Implementation walkthrough
How to implement PCI DSS: video walkthrough
A walkthrough of a PCI DSS programme, from tracing every card data flow to the annual validation your acquirer or the card brands require.
Key takeaways
- PCI DSS is a contractual obligation validated every year; it is not a law or a certification.
- Confirm your level and whether a Report on Compliance or a self-assessment questionnaire is expected.
- Reducing the scope first, through segmentation or tokenisation, shrinks everything that follows.
- Evidence is collected as work is done and reviewed internally before the assessor arrives.
- The QSA assesses and attests; Sterling prepares you for that assessment.
PCI DSS is validated every year, not certified
PCI DSS, the Payment Card Industry Data Security Standard, is the global baseline of technical and operational requirements for protecting payment card account data. Maintained by the PCI Security Standards Council, it applies to every organisation that stores, processes or transmits cardholder data or sensitive authentication data, and to the systems, people and processes that do so, which together form the cardholder data environment.
It is neither a law nor a certification. It is a contractual obligation that reaches you through your acquirer, the card brands' compliance programmes and, for service providers, customers' contracts, and compliance is validated at least once a year. This short film walks through the programme that gets you there; the stages below follow the PCI DSS hub.
From card data flows to a validated Attestation of Compliance
Begin by confirming the scope, the level and the validation type: trace every card data flow, define the cardholder data environment and its connected systems, list the third parties, and confirm with your acquirer which level applies and whether a Report on Compliance or a self-assessment questionnaire is expected. A gap analysis then tests each sub-requirement the way an assessor will and agrees a remediation plan with owners and dates.
Reduce the scope before you remediate: segmentation, tokenisation, point-to-point encryption or a hosted payment page can take systems out of the environment altogether. Then implement the controls, policies and periodic tasks that remain, collecting evidence as work is done, and review that evidence internally before the assessment. A Qualified Security Assessor assesses and attests for larger merchants and most service providers; eligible organisations complete a self-assessment questionnaire with its own Attestation of Compliance.
Sterling's expert and experienced consultants map and shrink the cardholder data environment with your people under Sterling OS™ and stay through every annual cycle. The current version is PCI DSS v4.0.1, and the formerly future-dated requirements have been mandatory since 31 March 2025.
PCI DSS at a glance
- Purpose
- Protection of payment card account data wherever it is stored, processed or transmitted, through twelve requirements validated every year
- Relevant to
- Merchants, service providers, BPOs, payment facilitators, hosting and software providers: anyone who handles cardholder data or can affect its security
- Version
- PCI DSS v4.0.1 (June 2024); v4.0 was retired on 31 December 2024 and the formerly future-dated requirements have been mandatory since 31 March 2025
- Validation
- Assessed by a PCI SSC-qualified QSA (Report on Compliance and Attestation of Compliance), or by self-assessment questionnaire where your acquirer and the card brands allow it; quarterly ASV scans where they apply
- Sterling's role
- Scoping, gap analysis, remediation with your team, Effivity, training, internal assessment and QSA readiness, then Sustain™ through every annual cycle
- Cost and timing
- Total investment for PCI DSS compliance depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months
PCI DSS: questions people ask
Is PCI DSS a certification?
No. There is no PCI DSS certificate and no certification body. Compliance is validated at least annually, by a Qualified Security Assessor who produces a Report on Compliance and signs an Attestation of Compliance, or by a self-assessment questionnaire with its own AOC where your acquirer and the card brands allow it.
Do we need a QSA, or can we self-assess?
That depends on your merchant or service-provider level, which the card brands define by annual transaction volume, and on what your acquirer or customers require. The largest merchants and most service providers are assessed by a QSA; many smaller merchants and some service providers may self-assess. Some brands also accept a Report on Compliance completed by a trained Internal Security Assessor on your staff, where the acquirer permits it.
Which self-assessment questionnaire applies to us?
The PCI Security Standards Council publishes SAQs for different payment environments: SAQ A and SAQ A-EP for e-commerce and mail or telephone order merchants that outsource card data functions to differing degrees; SAQ B and SAQ B-IP for imprint and standalone terminal environments; SAQ C and SAQ C-VT for payment application and virtual terminal environments; SAQ P2PE for validated point-to-point encryption; SAQ SPoC for approved software-based PIN entry; SAQ D for merchants who fit none of the others; and SAQ D for service providers, the only SAQ open to them. Eligibility criteria are strict; your acquirer has the final word.
Are the PCI DSS v4.0 future-dated requirements now mandatory?
Yes. They were best practice until 31 March 2025 and have been required in every assessment since, under PCI DSS v4.0.1, the only active version since v4.0 was retired on 31 December 2024.
How can we reduce our PCI DSS scope?
By keeping card data out of your systems: hosted payment pages or redirects, tokenisation, validated point-to-point encryption, agent-assisted payment tools in the contact centre, and outsourcing to providers with a current AOC; what remains is isolated with tested segmentation. Reducing scope does not remove PCI DSS: an e-commerce merchant eligible for SAQ A still has requirements to meet, including quarterly ASV scans of the systems hosting its payment page or redirect.
Keep exploring
Related to this video
Read next
Services
The complete guide
Everything on PCI DSS
Start with the PCI DSS page, or go straight to the guide you need.
On the PCI DSS page
Guides
- The PCI DSS annual cycle
- PCI DSS assessor questions
- PCI DSS in Australia
- PCI DSS checklist
- Choosing a QSA
- PCI DSS common mistakes
- PCI DSS compensating controls and the customised approach
- PCI DSS compliance cost
- Do you need PCI DSS
- PCI DSS documentation
- Effivity for PCI DSS
- PCI DSS gap analysis
- PCI DSS implementation plan
- PCI DSS in India
- PCI DSS internal audit and the ISA
- PCI DSS in the Netherlands and Europe
- PCI DSS payment page scripts
- PCI DSS vs ISO/IEC 27001 and SOC 2
- PCI DSS v4.0.1 requirements explained
- PCI DSS scoping and segmentation
- PCI DSS in Singapore and South East Asia
- PCI DSS for small merchants and start-ups
- The PCI DSS assessment
- PCI DSS in the Philippines
- PCI DSS in the UK
- PCI DSS timeline
- PCI DSS training
- PCI DSS in the UAE and GCC
- PCI DSS v4.0.1
- PCI DSS validation step by step
- How to verify a PCI DSS AOC and check a provider's compliance
- Which SAQ applies to you
By industry
More videos: Information security, cyber and cloud
- How to implement SOC 2Implementation walkthrough · 3 min 24 s
- SOC 2 requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27017Implementation walkthrough · 3 min 14 s
- ISO/IEC 27017 requirements explainedTwo-minute brief · 2 min
- How to implement CMMC 2.0Implementation walkthrough · 3 min 15 s
- CMMC 2.0 requirements explainedTwo-minute brief · 2 min
- How to implement CSA STARImplementation walkthrough · 3 min 15 s
- CSA STAR requirements explainedTwo-minute brief · 2 min
- How to get Cyber Essentials certifiedImplementation walkthrough · 3 min 15 s
Talk to a consultant
Plan your PCI DSS compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice