The PCI DSS obligation comes from your acquirer and payment processor, not a regulator, and two facts decide the shape of the programme. The first is whether you store, process or transmit cardholder data, and through which channels. The second is the validation route that follows: a self-assessment questionnaire, or a Report on Compliance for a Level 1 entity. Settle both first, because they decide how much of the 12 requirements you must evidence. Then work the requirements against v4.0.1, including the controls that became mandatory in March 2025, and only then compare platforms, remembering that no software replaces an Approved Scanning Vendor.
6 pages on PCI DSS, in the order the work happens. Jump to the stage you are at, or read straight through.
Confirm that PCI DSS reaches you, pick the SAQ or ROC route that matches how you handle card data, and track the 12 requirements item by item.
Price the validation route your acquirer assigns, the scans and penetration tests the standard repeats every year, and the scope that decides both.
Know why an ISO 27001 certificate does not replace PCI DSS validation, where the two share evidence, and where PCI DSS fixes the number.
Judge platforms on coverage, crosswalks, data residency and pricing, and know which part of the work an Approved Scanning Vendor still has to do.
The free compliance check runs the PCI DSS gap assessment in about five minutes and gives you a scored report you can take to a board meeting.
14-day free trial · no credit card · unlimited users