Who needs PCI DSS compliance?
Any business that accepts, processes, stores or transmits payment card data, and any service provider that can affect the security of that data, must comply. Your acquiring bank and the card brands decide how you validate compliance, usually based on your transaction volume and how you take payments.
Larger merchants and service providers typically need an on-site assessment by a Qualified Security Assessor, documented in a Report on Compliance. Many smaller merchants validate with a Self-Assessment Questionnaire. Both end with an Attestation of Compliance.
What changed with PCI DSS v4?
Version 3.2.1 was retired in March 2024, and v4.0 was retired at the end of 2024 in favor of v4.0.1, a limited revision that clarified wording. The requirements that v4 introduced as future-dated best practices became mandatory on March 31, 2025.
Those newer requirements include broader multi-factor authentication into the cardholder data environment, targeted risk analyses for flexible requirements, stronger password rules and controls on scripts running in payment pages. If your last assessment predates them, expect new work.
What does PCI DSS require?
The standard is organized into 12 requirements under six goals: build and maintain a secure network, protect account data, maintain a vulnerability management program, implement strong access control, regularly monitor and test networks, and maintain an information security policy.
What we do
We review your cardholder data environment against the standard and report exactly where you fall short. Reducing scope is often the fastest win, so we look for ways to keep card data out of systems that do not need it.
Self-Assessment Questionnaires are long and technical. We help you pick the right SAQ and answer it accurately. We also deploy and tune log monitoring that records the events PCI DSS requires, and we prepare you for the QSA when an on-site assessment is needed.
