What is on a PCI compliance checklist?

Step by step

1. Map the card data. Draw the flows: where a card number is entered, what it passes through, where it is stored, who it is sent to. Requirement 1.2 expects current network and data-flow diagrams, and they are also what tells you what is in scope.
2. Shrink the scope. Every system that stores, processes or transmits account data, and every system that can affect the security of those systems, is in your cardholder data environment. A hosted payment page or tokenization at the processor keeps card numbers off your servers and is the one change that removes the most work.
3. Confirm your level and your validation route. Your acquirer or the card brands set your merchant or service provider level from transaction volume. The level decides whether you self-assess with an SAQ or need a Report on Compliance from a Qualified Security Assessor. Ask your acquirer rather than guessing.
4. Pick the right SAQ. Each SAQ has eligibility criteria printed at the front, and they are the test. Read them against how you actually take payments before filling anything in.
5. Work the requirements. Network security controls (1) and secure configuration (2); protecting stored account data (3) and encrypting it in transit (4); malware defenses (5) and secure development and patching (6); need-to-know access (7), identity and authentication (8) and physical access (9); logging and monitoring (10); testing (11); and the policies and programs in (12).
6. Run the scans and the testing. Internal and external vulnerability scans at least once every three months and after significant change (11.3), with the external scans performed by an Approved Scanning Vendor, and penetration testing at least once every 12 months (11.4). Remediate and rescan or retest to prove the fix.
7. Do the targeted risk analyses v4 asks for. Where a requirement lets you set the frequency of an activity yourself, 12.3.1 requires a documented targeted risk analysis justifying the interval you chose. These are easy to miss and an assessor will ask for them.
8. Validate and sign. Complete the SAQ or the ROC, sign the Attestation of Compliance, and send it where your acquirer or the requesting party asks. Then keep the controls running: validation is annual, the requirements are continuous.

Scope is the whole game

PCI DSS applies to the cardholder data environment and to anything that can affect its security. Two businesses with identical revenue can face completely different programs depending on whether a card number ever reaches their own systems. Before you buy tooling or hire an assessor, change the payment flow if you can: a redirect or an iframe hosted by the processor, tokenization for anything you need to charge again, and no storage of the primary account number on your side.

What v4.0.1 changed about how you prove things

PCI DSS v4.0.1 is a limited revision of v4.0: it clarifies and corrects requirement text but adds or removes no requirements. Version 4 did change the shape of the work: the future-dated requirements are now in full effect, several requirements let you choose a frequency and then ask you to justify it with a targeted risk analysis under 12.3.1, and the customized approach lets you meet a requirement’s stated objective by another route, with the analysis and assessor validation that goes with it. If your last assessment was against v3.2.1, the gap is mostly in evidence and documentation rather than new technology.

The items teams forget

Payment page script inventory and change detection (6.4.3 and 11.6.1), which exist because of attacks that modify checkout pages in the browser. Access reviews at least twice a year (7.2.4). Documented roles and responsibilities for each requirement area (the x.1 sub-requirements). Keeping live account data out of test environments (6.5). Service provider duties that merchants do not have, including more frequent segmentation testing.

Where Keel fits

Keel ships PCI DSS v4.0.1 as a trackable control set at its second-level requirements (for example 6.3 and 11.3), crosswalked to the SOC 2 and ISO 27001 controls you already run, so evidence attached to a mapped control counts for both. Assessors work the detailed items against the published standard, which Keel does not reproduce or replace.

FAQ