PCI DSS for US Online Sellers and Payment Businesses

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• A fixed quote

  A fixed quote follows a free gap assessment, so you know the full cost before you commit.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

The outcome: the right PCI DSS validation, accepted by your US acquirer, with your checkout set up so the work stays small. We handle the preparation; a Qualified Security Assessor (QSA) performs the assessment where one is required.

Take cards online in the US and PCI DSS will reach you. It is the PCI Security Standards Council's security standard, at v4.0.1 in the Council's library^[1], and it travels through contracts rather than statute. The Council states that compliance-accepting entities, typically payment brands and acquirers, decide how merchants and service providers evidence compliance: a Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ)^[2].

In Sterling's experience, US businesses hear about it at four moments:

• An acquirer notice. Your US bank or processor asks for this year's validation.
• Marketplace onboarding. A platform that collects payments for you requires a completed form.
• A US retailer's supplier checklist. A large customer wants your attestation before go-live.
• A new checkout. Switching gateway or adding a channel changes what you must prove.

Your role matters more than your size. A merchant sells its own goods or subscriptions. A marketplace, gateway, payment facilitator or checkout-tool provider handling card data for other businesses is usually a service provider, with a heavier assessment.

The outcome: a checkout that keeps you on the lightest route your acquirer will accept. The Council's guidance on the SAQ A questionnaire, for e-commerce merchants that rely on a third-party provider for payment functions, draws the line clearly^[3].

1. Embedded provider form (for example, an inline frame). You must confirm the page is not susceptible to script attacks, either with techniques such as those in requirements 6.4.3 and 11.6.1, or with your provider's written confirmation that its solution protects the page^[3]. 2. Redirect to the provider. The Council states the script criterion does not apply to redirects, such as HTTP 30x, meta-refresh or JavaScript redirects, or where payment is handed entirely to a provider, such as an emailed pay link^[3]. 3. Your own form, or card data through your servers. Far more systems come into scope, and the assessment is heavier.

The Council adds that SAQ eligibility criteria should not guide which requirements apply in a ROC assessment unless agreed with the compliance-accepting entity^[4]. We confirm your model, your provider's evidence and the form's eligibility in writing before committing you to a route.

The outcome: one short document showing where card data enters, where it goes and what can affect it, so your acquirer and your team see the same picture. A scoping session covers:

• Payment pages. The provider form or redirect, and every script that loads where customers pay.
• Storefront and billing platform. Plugins, themes and the hosting account behind them.
• Order and service tools. Fulfillment and customer-service systems that show or receive payment details.
• Data paths. Any server, queue, log or database card data passes through or lands in.
• People. Staff, agencies and contractors with access, and their laptops.
• Other channels. Phone and mail orders, in-store terminals, renewals and marketplace payouts.

We revisit it whenever your payment set-up changes.

The outcome: the controls in place before anyone external tests them. Sterling's plain-English summary of where the effort goes:

• Payment-page scripts. An inventory of every script where customers pay, an approver for each and an alert when one changes. Tag managers, chat widgets, review plugins and analytics are the usual surprises.
• Card data in the wrong place. Order exports, tickets, call recordings, logs and email.
• Access. Unique accounts, least privilege and strong sign-in for the storefront admin, hosting console and payment systems.
• Vulnerability management. Scanning, scheduled patching and testing of in-scope systems.
• Provider responsibilities. Every provider touching payments, the parts each covers and the parts that stay yours.
• Change control and incidents. Reviewed, recorded checkout changes, and a written plan for a page change or data exposure.

The outcome: we catch these in the gap assessment, not in front of your acquirer.

• "The storefront vendor covers it." A hosted store reduces what you prove; your staff, plugins and exports remain yours.
• An unreviewed script list. The criterion embedded-form merchants miss most often^[3].
• Choosing the form from a blog post. The accepting entity sets the route^[2].
• Wide agency access. Developers who can edit checkout code are part of your assessment.
• Peak-season changes. A holiday campaign tag, a new gateway or an order spreadsheet can change scope overnight.

The outcome: your validation delivered on time, with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required; for SAQ-eligible merchants and service providers we prepare and support the SAQ. The people who consult never perform your assessment.

1. Free gap assessment. We trace payment flows, settle your role and confirm with your acquirer what it requires. 2. Scope reduction. Hosted payment methods, tokenization and card data removed from tickets and exports. 3. Controls and evidence. Policies, procedures and technical fixes, with evidence collected in Effivity, our GRC automation platform. 4. Internal review. We test the work before anyone external looks. 5. Submission. We complete the SAQ with you, or coordinate the QSA, through to the Attestation of Compliance.

A fixed quote follows a free gap assessment, and PCI DSS is quoted separately from any other standard. To begin, use Get started and a Sterling expert will respond.

PCI DSS is validated in one of two ways, depending on how you handle card data and what your acquirer or card brand requires. A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required^[1]; for SAQ-eligible merchants and service providers we prepare and support the SAQ.

Either way, you work with Sterling from first scoping call to final submission. We coordinate:

• scoping: where card data is stored, processed or transmitted, and how to shrink that footprint;
• a gap assessment against the current version of the standard;
• the policies, procedures and technical control improvements needed to close the gaps;
• evidence collection and an internal review before anyone external looks at your environment;
• the assessment itself, including scheduling, evidence requests and follow-up questions.

What you receive is a validation of compliance, documented in the form your acquirer or card brand accepts. Our experts bring 30+ years of experience, and Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.

^[1] Become a Qualified Security Assessor (QSA). PCI Security Standards Council. accessed October 23, 2026.

• PCI DSS: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• PCI DSS SAQ Types Explained: Which One Your US Business NeedsUnited States
• PCI DSS 4.0.1 Requirements in Plain English for US BusinessesUnited States
• SOC 2 for US Payments and E-commerce CompaniesUnited States
• PCI DSS for US Fintechs: What Acquirers and Card Programs RequireUnited States
• Sterling in the United StatesUnited States

1. Document Library (PCI DSS v4.0.1 listed as a featured document). PCI Security Standards Council. accessed October 23, 2026.

2. FAQ 1473: What is the role of compliance-accepting entities and assessors in determining the applicability of PCI DSS requirements for merchant and service provider PCI DSS assessments?. PCI Security Standards Council. accessed October 23, 2026.

3. FAQ: How does an e-commerce merchant meet the SAQ A eligibility criteria for scripts?. PCI Security Standards Council. accessed October 23, 2026.

4. FAQ 1331: Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?. PCI Security Standards Council. accessed October 23, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.