSS 4.0, particularly regarding payment page script security.

Implementing Strong Access Control

Requirement 7: Restrict access by business need-to-know. Implement role-based access controls and least-privilege principles. Only people who need cardholder data for business operations should have access.

Requirement 8: Identify and authenticate users. Every user accessing cardholder data must have a unique ID. PCI DSS 4.0 mandates multi-factor authentication (MFA) for all access to the cardholder data environment—not just administrators.

Requirement 9: Restrict physical access. Secure server rooms, implement visitor controls, and properly destroy media containing card data. Paper copies of credit card information require the same level of physical security as electronic data.

Monitoring and Testing Networks

Requirement 10: Log and monitor access. Maintain comprehensive logs with daily review and real-time monitoring. PCI DSS requires retaining these logs for at least one year for potential future investigations.

Requirement 11: Test security regularly. Conduct quarterly vulnerability scans and annual penetration testing. External vulnerability scans must be performed by an Approved Scanning Vendor certified by the PCI Council.

Maintaining an Information Security Policy

Requirement 12: Maintain security policies. Document procedures, train employees, and review policies annually. This requirement marries PCI DSS to broader IT governance and includes background checks for employees with access to cardholder data.

Selecting the Right Self-Assessment Questionnaire

The SAQ you complete depends on how your business handles payment card data. Choosing the wrong questionnaire creates significant problems. If you incorrectly use SAQ A instead of SAQ A-EP, you might fail to implement over 100 security controls that your environment actually requires.

SAQ A: Fully Outsourced Card Functions

SAQ A applies to merchants who outsource all cardholder data functions to validated third-party service providers. You cannot store, process, or transmit cardholder data on-site. This questionnaire contains approximately 24 requirements—the fewest of any SAQ.

Recent PCI SSC updates created new eligibility requirements. Merchants must now self-attest that their site is not susceptible to attacks from scripts that could affect e-commerce systems. Many merchants lack the technical expertise to accurately assess script vulnerabilities, potentially disqualifying them from SAQ A.

SAQ A-EP: E-Commerce with Website Impact

SAQ A-EP applies to e-commerce merchants who outsource payment processing but whose websites impact transaction security. You do not directly receive account data, but you control how customers redirect to a third-party payment processor or embed a payment iframe.

The difference between SAQ A and SAQ A-EP creates confusion. SAQ A-EP contains approximately 140 requirements—vastly more than SAQ A’s 24. Merchants incorrectly claiming SAQ A eligibility face remediation costs when discovered.

SAQ B: Imprint Machines and Dial-Out Terminals

SAQ B applies to brick-and-mortar or mail/telephone order merchants using only imprint machines or standalone dial-out terminals. You cannot transmit cardholder data over a network and cannot store electronic cardholder data.

This questionnaire suits businesses with simple, older payment acceptance methods that remain disconnected from internet-connected systems.

SAQ B-IP: Standalone IP-Connected Terminals

SAQ B-IP covers merchants using standalone, IP-connected point-of-sale terminals. The terminals connect to the internet for authorization but remain isolated from other systems in your environment.

These merchants do not store cardholder data electronically and do not transmit unencrypted data over networks beyond the terminal itself.

SAQ C: Payment Application Systems

SAQ C applies to merchants with payment application systems connected to the internet but not connected to other systems. Brick-and-mortar and mail/telephone order merchants can use this questionnaire. E-commerce merchants and service providers cannot.

SAQ C environments have more complexity and risk than those qualifying for SAQ B or B-IP, requiring additional controls around network security.

SAQ C-VT: Virtual Terminals

SAQ C-VT covers merchants who manually enter single transactions via keyboard into an internet-based virtual terminal solution. You access the virtual terminal through a web browser on a personal computer connected to the internet.

This questionnaire suits businesses that key-enter card numbers provided over the phone or through other out-of-band methods.

SAQ D: All Other Merchants

SAQ D serves as the catch-all for merchants who do not fit other categories. This is the most comprehensive questionnaire with 330+ questions covering all PCI DSS requirements.

Completing SAQ D requires thorough assessment of your payment processing environment, including network security, data protection measures, and access controls.

SAQ P2PE: Validated Point-to-Point Encryption

SAQ P2PE applies to merchants using hardware payment terminals included in a PCI-validated Point-to-Point Encryption solution. This questionnaire contains only 33 questions—a 90% reduction from SAQ D.

Using a validated P2PE solution significantly reduces compliance scope because clear cardholder data never enters your systems.

DIY Compliance: Real-World Scenarios

Understanding practical scenarios helps you assess whether self-managed compliance fits your situation. These examples illustrate the action-consequence relationships in DIY PCI compliance.

Scenario 1: Small E-Commerce Store Using Stripe

Maria runs an online boutique processing 500 transactions monthly. She uses Stripe Checkout, which hosts payment fields on Stripe’s servers. Customers enter card data directly into Stripe’s PCI DSS-validated interface.

Maria can handle compliance herself. Stripe provides a prefilled SAQ and guided compliance flow through its dashboard. Her main risk comes from unknowingly adding scripts to payment pages that could affect her SAQ A eligibility.

Scenario 2: Retail Store with Multiple POS Terminals

James operates a sporting goods store with five point-of-sale terminals processing 3,000 monthly transactions. His terminals connect to the internet for authorization but do not connect to his inventory management system.

James can self-assess using SAQ B-IP, but he must engage an Approved Scanning Vendor for quarterly external vulnerability scans. This adds approximately $500-$2,000 annually but remains far cheaper than hiring a QSA.

Scenario 3: Growing SaaS Company Handling Card Data

TechStart processes subscription payments for 50,000 customers, storing card numbers for recurring billing. They process 600,000 annual transactions, placing them at Level 2.

TechStart’s situation requires professional help. While they could technically attempt self-assessment, Mastercard’s Level 2 requirements mandate QSA involvement for SAQ D completion. Their best DIY path involves implementing tokenization to reduce scope and potentially qualify for a simpler SAQ.

Costs of DIY Compliance vs. Hiring Professionals

Understanding the true costs helps you make informed decisions. DIY compliance saves money for smaller merchants but can prove more expensive if done incorrectly.

DIY Compliance Costs for Small Merchants

Small businesses at Levels 3 and 4 can achieve compliance for relatively modest investments:

Employee training: $500-$5,000 annually depending on company size. Budget approximately $50 to $100 per employee per year for security awareness training.

Self-Assessment Questionnaire: $50-$10,000 depending on whether you complete it independently or need consultant guidance. Using payment processor tools like Stripe’s compliance dashboard often reduces this to zero.

Quarterly ASV scans: $500-$2,000 annually, or approximately $200 per IP address.

Network security tools: $2,000-$20,000 annually depending on network complexity. This includes firewalls, intrusion detection, and monitoring solutions.

Data encryption implementation: $500-$5,000 for initial setup plus ongoing maintenance costs.

Policy development and documentation: $1,000-$10,000 for initial creation. Updates cost less annually.

Total DIY costs for small merchants: $5,000-$20,000 annually.

Professional Compliance Costs

Larger organizations or those requiring QSA involvement face higher costs:

Qualified Security Assessor audit: $15,000-$100,000+ depending on business size and complexity. Level 1 merchants report costs from $30,000 to $200,000 annually.

Report on Compliance preparation: $35,000-$200,000 including the QSA assessment, evidence gathering, and remediation support.

Penetration testing: $3,000-$30,000 depending on scope. Annual testing is mandatory for all organizations; service providers need semi-annual testing.

Internal Security Assessor training: Approximately $3,000 for the initial certification course plus annual recertification. This investment can improve assessment efficiency and reduce QSA costs over time.

Cost Comparison Table

Consequences of Non-Compliance

The financial and operational penalties for non-compliance far exceed compliance costs. Understanding these consequences reinforces why DIY compliance requires diligence.

Monthly Fines

Payment processors impose escalating penalties for non-compliance:

Months 1-3: Fines range from $5,000 to $10,000 per month.

Months 4-6: Penalties escalate to $25,000-$50,000 per month.

Beyond 6 months: Businesses face fines up to $100,000 per month.

Card networks may issue fines up to $500,000 per incident. Acquiring banks typically pass these costs to merchants.

Data Breach Liability

A single breach can expose millions of records, triggering:

Forensic investigation costs: $100,000-$500,000+ to determine breach scope and source.

Customer notification expenses: Required by all 50 states, costing $1-$3 per affected individual.

Credit monitoring services: Often mandated for 12-24 months post-breach.

Legal settlements: Class-action lawsuits following major breaches regularly exceed $1 million.

The average cost of a data breach reached $4.44 million in 2025, with U.S. organizations facing the highest per-record costs at $264.

Loss of Processing Privileges

Acquiring banks and payment processors can increase transaction fees or revoke payment processing capabilities entirely. For e-commerce businesses, losing the ability to accept credit cards can mean closure.

Scope Reduction Strategies

Reducing your PCI scope makes DIY compliance more manageable. These strategies minimize the systems and processes you must assess.

Tokenization

Tokenization replaces cardholder data with an irreversible token that has no exploitable value. Systems storing tokens instead of actual cardholder data fall outside PCI DSS requirements.

When implementing tokenization:

• Adopt a PCI-compliant tokenization solution from a trusted provider
• Replace stored Primary Account Numbers with tokens
• Ensure tokens cannot be reversed to retrieve original card numbers
• Verify your tokenization vendor appears on the PCI SSC approved list

Point-to-Point Encryption (P2PE)

PCI-validated P2PE solutions encrypt card data at the point of entry, keeping clear data out of your environment. Merchants using validated P2PE solutions can complete SAQ P2PE with only 33 questions versus 329 in SAQ D.

Benefits of P2PE include:

• Fewer in-store systems, networks, and processes fall within PCI scope
• Reduced annual assessment effort
• Lower ongoing costs for maintaining controls
• Protection against malware capturing card data

Network Segmentation

Proper network segmentation isolates your cardholder data environment from general business networks. Use VLANs or separate hardware to ensure payment processing systems operate independently.

Many retailers fail to effectively isolate their cardholder data environments. Testing segmentation effectiveness regularly ensures its integrity.

Outsourcing Payment Functions

Using payment processors like Square as your merchant of record can eliminate individual compliance validation requirements. Square maintains PCI certification on your behalf, removing the stress of annual updates, expensive audits, and non-compliance fees.

However, outsourcing does not eliminate all responsibilities. Even when using Stripe, Square, or PayPal, merchants remain responsible for:

• Completing the appropriate SAQ
• Securing their networks
• Ensuring service provider compliance
• Monitoring third-party scripts on payment pages

State-Specific Data Breach Notification Laws

Federal PCI DSS compliance represents the baseline. All 50 states have enacted data breach notification laws that create additional compliance requirements.

California: The Benchmark State

California set the standard for breach notification by being the first state to enact such laws in 2002. Under the California Consumer Privacy Act (CCPA), businesses must:

• Notify affected California residents “in the most expedient time possible and without unreasonable delay”
• Report breaches affecting more than 500 residents to the California Attorney General
• Include specific information: business contact details, breach description, types of information compromised, key dates, and credit bureau contacts if Social Security numbers were exposed

California consumers can sue for statutory damages of up to $750 per incident if a breach results from failure to maintain reasonable security procedures. Before suing, consumers must give 30 days written notice and allow cure opportunity.

States with Strict Timing Requirements

Different states impose varying notification deadlines:

Florida: Notification must occur within 30 days of breach determination.

Connecticut: Notice required within 60 days of breach discovery.

Indiana: Private entities must notify within 45 days of discovery.

Louisiana: Maximum 60 days after breach discovery for notification.

Most states: Require notification “without unreasonable delay,” typically interpreted as 30-60 days.

Credit Monitoring Requirements

Under many state laws, where more than 500 individuals are impacted, notice must be provided to credit bureaus. Nearly half of states require notice to state Attorneys General. Several states mandate providing credit monitoring services to affected individuals when Social Security numbers are exposed.

Multi-State Operations

Businesses operating across multiple states must comply with each state’s notification requirements. The applicable jurisdictions depend on:

• Where the company stores data
• States where affected parties reside

This creates complex compliance scenarios where a single breach may trigger different notification requirements across dozens of jurisdictions.

Mistakes to Avoid

Common errors derail DIY compliance efforts. Understanding these pitfalls helps you avoid costly remediation.

Mistake 1: Assuming Third-Party Processors Handle Everything

The problem: Many merchants wrongly believe that using Stripe, Square, PayPal, or Shopify removes all PCI obligations.

The consequence: You remain responsible for completing the appropriate SAQ, securing your networks, and verifying service provider compliance. Failing to do so means non-compliance even with outsourced payment processing.

The solution: Verify your processor’s PCI compliance status. Complete the correct SAQ for your business model. Maintain local security controls on networks and systems that interact with payment processes.

Mistake 2: Treating Compliance as a One-Time Project

The problem: Only 29% of businesses maintain compliance one year after initial validation. Controls drift over time.

The consequence: Annual audits reveal gaps. Remediation costs escalate. Non-compliance fines accumulate.

The solution: Implement continuous monitoring dashboards. Schedule monthly security reviews. Plan annual policy updates. Understand that system modifications may affect PCI scope and require reassessment.

Mistake 3: Storing Card Data Unnecessarily

The problem: Any stored Primary Account Number dramatically increases compliance scope and risk. Some businesses store full card numbers in spreadsheets, emails, or unencrypted databases.

The consequence: You must complete SAQ D with 330+ requirements. Breach exposure increases exponentially. Regulatory fines multiply.

The solution: Implement tokenization. Purge unnecessary card data. Design payment flows that minimize data retention. Never store CVV codes, PINs, or full magnetic stripe data after authorization.

Mistake 4: Completing the Wrong SAQ

The problem: Organizations often assume they fit criteria for simpler questionnaires when they actually qualify for more comprehensive ones. Incorrectly using SAQ A instead of SAQ A-EP means missing over 100 security controls.

The consequence: Failed compliance validation. Required remediation of controls you never implemented. Potential breach due to missing security measures.

The solution: Carefully review eligibility criteria for each SAQ. When uncertain, select the more comprehensive questionnaire. Consult with a QSA for scoping guidance before completing self-assessment.

Mistake 5: Using Default Passwords and Configurations

The problem: 80% of restaurant data breaches involve compromised point-of-sale systems with default credentials. Vendors ship equipment with factory-set passwords that attackers know.

The consequence: Easy unauthorized access to payment systems. Complete compromise of cardholder data. Automatic elevation to Level 1 merchant status following breach.

The solution: Change all default passwords immediately upon installation. Remove unnecessary services. Implement proper disposal procedures for card data storage devices.

Mistake 6: Insufficient Network Segmentation

The problem: Without proper segmentation, every system on your network potentially falls within PCI scope. Many retailers fail to isolate cardholder data environments from general business systems.

The consequence: Scope expands to include inventory systems, employee computers, and other unrelated infrastructure. Compliance costs multiply. Breach impact spreads across entire network.

The solution: Implement robust network segmentation using VLANs or separate hardware. Regularly test segmentation effectiveness. Consider micro-segmentation for enhanced security.

Mistake 7: Ignoring Third-Party Service Provider Compliance

The problem: Businesses overlook the compliance status of their service providers. PCI DSS Requirement 12.8 requires merchants to monitor third-party providers with access to card data.

The consequence: You bear responsibility for ensuring partner compliance. Non-compliant vendors create liability exposure. Breaches at service providers can trigger your notification obligations.

The solution: Maintain an up-to-date list of all service providers. Regularly assess and verify their PCI DSS compliance status. Include clear data security responsibilities in all contracts.

Do’s and Don’ts for DIY PCI Compliance

Do’s

Do map your payment flows completely. Document where card data enters, moves through, and exits your environment. Without accurate scoping, you either over-invest in unnecessary controls or miss critical vulnerabilities.

Do minimize your scope proactively. Move to hosted payment fields, implement tokenization, and eliminate unnecessary card data storage. Smaller scope means simpler compliance.

Do schedule ASV scans before quarter-end. Waiting until the last day creates risk. If a scan fails, you need time for remediation and rescanning to achieve a passing result within the same quarter.

Do train employees on card handling procedures. Human error causes most compliance failures. Regular training on recognizing phishing attempts, maintaining strong passwords, and handling card data reduces risk.

Do document everything. Missing documentation fails audits even with perfect technical controls. Update policies within 30 days of any process change. Maintain organized evidence collection processes.

Don’ts

Don’t store sensitive authentication data post-authorization. CVV codes, PINs, and full magnetic stripe data must never be retained after transaction completion. This is a strict PCI DSS violation.

Don’t rely on manual evidence collection. Manual processes are time-consuming, error-prone, and consume 200+ hours per audit cycle. Use automation platforms that integrate with existing tools.

Don’t ignore physical security. Secure server rooms, implement visitor controls, and properly destroy media containing card data. PCI compliance extends beyond digital measures.

Don’t assume small size exempts you. PCI DSS regulations apply to all businesses processing card payments, regardless of transaction volume. Size affects merchant level but not compliance obligation.

Don’t mix tokenized and non-tokenized data. Keep them separate at every processing stage. When sensitive and tokenized information share systems or databases, PCI scope unintentionally expands.

Pros and Cons of DIY PCI Compliance

Pros

Cost savings for small merchants. DIY compliance costs $5,000-$20,000 annually versus $50,000-$200,000+ for professional services. The savings prove substantial for Level 3 and 4 merchants.

Deeper organizational knowledge. Working through compliance requirements yourself builds institutional understanding of payment security. This knowledge persists and improves ongoing security practices.

Greater control over timelines. You set your own schedule for assessments, remediation, and documentation. External auditors impose their availability constraints.

Faster remediation cycles. When you identify issues yourself, you can fix them immediately without waiting for consultant availability or formal report cycles.

Payment processor support reduces burden. Platforms like Stripe provide customized compliance journeys, prefilled SAQs, and guided flows that simplify self-assessment significantly.

Cons

Risk of incorrect self-assessment. Without expert guidance, you may complete the wrong SAQ, miss requirements, or misinterpret standards. Errors create false compliance that exposes you to breach liability.

No external validation credibility. Self-assessment lacks the independent verification that QSA assessments provide. Some acquiring banks and business partners may require external validation regardless of merchant level.

Technical complexity exceeds internal capability. Requirements like penetration testing, vulnerability scanning, and network segmentation may exceed in-house expertise. Improper implementation creates security gaps.

Time investment diverts from core business. Compliance requires ongoing attention. For small business owners, the hours spent on PCI could generate more value applied elsewhere.

Liability remains fully internal. When you self-assess, you bear complete responsibility for compliance accuracy. QSAs carry errors and omissions insurance that provides some protection.

When to Hire a QSA Despite Eligibility for Self-Assessment

Even when not required, engaging a QSA can prove worthwhile in certain situations:

After a data breach. Post-breach forensics and remediation benefit from expert guidance. Card brands may also mandate QSA involvement following compromise.

During significant system changes. Major infrastructure upgrades, new payment channels, or technology migrations affect PCI scope. Expert scoping prevents costly mistakes.

When business partners require it. Some enterprises mandate QSA-validated compliance from vendors regardless of transaction volume. Meeting customer requirements may necessitate external assessment.

Before expanding payment channels. Adding e-commerce to brick-and-mortar operations, implementing mobile payments, or entering new markets changes compliance requirements. Expert guidance prevents scope creep.

When internal resources lack expertise. If your team cannot confidently implement MFA, conduct penetration tests, or configure firewalls, professional support prevents security gaps that self-assessment might miss.

An Internal Security Assessor can bridge the gap between full QSA engagement and pure self-assessment. ISAs provide in-house expertise while maintaining QSA relationships for validation.

PCI DSS 4.0 Updates Affecting DIY Compliance

PCI DSS 4.0 introduced significant changes that affect self-assessment. Understanding these updates helps you prepare for current requirements.

Multi-Factor Authentication Expansion

MFA requirements expanded dramatically. Under PCI DSS 4.0, MFA is required for all access to the cardholder data environment—not just administrators. This includes:

• All users accessing the CDE, every time they attempt access
• Both remote access and internal network access (requiring MFA twice)
• All types of system components: cloud environments, hosted systems, workstations, servers, and endpoints

Payment Page Script Security

Requirements 6.4.3 and 11.6.1 address client-side script security. Merchants must implement controls for all payment page scripts executed in browsers to prevent unauthorized modifications.

For SAQ A merchants, these requirements created new eligibility criteria. You must self-attest that your site is not susceptible to script-based attacks. Given that 98.9% of websites use client-side JavaScript, many merchants may no longer qualify for SAQ A.

Targeted Risk Analyses

PCI DSS 4.0 requires targeted risk analyses for several controls, necessitating granular assessments to identify specific vulnerabilities. This adds documentation burden but improves security outcomes.

Password Requirements

Requirement 8.3.6 states that passwords must be at least 12 characters long and include both numeric and alphabetic characters. Service providers face additional requirements for customer credential management.

FAQs

Can I do PCI compliance myself if I only accept payments online?
Yes, most e-commerce merchants at Levels 3 and 4 can self-assess using SAQ A or SAQ A-EP. Your specific questionnaire depends on how you integrate with payment processors and whether your website affects transaction security.

Do I need PCI compliance if I use Square or Stripe?
Yes, you remain responsible for securing your environment and completing an SAQ even when using third-party processors. These platforms reduce your compliance burden but do not eliminate your obligations entirely.

How often must I validate PCI compliance?
Annually. You must complete your SAQ and Attestation of Compliance every year. Quarterly ASV scans are also required if your SAQ type mandates them.

What happens if I fail a vulnerability scan?
You must remediate the vulnerabilities and rescan within the same quarter. PCI DSS requires a passing scan in each calendar quarter, though rescans can occur until you achieve passing status.

Can a data breach make me a Level 1 merchant?
Yes, any merchant that experiences a breach resulting in account data compromise is automatically elevated to Level 1 status, requiring QSA assessment regardless of transaction volume.

Do I need penetration testing for SAQ A?
No, SAQ A does not require penetration testing. However, SAQ A-EP, SAQ C, SAQ D, and other questionnaires do require annual penetration tests covering your cardholder data environment.

What is an Approved Scanning Vendor?
An ASV is a company certified by the PCI SSC to conduct external vulnerability scans. You cannot perform these scans internally—they must be completed by an organization appearing on the PCI Council’s approved list.

How long must I retain PCI compliance logs?
At least one year. PCI DSS Requirement 10 mandates retaining access logs for potential future investigations. Some states require longer retention for breach investigation purposes.

Can an employee become an Internal Security Assessor?
Yes, any full-time employee can become an ISA by completing PCI SSC training and passing the examination. The organization must sponsor the candidate and pay certification fees.

What is the difference between ROC and SAQ?
A Report on Compliance (ROC) is completed by a QSA after an on-site audit, while a Self-Assessment Questionnaire (SAQ) is completed by merchants themselves. Level 1 merchants require ROCs; most others use SAQs.

Does PCI compliance protect me from all data breach liability?
No, PCI compliance provides a security baseline but does not guarantee breach prevention. However, compliant organizations typically face lower fines and demonstrate due diligence that may reduce legal liability.

How do state laws interact with PCI DSS?
State breach notification laws add requirements on top of PCI DSS. You must comply with both federal payment card standards and state-specific notification, timing, and credit monitoring mandates when breaches occur.