The PCI DSS obligation comes from your acquirer and payment processor, not a regulator, and two facts decide the shape of the programme. The first is whether you store, process or transmit cardholder data, and through which channels. The second is the validation route that follows: a self-assessment questionnaire, or a Report on Compliance for a Level 1 entity. Settle both first, because they decide how much of the 12 requirements you must evidence. Then work the requirements against v4.0.1, including the controls that became mandatory in March 2025, and only then compare platforms, remembering that no software replaces an Approved Scanning Vendor.
4 pages on PCI DSS, in the order the work happens. Jump to the stage you are at, or read straight through.
Confirm that PCI DSS reaches you, pick the SAQ or ROC route that matches how you handle card data, and track the 12 requirements item by item.
Judge platforms on coverage, crosswalks, data residency and pricing, and know which part of the work an Approved Scanning Vendor still has to do.
The free compliance check runs the PCI DSS gap assessment in about five minutes and gives you a scored report you can take to a board meeting.
14-day free trial · no credit card · unlimited users