PCI DSS · Payment Card Industry Data Security Standard
PCI DSS compliance consulting for card payments your acquirer and your customers can trust.
Reach PCI DSS compliance and keep it, validated by your Qualified Security Assessor or accepted by your acquirer, first time, on the date your contract or card brand programme sets. Sterling's expert and experienced consultants map and shrink the cardholder data environment with your people, close every gap against the twelve requirements, assemble the evidence and stay with you through the assessment and every annual cycle after it, in 60+ countries. We ensure successful validation for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced PCI DSS consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not validate compliance; the QSA assesses and attests
8,100+ client engagements in 60+ countries.
PCI DSS client experience
What it is
What is PCI DSS and what is it used for?
PCI DSS, the Payment Card Industry Data Security Standard, is the global baseline of technical and operational requirements for protecting payment card account data. It is maintained by the PCI Security Standards Council, founded in 2006 by American Express, Discover, JCB International, Mastercard and Visa, and it applies to every organisation that stores, processes or transmits cardholder data or sensitive authentication data. The systems, people and processes that do so, and anything connected to them, form the cardholder data environment (CDE) to which every requirement applies.
It is not a law and it is not a certification. It is a contractual obligation that reaches you through your acquirer, the card brands' compliance programmes and, for service providers, your customers' contracts, validated at least once a year. The questions behind it are concrete: where does card data enter, move through and leave your business, and can you show that all twelve requirements were met wherever it goes?
Current version. PCI DSS v4.0.1, published on 11 June 2024, is the only active version of the standard. It is a limited revision of v4.0 (March 2022) that clarifies intent without adding or removing requirements; v4.0 was retired on 31 December 2024. The 51 future-dated requirements introduced with v4.0 were best practice until 31 March 2025 and have been mandatory in every assessment since, among them multi-factor authentication for all non-console access into the CDE, payment page script controls, twelve-character passwords and automated log review. A first assessment is built to the full v4.0.1 requirement set from day one. PCI DSS v4.0.1: what changed and what your next assessment tests
Who it is for
Who needs PCI DSS compliance?
PCI DSS applies to any organisation that accepts, processes, stores or transmits payment card data, and to any service provider whose services could affect its security: retailers, hospitality and e-commerce businesses; BPOs and contact centres taking payments by phone; payment facilitators, gateways and processors; software and hosting providers. Four situations bring organisations to Sterling:
- Your acquirer or a card brand programme has asked you to validate. The letter names a level, a deadline and a document, ROC or SAQ; the first job is to establish the real scope before anyone fills in a form.
- A customer contract or tender requires an Attestation of Compliance. Service providers and BPOs are asked for a current AOC in due diligence, and its scope has to match the services the customer is buying.
- You are launching a payment channel or entering a new market. A new online store, payments in the contact centre, a payment facilitation model or an acquisition abroad: the cheapest time to decide what touches card data is before it is built.
- You are compliant on paper and worried about the assessment. A questionnaire was signed without the controls behind it, the environment has grown, every v4.0.1 requirement is in force, or a QSA is coming for the first time.
What you should get is fewer places where card data can be lost, and proof that those that remain are controlled; that comes from scoping, remediation and disciplined operation, not from the AOC alone.
Business benefits
How PCI DSS protects your payments business and its reputation
A payment security programme should make a card data breach unlikely and an annual validation uneventful. We start with the places where card data is present unnecessarily, the controls that stop real incidents and the evidence your acquirer and customers ask for, and build around them.
- Fewer places to lose card dataTokenisation, point-to-point encryption, hosted payment pages and validated providers remove card data from systems that never needed it, so there is less to protect.
- Evidence your acquirer and customers acceptA current AOC with the ROC or SAQ behind it, passing quarterly scans and clean answers to due diligence, instead of a scramble whenever a questionnaire arrives.
- Controls that stop real breachesNetwork security controls, hardened and patched systems, MFA, logging and testing address the ways card data is actually stolen.
- A cheaper annual cycleQuarterly, six-monthly and annual tasks scheduled and evidenced as they happen, so the next assessment starts from records, not memory.
- One control set with ISO/IEC 27001 and SOC 2Shared policies, risk analyses, access reviews and incident procedures serve all three, and a client audit is answered once.
- Third parties under controlEvery provider that touches card data listed, its AOC on file, responsibilities agreed in writing and its status reviewed on a schedule.
Pick a handful of measures that reflect these priorities, such as systems in scope, overdue periodic tasks or time to close scan findings, and judge the programme by them. A signed questionnaire is not a security result.
Requirements
What are the main PCI DSS requirements?
PCI DSS v4.0.1 sets twelve requirements under six goals, in the standard's words: Build and Maintain a Secure Network and Systems (requirements 1 and 2), Protect Account Data (3 and 4), Maintain a Vulnerability Management Program (5 and 6), Implement Strong Access Control Measures (7, 8 and 9), Regularly Monitor and Test Networks (10 and 11) and Maintain an Information Security Policy (12). Each requirement breaks down into numbered sub-requirements with the testing procedures the assessor follows, and each can be met by the defined approach or, where you can justify an alternative control, by a customised approach that meets its stated objective.
| Requirement | What it requires of you | What it looks like in practice |
|---|---|---|
| 1 Install and Maintain Network Security Controls | Control traffic between trusted and untrusted networks and into the CDE, permitting only what the business needs | Network and data-flow diagrams, rulesets with a justification per rule, periodic rule reviews |
| 2 Apply Secure Configurations to All System Components | Harden every system in scope, change vendor defaults, remove what is not needed | Configuration standards per platform, build checklists, a wireless inventory, change records |
| 3 Protect Stored Account Data | Keep only the account data you need, never store sensitive authentication data after authorisation, render stored PAN unreadable | A retention policy with purge evidence, data discovery results, masking, cryptography or tokenisation with key management |
| 4 Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks | Encrypt PAN in transit over public networks with strong protocols and trusted certificates; never send it by end-user messaging | An inventory of encryption in use, a certificate register, a rule people follow that card numbers are never e-mailed or texted |
| 5 Protect All Systems and Networks from Malicious Software | Anti-malware that is current, active and monitored; phishing addressed; removable media controlled | Coverage lists with justified exceptions, alert and update logs, anti-phishing measures for payment staff |
| 6 Develop and Maintain Secure Systems and Software | Find and rank vulnerabilities, patch within defined timeframes, develop securely, control change, manage payment page scripts | Vulnerability sources, patch reports, secure coding training, change records, a script inventory with integrity checks |
| 7 Restrict Access to System Components and Cardholder Data by Business Need to Know | Grant access by role and least privilege, approve it, review it | An access model by role, approved requests, privileged accounts justified, six-monthly access reviews |
| 8 Identify Users and Authenticate Access to System Components | Unique IDs, strong authentication, MFA for all access into the CDE and all remote access, a managed account lifecycle | A user inventory, MFA configuration evidence, password and lockout settings, leaver records |
| 9 Restrict Physical Access to Cardholder Data | Control physical access to the facilities, media and point-of-interaction devices that hold or capture card data | Badge and visitor logs, a media inventory with destruction records, terminal inspection records, front-line training |
| 10 Log and Monitor All Access to System Components and Cardholder Data | Log all access, protect the logs, review them daily with automated tools, retain them for a year, detect failures of critical controls | Centralised logging with alerts, daily review evidence, synchronised time, a record of how control failures are handled |
| 11 Test Security of Systems and Networks Regularly | Detect rogue wireless, scan internally and externally every quarter, penetration test, test segmentation, detect intrusions and payment page tampering | Passing quarterly ASV scans, internal scan results, penetration test reports with remediation, intrusion alerts, tamper detection on payment pages |
| 12 Support Information Security with Organizational Policies and Programs | Set policy, run targeted risk analyses, define roles, train and screen people, manage third-party service providers, confirm scope annually, respond to incidents | A policy set reviewed yearly, training records, a provider register with AOCs and responsibility matrices, a scope confirmation, an exercised incident plan |
What does useful PCI DSS evidence look like?
Diagrams that match the network, a signed scope confirmation, hardening standards with proof they were applied, access reviews with their decisions, MFA settings, scan and penetration test reports with the fixes, daily log review records, provider AOCs, targeted risk analyses, training records and an exercised incident plan. We work out which records each requirement genuinely needs, create nothing for its own sake, and keep them in Effivity from the first workshop, so the assessor sees a programme that runs.
PCI DSS requirements explained, requirement by requirementValidation process
How do you get PCI DSS validated?
First confirm the scope and make every requirement true inside it. Then have compliance validated the way your acquirer and the card brands require: a Qualified Security Assessor's assessment, Report on Compliance and Attestation of Compliance for larger merchants and most service providers; a self-assessment questionnaire with its own AOC for eligible smaller merchants and some service providers. Sterling prepares your organisation; the QSA assesses and attests, and that separation is what gives the AOC its value.
- 01Confirm the scope, the level and the validation type.Trace every card data flow, define the CDE and its connected systems, list the third parties, and confirm with your acquirer which level applies and whether a ROC or an SAQ is expected.
- 02Gap analysis: assess the environment against all twelve requirements.The gap analysis tests each sub-requirement the way an assessor will, keeps what works and agrees a remediation plan with owners and dates.
- 03Reduce the scope, then remediate what remains.Segmentation, tokenisation, point-to-point encryption or a hosted payment page first; then the controls, policies and periodic tasks, with evidence collected as work is done.
- 04Internal assessment and evidence review.Scans, penetration tests and segmentation tests run and their findings closed; every requirement checked against its evidence before the assessor sees it.
- 05Complete the validation.QSA fieldwork, the ROC and the AOC, or the SAQ and its AOC signed by your executive; quarterly ASV scans passing; the documents submitted to your acquirer and shared with customers who need them.
- 06Keep compliance continuous.Quarterly scans, six-monthly and annual tasks, changes assessed for their effect on scope, third parties monitored and the scope reconfirmed, so next year repeats the result.
Weigh the route's credibility before its price. Ask which QSA company will assess you and confirm its listing on the PCI Security Standards Council's public QSA list; do the same for the scanning vendor on the ASV list. Be cautious of "PCI certificates": there is no PCI DSS certificate; the documents that count are the AOC with the ROC or SAQ behind it. How to choose a credible PCI DSS provider · The compliance buyer's checklist
Cost
How much does PCI DSS compliance cost?
No universal price for PCI DSS compliance would be accurate. A retailer whose payments all run through validated terminals has a different programme from a BPO taking card numbers over the phone in three countries. What we can commit to is a proposal that shows every component, at a fee that is fixed.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Payment channels and sites, the size of the CDE, the state of existing controls, ROC or SAQ, and how much of the work your team takes on (Design™ or Drive™) |
| Independent validation | The QSA company's fees for the assessment, its sampling and site visits, quarterly ASV scans, and penetration and segmentation testing where you do not have them |
| Internal resources and remediation | IT, security and process-owner time, and the technology the gaps demand: MFA, logging, segmentation, tokenisation or encryption, anti-malware, integrity monitoring |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people; users, courses and the access period are confirmed in the proposal |
| Continued support | Periodic tasks tracked, findings followed up, changes assessed and the next validation prepared under Sustain™ |
What moves the price
- How many channels, sites and countries handle card data, and how many systems sit in the CDE
- Whether the acquirer expects a QSA assessment or accepts a self-assessment questionnaire
- How much scope can be removed by tokenisation, encryption or outsourcing before controls are built
- The technology gaps, particularly MFA, logging, segmentation and vulnerability management
- The deadline, and how much of the work your own team can absorb
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- QSA, ASV and testing fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does PCI DSS compliance take?
The realistic timeline depends on how well the card data flows are known, how much scope can be removed, the technology to be bought and the assessor's calendar. Count in months, not days, typically three to nine: the controls have to operate long enough to produce the scans, access reviews and log reviews the assessor will sample. We build the plan around that evidence, with milestones tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to IT, finance and operations, the quality of network and data-flow information, and how quickly the acquirer confirms what it expects |
| Scope reduction and remediation | Decisions on tokenisation, encryption or outsourcing, procurement and configuration of missing technology, and the availability of system owners |
| Operation and evidence | Controls running long enough to produce scans, reviews, logs and test results, then Sterling's internal assessment |
| Validation | The QSA company's availability, the length of fieldwork, and the time to close anything found before the AOC is signed |
If your acquirer has set a date or a customer contract depends on the AOC, tell us on day one. We will tell you what is achievable, which scope decisions come first and where the risk to the date sits. A compliance date promised before anyone has traced a card number through your systems is a sales tactic, not a plan.
Challenges
Common PCI DSS implementation challenges
PCI DSS programmes stall for five familiar reasons, and each has a practical answer.
Nobody can say exactly where card data is.
We trace every flow with finance, the contact centre, IT and the payment providers, run data discovery across file shares, mailboxes, call recordings and databases, and produce the diagrams and scope confirmation the assessor asks for first.
The scope is bigger than it needs to be.
A flat network puts the whole company in scope. We design segmentation, tokenisation, point-to-point encryption or a hosted payment page where it pays for itself, and have the segmentation tested, so the assessment covers only the systems that handle card data.
Periodic tasks slip between assessments.
Quarterly scans, six-monthly access reviews, daily log reviews and annual tests are the evidence the assessor samples. They are scheduled in Effivity with owners and due dates, and the record is created when the task is done, not reconstructed later.
Third parties are assumed to be compliant.
Every provider that stores, processes or transmits card data for you, or could affect its security, goes on a register with its AOC, the services covered and a written split of responsibilities, reviewed on a schedule, so nothing falls between what they cover and what you cover.
A questionnaire was signed without the controls behind it.
We rebuild accurately: the real scope, the real gaps, a remediation plan the acquirer can see progress against, and evidence that stands when a QSA, a customer's auditor or an investigator asks for it.
Your engagement
What your PCI DSS engagement includes
The agreed scope covers everything a compliant environment and a prepared team need. Most providers sell a gap assessment or a scan and leave the rest to you; Sterling delivers the whole journey under one all-inclusive proposal.
Scope, gap analysis and remediation plan
Card data flows traced, the CDE defined, the validation type confirmed with your acquirer and a remediation plan with owners and dates, agreed before work starts.
Policies, procedures and the security programme
The Requirement 12 programme built with your process owners: policies, targeted risk analyses, third-party management, incident response and awareness, on Sterling's template sets.
Effivity ISO & GRC software
Your PCI DSS programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal assessment and evidence review
Each requirement tested against its evidence, findings followed to closure, and the evidence pack organised the way the assessor reads it.
Validation readiness and QSA support
Preparation for the assessment, support during fieldwork and with any finding, until the AOC is signed.
Validation of compliance remains with your QSA, or with your acquirer's acceptance of a self-assessment.
How we deliver
How Sterling supports your PCI DSS implementation
Every PCI DSS engagement runs on Sterling OS™, Sterling's delivery operating system: five phases, every one with its named deliverables, decision owners and evidence. Take as much or as little support as your internal capacity requires; method, software and accountability stay constant.
- 01Design™Guided implementation: your team does the work, with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed: Sterling consultants carry the agreed remediation and documentation work alongside your system owners.
- 03Sustain™Continuous compliance: periodic tasks, scan follow-up, change assessment, internal assessment and readiness for every annual validation.
- 04Automate™The programme running in Effivity: policies, scope, periodic tasks, third parties, risk analyses, findings and evidence in one workspace.
- 05Revise™Revisions of the standard, new payment channels, acquisitions and changes in the validation your acquirer or customers require.
Before work starts we agree the named lead, the weekly working session, the deliverables and the decision owners, and progress is reviewed against those commitments so that a gap shows up early, not in fieldwork.
How Sterling OS™ worksOften combined with
Standards organisations pair with PCI DSS
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
- Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
- BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
- CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
Effivity · PCI DSS compliance software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of PCI DSS v4.0.1.
Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries, is part of every Sterling PCI DSS engagement. Your consultant sets up the workspace for the agreed scope, so that the scope record, policies, risk analyses, periodic tasks, providers and their AOCs, findings, training records and the evidence for each requirement sit in one place, the programme is run from it day to day, and the assessor reviews a live system instead of a folder. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.
Card data flows, the CDE and the scope confirmation
The data-flow and network diagrams, the inventory of in-scope and connected systems, segmentation decisions with their test results, and the annual scope confirmation, kept current as channels change.
Network security controls and configuration standards
Rulesets with their justification and review dates, hardening standards per platform with the records that show they were applied, and change requests linked to the systems they touch.
Retention, cryptography and key management
Retention rules for account data, purge tasks and their evidence, the inventory of where PAN is stored and how it is protected, certificate expiry dates, key management procedures and custodians.
Findings, patching and secure change
Vulnerabilities from scans, tests and vendor notices ranked and tracked to closure within your timeframes, patch evidence attached, change records with approvals and the payment page script inventory.
Roles, access reviews and physical controls
The access model by role, access requests and approvals, six-monthly access reviews with their decisions, leaver checks, and the media, visitor and terminal inspection records.
Log reviews, scans and penetration tests
Daily log review sign-offs, quarterly ASV and internal scan results, penetration and segmentation test reports with remediation, and intrusion and tamper alerts followed up.
Policies, risk analyses, people and third parties
The policy set with versions and annual reviews, targeted risk analyses, training records linked to Sterling Academy, screening records, the provider register with AOCs and responsibility matrices, and the incident plan with its exercises.
Evidence by requirement and the assessor's view
Every sub-requirement with its owner, status, linked evidence and last review, on management dashboards and in an evidence pack for the assessor; ready to map to ISO/IEC 27001 and SOC 2 as one control set.
What this means at the audit
The assessor asks for the diagrams, the scope confirmation, the last four quarterly scans, the access reviews, a sample of daily log reviews, the provider register and the training records. In Effivity each one is a screen with dates, owners and evidence attached, rather than a folder. Once the AOC is signed, Sustain™ carries on in the same workspace, so next year's assessor meets a programme that never paused.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your policies, registers and evidence migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, PIMS, BCMS, QMS and more when you integrate standards
PCI DSS client experience
On the record: what clients say about working with Sterling.
The IT risk manager writes that the engagement clarified the company's responsibilities across payment processes, technology environments and internal controls, and that the structured approach, evidence review and readiness activities helped it organise its compliance effort and strengthen security practice.
The chief compliance officer writes that the HIPAA and PCI DSS gap assessment gave a clear view of the company's compliance posture, existing controls and areas for improvement, helped it prioritise remediation and set clear action plans, and that the team's technical expertise, structured approach and practical recommendations made the assessment efficient and credible in supporting customer assurance requirements.
The operations manager writes that the team's attention to detail, collaborative approach and commitment to quality set a standard well beyond what the company expected.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request.
Case studies with PCI DSS in scope
Payments inside an integrated programme.
- 01Read the case study
BPO: PCI DSS compliance that brought in new large clients
A BPO handling card payments for its clients needed to show it could do so securely. Meeting the PCI DSS requirements demonstrated its security discipline, reassured clients and helped it win new large clients for whom payment security matters. Risk reduction, controls and incident detection cut card fraud, financial losses and the damage these do to reputation; its director of operations said the work opened up new opportunities and that clients can see the difference.
- 02Read the case study
Banking and financial services: service quality, data protection and uninterrupted service
A bank and financial services provider needed better customer service, stronger data protection and continuity through disruption. It implemented ISO 9001, ISO/IEC 27001, ISO/IEC 27701, ISO 22301 and PCI DSS, and worked to the GDPR. Standard processes and customer feedback raised satisfaction and retention, and the security, privacy and payment controls reduced cyber risk and kept it compliant. Its chief operations officer called ISO 22301 the missing piece, since protecting the bank also means uninterrupted service to customers.
- 03Read the case study
BPO: six standards that opened doors in regulated sectors
A BPO serving clients in highly regulated sectors had good people but needed systems to deliver consistently and protect sensitive data. It implemented ISO 9001, ISO/IEC 27001, ISO/IEC 27701, ISO 22301, PCI DSS and HIPAA. The security, privacy and payment controls safeguarded client data and kept it compliant, and ISO 22301 prepared it for disruption with backup systems, plans for alternative sites and fast recovery. Its chief executive said this opened the way to clients previously out of reach.
Sterling Academy · PCI DSS e-learning
Train everyone who touches a card payment, not just the security team.
Sterling Academy trains the whole workforce and the people who run the programme through video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- PCI DSS awareness for every employee, with the training evidence Requirement 12 asks for
- Practitioner courses for system owners, the compliance lead and the people who run periodic tasks
- Internal auditor training for the people who will assess the programme internally, as applicable to your standard, as part of the engagement
- Learner progress by department and a training status report for the assessor
- New hires and contact-centre agents trained as they arrive, so the record is current at every validation
- A Sterling consultant on hand whenever a learner needs one
Sterling Academy courses for a PCI DSS programme
Which courses your people take, and who takes which.
PCI DSS Awareness
What cardholder data and sensitive authentication data are, why the twelve requirements exist, what each person must and must never do with a card number, and how to report an incident. The awareness evidence for the workforce.
View the courseDocumented Information Management
Writing, approving, versioning and retiring the policies, standards and procedures PCI DSS expects, and keeping the records that prove periodic tasks were done.
View the courseNonconformity Management
Handling a requirement found not in place, a failed scan, a missed periodic task or a control failure: containment, root cause, corrective action and evidence that the fix held.
View the courseRisk Management
The targeted risk analyses PCI DSS requires where a requirement gives you flexibility or where you take the customised approach, with the ownership and review that keep them current.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will assess the programme internally before each validation, with exercises on your own environment and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO/IEC 27001, ISO 9001, ISO 22301, ISO 14001, ISO 45001, ISO 22000 and more, so one workforce trains on one platform for every standard you integrate.
See all coursesSterling consulting clients get access through their consultant. A Sterling Academy certificate is a training certificate; validation of PCI DSS compliance stays with your QSA or acquirer.
Where we work
Where Sterling delivers PCI DSS
- PCI DSS in Australia
- PCI DSS in Austria
- PCI DSS in Bahrain
- PCI DSS in Bangladesh
- PCI DSS in Belgium
- PCI DSS in Brazil
- PCI DSS in Canada
- PCI DSS in China
- PCI DSS in Czechia
- PCI DSS in Denmark
- PCI DSS in Egypt
- PCI DSS in France
- PCI DSS in Germany
- PCI DSS in Ghana
- PCI DSS in Hong Kong
- PCI DSS in India
- PCI DSS in Indonesia
- PCI DSS in Ireland
- PCI DSS in Italy
- PCI DSS in Japan
- PCI DSS in Jordan
- PCI DSS in Kenya
- PCI DSS in Kuwait
- PCI DSS in Malaysia
- PCI DSS in Maldives
- PCI DSS in Mauritius
- PCI DSS in Mexico
- PCI DSS in Nepal
- PCI DSS in the Netherlands
- PCI DSS in New Zealand
- PCI DSS in Nigeria
- PCI DSS in Norway
- PCI DSS in Oman
- PCI DSS in Pakistan
- PCI DSS in the Philippines
- PCI DSS in Poland
- PCI DSS in Portugal
- PCI DSS in Qatar
- PCI DSS in Saudi Arabia
- PCI DSS in Singapore
- PCI DSS in South Africa
- PCI DSS in South Korea
- PCI DSS in Spain
- PCI DSS in Sri Lanka
- PCI DSS in Sweden
- PCI DSS in Switzerland
- PCI DSS in Taiwan
- PCI DSS in Tanzania
- PCI DSS in Thailand
- PCI DSS in Türkiye
- PCI DSS in Uganda
- PCI DSS in the United Arab Emirates
- PCI DSS in the United Kingdom
- PCI DSS in the United States
- PCI DSS in Vietnam
Keep exploring
Explore more about PCI DSS
Watch a video on how to implement PCI DSS here.
Watch a video on PCI DSS requirements here.
PCI DSS resources
Services for PCI DSS
Why Sterling
Want successful PCI DSS validation? Come to Sterling.
Whether you take payments at one site or through contact centres, platforms and providers in several countries, Sterling helps you establish one payment security programme with clear ownership, working through differences in acquirers, card brand programmes, regulation and customer contracts without losing sight of how each channel handles a card number.
Payment security in 60+ countries
PCI DSS programmes for BPOs and contact centres, e-commerce, hospitality, fintech and shared-service centres, from offices in 21 countries, with one engagement team accountable across every country you operate in.
All-inclusive proposal
One proposal covering consulting, Effivity, training and Academy access, with QSA, ASV and testing fees shown separately so nothing is hidden. No surprises, ever.
A programme your people can run
The smallest defensible scope and the least documentation that still satisfies the assessor: controls, periodic tasks and software connected to how payments are really taken, so the programme keeps running between validations.
Expert and experienced consultants
Consultants who have built security and management systems across sectors and countries since 2003 and who get the PCI DSS programme right first time, so the assessment confirms controls that already run.
The Sterling Promise
What our PCI DSS compliance success guarantee means
Until your agreed PCI DSS validation outcome is achieved we stay on the engagement, through scoping, remediation, preparation and whatever the assessor finds. Plain explanations, practical delivery, included software and employee learning leave you with a capability that runs every year, not an attestation rebuilt each time.
The engagement letter names the validation type, the scope, the outcome and who does what. Your organisation gives us accurate information and runs the agreed controls. The independent QSA assesses compliance and keeps its attestation decision; the card brands and your acquirer set the validation requirements. Our commitment is to the agreed compliance support, not a guarantee that no incident will occur.
After validation
What happens after PCI DSS validation?
An AOC describes the environment on the day it was signed. The next one is due in twelve months, and the requirements apply every day in between: quarterly scans, six-monthly access reviews, daily log reviews, annual penetration tests, training and confirmation that the scope is still right, because a new channel, provider or network change can put systems into scope overnight.
Under Sterling OS™ Sustain™ we run the calendar of periodic tasks with you, assess changes for their effect on scope, follow findings to closure and conduct the internal assessment before each validation, so the programme stays alive between assessments rather than being revived before one.
FAQs
Frequently asked questions about PCI DSS
Is PCI DSS a certification?
No. There is no PCI DSS certificate and no certification body. Compliance is validated at least annually, by a Qualified Security Assessor who produces a Report on Compliance and signs an Attestation of Compliance, or by a self-assessment questionnaire with its own AOC where your acquirer and the card brands allow it.
Do we need a QSA, or can we self-assess?
That depends on your merchant or service-provider level, which the card brands define by annual transaction volume, and on what your acquirer or customers require. The largest merchants and most service providers are assessed by a QSA; many smaller merchants and some service providers may self-assess. Some brands also accept a Report on Compliance completed by a trained Internal Security Assessor on your staff, where the acquirer permits it.
Which self-assessment questionnaire applies to us?
The PCI Security Standards Council publishes SAQs for different payment environments: SAQ A and SAQ A-EP for e-commerce and mail or telephone order merchants that outsource card data functions to differing degrees; SAQ B and SAQ B-IP for imprint and standalone terminal environments; SAQ C and SAQ C-VT for payment application and virtual terminal environments; SAQ P2PE for validated point-to-point encryption; SAQ SPoC for approved software-based PIN entry; SAQ D for merchants who fit none of the others; and SAQ D for service providers, the only SAQ open to them. Eligibility criteria are strict; your acquirer has the final word.
Are the PCI DSS v4.0 future-dated requirements now mandatory?
Yes. They were best practice until 31 March 2025 and have been required in every assessment since, under PCI DSS v4.0.1, the only active version since v4.0 was retired on 31 December 2024.
How can we reduce our PCI DSS scope?
By keeping card data out of your systems: hosted payment pages or redirects, tokenisation, validated point-to-point encryption, agent-assisted payment tools in the contact centre, and outsourcing to providers with a current AOC; what remains is isolated with tested segmentation. Reducing scope does not remove PCI DSS: an e-commerce merchant eligible for SAQ A still has requirements to meet, including quarterly ASV scans of the systems hosting its payment page or redirect.
What is the customised approach and should we use it?
The customised approach (the standard's "Customized Approach") lets you meet a requirement's stated objective with a control of your own design instead of the defined control. It needs a documented controls matrix, a targeted risk analysis and your own testing for each customised control, and the assessor derives its own test procedures. It suits risk-mature organisations; most first-time programmes use the defined approach throughout and reserve the customised approach for the one or two requirements where the defined control does not fit.
How does PCI DSS relate to ISO/IEC 27001 and SOC 2?
PCI DSS is a prescriptive control set for a defined environment, validated every year. ISO/IEC 27001 is a risk-based management system, certified by an accredited body on a three-year cycle. SOC 2 is an attestation report by a CPA firm against the Trust Services Criteria. None replaces another, but their policies, risk analyses, access reviews, logging and incident procedures overlap, and organisations that need two or three run them as one control set with one evidence base.
Does Sterling issue the ROC or the AOC?
No. Sterling provides consulting, remediation support, training and readiness. The Report on Compliance and the Attestation of Compliance come from your Qualified Security Assessor; a self-assessment questionnaire is completed and attested by your organisation and accepted by your acquirer. Anyone offering to prepare you and to validate you at the same time is offering paper.
What do you need to prepare a PCI DSS proposal?
How you take card payments, in which channels and countries, roughly how many systems and people are involved, whether a ROC or an SAQ is expected and by whom, what controls and validations exist today, and your deadline. With that we can scope an all-inclusive proposal; nobody needs to complete a questionnaire first.
Before the first call
Prepare a useful PCI DSS readiness brief
You do not need a questionnaire or a network diagram first. Bring a short account of how card payments reach your business and what has been asked of you. Seven questions are enough:
- What has your acquirer, a card brand or a customer asked for, and by when: a Report on Compliance, an SAQ, an AOC, or nothing yet?
- Through which channels do you take or handle card payments: online, terminals, phone or chat, recurring billing, on behalf of clients?
- Which providers are involved: acquirer, gateway, processor, hosting, call recording, tokenisation, and do you hold their AOCs?
- Where might card numbers be stored today, including e-mail, call recordings, spreadsheets and paper?
- Which controls already exist: firewalls, MFA, logging, scanning, penetration testing, policies, training?
- Who can make decisions and contribute time from IT, security, finance and operations to remediation and review?
- Is there a previous AOC, a scan history, an open finding or a contract date to plan around?
These answers let us scope the work and price it realistically. They prepare a conversation; they are not a scored assessment and not an attestation.
Don’t be fooled by PCI compliance scams
If it takes ten days, it is not PCI DSS compliance.
An Attestation of Compliance is useful when its scope matches the services your acquirer and customers rely on and the controls can stand up to a QSA's sampling. Paper is cheap and plentiful: "PCI certificates" issued by scanning vendors, questionnaires completed by a consultant who never saw the network, and seals for websites never scanned. It costs less, right up to the breach or the acquirer's review.
How to choose a credible PCI DSS provider
- Ask who will validate you and check the QSA company on the PCI Security Standards Council's public QSA list, and the scanning vendor on its ASV list, before fieldwork is booked.
- Ask for the scope first. A provider who quotes a fee or names an SAQ before tracing where card data flows is guessing.
- Ask how the programme will look at your actual systems, providers and records. Policies should describe your operation, not a template with another company's name in it.
- Get the division of labour in writing, with QSA, scanning and testing costs shown separately and a named route for support when the assessor finds something.
- Ask what your people will learn and where the programme will live. Without training and a system, the periodic tasks stop the day the consultant leaves.
- Walk away from "PCI certified in 7 to 10 days", "we complete the SAQ for you" and one invoice for consulting and attestation. Controls have to operate, and produce evidence, before anyone can attest to them.
Keep exploring
More on PCI DSS and related standards
More in Financial services, payments & AML
Talk to a consultant
Plan your PCI DSS compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice