PCI-DSS
The Payment Card Industry Data Security Standard for handling cardholder data.
PCI-DSS v4.0 sets 12 requirements across six goals. Merchant level (1–4) is set by transaction volume and determines the assessment path — from a Self-Assessment Questionnaire (SAQ) to onsite QSA audit.
Using a hosted payment page can shrink scope to SAQ-A, but any environment that stores, processes, or transmits cardholder data has PCI obligations.
Follow the payment data flow
Identify where payment data enters the business, which systems can access it, and how it reaches the processor. Include checkout scripts, terminals, customer support, and any stored records. Outsourcing payment processing can reduce the environment you need to assess, but it does not remove every merchant responsibility.
Choose the appropriate validation path
Confirm the applicable questionnaire or assessment route with the acquiring bank or payment provider. Eligibility depends on the actual integration and environment, not simply company size. Use the current PCI Security Standards Council materials, including the applicable version and eligibility criteria, rather than a generic payment-security checklist.
Keep security work connected to evidence
Maintain the integration inventory, provider responsibilities, relevant configuration records, and processes for handling changes. A processor’s compliance status does not prove that your own website or workflow is secure. Treat validation as a defined assessment of scope, not a blanket guarantee about every business system.
See how Scarlet Risk covers PCI-DSS.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo