PCI DSS, the Payment Card Industry Data Security Standard, applies to organizations that store, process or transmit cardholder data, and to anyone who could affect the security of the systems that do. The current version is v4.0.1, and v4.0 was retired on 31 December 2024. For a small or mid-size business the hard part is not the standard itself, it is knowing what to do first. Here is one workable order.
1. Ask your acquirer what they expect
Your merchant bank or payment processor, together with the card brands, sets what validation you need to show. Ask them in writing which self-assessment questionnaire or report applies to you and when it is due.
2. Name one owner
Pick a person who is accountable for the effort, with time and budget to act. PCI work that belongs to everyone often belongs to no one.
3. Map where card data goes
Trace each path: website checkout, phone orders, card terminals, emailed forms, paper, exports and the systems behind them. Draw it. The diagram is also a document you will need later.
4. Handle less card data
The cheapest control is the data you do not hold. Stop storing what you do not need, and note that sensitive authentication data, such as the security code, is not allowed to be kept after authorization. Consider a hosted payment page, tokenization or validated point-to-point encrypted terminals so card numbers can stay off your own systems.
5. Define your scope
Scope is the cardholder data environment plus systems that connect to it or can affect its security. Network segmentation can shrink scope, but it only counts if it is designed well and tested.
6. Choose the right questionnaire
Your payment setup usually decides which self-assessment applies. A business that fully outsources checkout to a hosted page often has a much shorter questionnaire than one that handles card data on its own servers. Confirm the choice with your acquirer rather than guessing.
7. Run a gap assessment
Compare what you do today with the requirements. Typical findings include missing multi-factor authentication on administrative access, weak logging, patching that has slipped, shared accounts and default passwords. Internal and external vulnerability scans, with external scans performed by an Approved Scanning Vendor, belong here too.
8. Fix in priority order
Start with items that remove the most risk for the least effort: multi-factor authentication, patching exposed systems, removing default and shared credentials, and turning on useful logs. Then work through the remaining gaps.
9. Write it down
Policies, procedures, network and data-flow diagrams, an inventory of systems, a list of service providers with who is responsible for what, and an incident response plan. If a control is not documented and evidenced, an assessor may treat it as not performed.
10. Make it routine
Security work is not a once-a-year sprint. Put recurring scans, access reviews, log reviews, change control and training on a calendar, and test your incident response plan so people know their roles.
Common stumbling blocks
- Treating PCI as an IT-only project when finance, operations and customer service also touch card data.
- Scoping too late, then discovering card numbers in email, spreadsheets or call recordings.
- Assuming a payment provider takes on every responsibility. Providers usually cover part of the list, and your agreement should say which part.
- Collecting evidence only when an assessment is due, which turns a manageable job into a scramble.
Where this goes next
Version 4.0.1 was a limited revision that clarified wording and added or removed no requirements, so work you do against v4.0 still points the right way. If you are unsure about scope, begin there: a smaller, well-understood environment is easier to secure and easier to document.
We help teams scope, close gaps and prepare evidence. Message us to talk through your PCI plan.
Sources
Discover more from Core-Infosec
Subscribe to get the latest posts sent to your email.
