PCI DSS compliance

PCI DSS applies to every merchant and service provider that stores, processes or transmits payment card data, or can affect its security. It is not a law: the card brands require it through your acquiring bank and your contracts. Version 4.0.1 is the only active version, and all its requirements apply since 31 March 2025.

What it requires

The main obligations in plain words, with the article or clause they come from.

  • Req. 1–2

    Network security controls around the cardholder data environment, and hardened configurations with vendor defaults changed.

  • Req. 3–4

    Keep as little card data as possible, never keep sensitive authentication data after authorization, make stored card numbers unreadable and encrypt them over public networks.

  • Req. 5–6

    Protect against malware and phishing, install critical patches within a month, develop software securely and control the scripts on payment pages.

  • Req. 7–9

    Access by need to know, a unique ID for everyone, multi-factor authentication into the environment, and physical security, card terminals included.

  • Req. 10–11

    Log access and review the logs every day, run vulnerability scans every three months and penetration tests every year.

  • Req. 12

    A security policy, targeted risk analyses, a scope confirmed every year, awareness training, oversight of service providers and an incident response plan.

  • Validation

    Confirm compliance every year with a self-assessment questionnaire or a report on compliance by a Qualified Security Assessor, and an attestation of compliance.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • The 12 requirements and the service provider appendix in the catalogue, linked to your policies, controls and evidence; the ones that apply only to service providers say so, and merchants mark them Not applicable with the reason.

  • Controls from the library mapped to PCI DSS, with test plans and results; the ISO 27001 crosswalk counts work already done.

  • Quarterly vulnerability scans, the wireless check, the six-monthly rule review, the yearly penetration test, scope confirmation and validation as recurring activities in the governance calendar, with owners and reminders.

  • Payment service providers in the vendor register with their review dates, and their attestation of compliance attached as evidence.

  • Fasttrack asks how you take card payments and says whether PCI DSS is required or recommended, and why.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • 1 Network security controls5
  • 2 Secure configurations3
  • 3 Protecting stored account data7
  • 4 Protecting cardholder data in transmission2
  • 5 Protection from malicious software4
  • 6 Secure systems and software5
  • 7 Access by business need to know3
  • 8 Identification and authentication6
  • 9 Physical access to cardholder data5
  • 10 Logging and monitoring7
  • 11 Regular security testing6
  • 12 Policies and programs10
  • A1 Multi-tenant service providers2

Related frameworks: ISO 27001

Common questions

Does PCI DSS apply if a payment provider handles the card data?

Yes, though much less of it. You still confirm compliance every year, usually with a short self-assessment questionnaire such as SAQ A when customers pay on the provider's hosted page, and you stay responsible for the page that sends them there.

Self-assessment questionnaire or report on compliance?

It depends on your level, which the card brands set by yearly transaction volume. Most merchants file a self-assessment questionnaire; the largest merchants, and service providers above a threshold, need a report on compliance by a Qualified Security Assessor. Your acquiring bank tells you which applies.

Does Atitic store card data?

No, and it should not: keep card numbers out of evidence files and notes. Atitic holds the records, policies and evidence about your card data environment, not the card data itself.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt PCI DSS in a free trial, link the evidence you already have and see what is still missing.

Start a free trial