PCI DSS: a plain-language guide
Short answer: PCI DSS (Payment Card Industry Data Security Standard) is the security standard for any business that stores, processes or transmits payment card data. The current version is 4.0.1. It has 12 requirements, and how you prove compliance, through a self-assessment or an audit by a Qualified Security Assessor, depends on how many card transactions you handle.
What is PCI DSS?
PCI DSS is maintained by the PCI Security Standards Council, founded by the major card brands. It is not a government law, but card brands and banks require it through their contracts. Version 4.0.1 was published in June 2024, and the requirements that version 4 introduced as "future-dated" became mandatory on 31 March 2025.
Who needs to comply with PCI DSS?
Any merchant or service provider that stores, processes or transmits cardholder data, or that can affect the security of that data. That includes online stores, payment gateways, SaaS platforms that take card payments and hosting providers serving them. If you use a hosted payment page from a provider such as a payment gateway, your scope is much smaller, but it is rarely zero.
What are the 12 PCI DSS requirements?
- Install and maintain network security controls.
- Apply secure configurations to all system components.
- Protect stored account data.
- Protect cardholder data with strong cryptography during transmission over open, public networks.
- Protect all systems and networks from malicious software.
- Develop and maintain secure systems and software.
- Restrict access to system components and cardholder data by business need to know.
- Identify users and authenticate access to system components.
- Restrict physical access to cardholder data.
- Log and monitor all access to system components and cardholder data.
- Test security of systems and networks regularly.
- Support information security with organisational policies and programs.
What is the difference between an SAQ and a ROC?
Smaller merchants usually complete a Self-Assessment Questionnaire (SAQ). There are several types, depending on how you accept cards; for example, SAQ A is for merchants who fully outsource card handling to a compliant provider. Larger merchants and most service providers need a Report on Compliance (ROC) written by a Qualified Security Assessor (QSA). Your acquiring bank or the card brands tell you which applies.
What changed in PCI DSS version 4?
- Multi-factor authentication for all access into the cardholder data environment.
- Stronger password rules and reviews of user accounts and access.
- Controls against skimming scripts on payment pages, including managing every script that runs on them.
- A targeted risk analysis to justify how often certain controls are performed.
- An option to meet requirements in a customised way, if you can show the same security result.
How can you reduce PCI DSS scope?
The cheapest card data to protect is card data you never touch. Use a hosted payment page or redirect from a compliant payment provider, never store full card numbers, keep payment systems on a separate network, and limit which people and systems can reach them. Less scope means fewer requirements and a simpler assessment.
How ExpertComply helps with PCI DSS
ExpertComply GRC includes a PCI DSS v4.0.1 checklist written in plain language, so you can track each requirement and keep evidence in one place. ExpertComply VAPT supports requirement 6 and 11 work by scanning your code and website, and can produce findings from a PCI DSS perspective.
ExpertComply does not replace a QSA or an Approved Scanning Vendor (ASV) where your bank requires one.
See plans Ask for a walkthrough