PCI DSS Compliance Consulting for Merchants and Processors

Any organisation that stores, processes, or transmits payment card data is subject to PCI DSS. This includes merchants of every size, payment service providers, payment gateways, acquiring banks, and any third party that handles card account data on behalf of another entity. Compliance is mandated contractually by the card brands through acquiring banks, not by law in most jurisdictions, but non-compliance can result in card brand fines, elevated transaction fees, mandatory forensic investigations, and ultimately suspension of card acceptance rights. Even organisations that outsource all card processing to a gateway must still validate compliance at the appropriate level.

The 12 PCI DSS requirements are grouped into six control objectives. The first two cover installing and maintaining network security controls and applying secure configurations across all in-scope system components. Requirements 3 and 4 address protecting stored account data and securing cardholder data during transmission using strong cryptography. Requirements 5 and 6 focus on protecting systems from malicious software and maintaining secure systems and applications. Requirements 7 and 8 govern restricting access by business need and authenticating identities on in-scope systems. Requirement 9 covers physical access to cardholder data, while Requirement 10 mandates logging and monitoring all access. Requirement 11 requires regular security testing including ASV scans and penetration tests. Requirement 12 establishes the organisational information security policies and programs that underpin all other controls.

A Self-Assessment Questionnaire is a self-validation tool used by merchants and service providers who do not need a Qualified Security Assessor to conduct their assessment. The correct SAQ type depends on how your organisation accepts card payments: SAQ A applies to merchants who fully outsource card processing; SAQ A-EP to e-commerce merchants with a page that redirects to a third-party processor; SAQ D is the most comprehensive and covers merchants who store card data or do not fit simpler categories. A Report on Compliance is a formal assessment conducted by a QSA and is required for Level 1 merchants processing over six million transactions annually and for large service providers. The ROC involves document review, interviews, observation, and technical testing across the entire CDE, and results in a signed report that the acquiring bank submits to the card brands.

Approved Scanning Vendor scans are quarterly external vulnerability assessments of your internet-facing IP addresses and domains, required under PCI DSS Requirement 11. The scans must be performed by a vendor on the PCI SSC list of approved providers and must produce a passing report to satisfy your annual compliance validation. Any finding rated above a base CVSS score of 4.0 is considered a failure and requires remediation and rescanning before you can attest to compliance. Internal quarterly scanning of your CDE systems is also required, and annual penetration testing verifies that your network segmentation actually prevents an attacker on the outside from reaching the cardholder data environment, not just that firewall rules say they should not be able to.

Tokenisation substitutes a live Primary Account Number with a non-sensitive token that has no value outside your own vaulting system. When your application layer works only with tokens, those systems no longer store, process, or transmit card data in any meaningful sense, which can remove them from PCI DSS scope entirely. The practical effect is a smaller cardholder data environment, fewer systems subject to the 12 requirements, lower remediation cost, and a narrower attack surface. Combined with point-to-point encryption, which protects card data from the point of capture to your payment processor, tokenisation is one of the most effective scope-reduction tools available to merchants who want to minimise the ongoing burden of annual compliance.