Understanding the Payment Card Industry Data Security Standards (PCI DSS) — what it means for your business, what your obligations are, and how we help you stay protected.
On September 7, 2006, the five major card brands — Visa, Mastercard, American Express, Discover, and JCB — joined forces to form the Payment Card Industry Security Standards Council and establish the PCI Data Security Standards (PCI DSS).
These standards apply to any organization that stores, processes, or transmits cardholder data for any of the major credit card brands. If your business accepts credit cards, PCI DSS applies to you.
Compliance involves completing an annual Self-Assessment Questionnaire (SAQ) and, depending on your transaction volume, submitting to quarterly network vulnerability scans performed by an Approved Scanning Vendor (ASV).
The 12 core requirements of PCI DSS are organized into 6 logical control groups, covering everything from network security and encryption to access control and monitoring. There are 9 variations of the SAQ tailored to how your business actually handles card data.
Your annual transaction volume determines your merchant level, which in turn dictates your specific compliance requirements and validation methods.
Annually. Requires an annual on-site security audit by a Qualified Security Assessor (QSA) and quarterly network scans by an ASV.
1Per year. Must complete an annual SAQ and quarterly vulnerability scans with an Approved Scanning Vendor.
2Annually (e-commerce). Requires an annual SAQ and quarterly network scans. Typically applies to online-only merchants.
3Per year (e-commerce) or up to 1M other transactions. Annual SAQ recommended; quarterly scans may be required by your acquirer.
4Based on your annual transaction volume across all channels, identify which of Visa's four merchant levels applies to your business. Your level determines the specific validation requirements you must meet.
Levels 1–4 based on annual volumeSelect the appropriate SAQ version based on how your business stores, processes, and transmits cardholder data. There are 9 variations. Answer all questions honestly and document your security controls.
9 SAQ versions availableAfter completing your SAQ, fill out the Attestation of Compliance — a formal declaration that your business meets PCI DSS requirements. Like the SAQ, there are 9 AOC variations corresponding to your specific situation.
Completed after SAQ submissionIf required by your merchant level or acquirer, arrange quarterly network scans through an Approved Scanning Vendor (ASV). These external scans identify vulnerabilities in your internet-facing systems before attackers can exploit them.
Every 90 days via an ASVSubmit your completed SAQ, AOC, and ASV scan reports to your acquiring bank or payment processor. Level 1 merchants may need annual validation by a Qualified Security Assessor (QSA) instead of the SAQ.
Annual submission required
The SAQ is a validation tool for merchants who are not required to undergo an on-site data security assessment. It covers all 12 PCI DSS requirements organized into 6 control groups. You must complete it annually, and the correct version depends on how your business handles cardholder data.
The AOC is completed immediately after your SAQ. It is a formal attestation — signed by an officer of your company — confirming that your business meets the PCI DSS requirements applicable to your merchant type. The AOC has 9 variations that mirror the SAQ structure.
🔒 Security First
PCI Compliance is not currently mandated by federal law in the United States. However, if you want to accept credit cards, the card brands require it — and the consequences of non-compliance can be financially devastating.
Annual compliance reminders are typically sent to merchants via email or included on their processing statement. Many processors also offer access to a compliance partner or portal to help you complete the process.
Our team can connect you with a compliance partner who will walk you through the entire process — SAQ, ASV scans, and everything in between. We also offer a free PCI for Dummies e-book to get you started.
