PCI DSS Compliance – Frequently Asked Questions (FAQs)

Based in Exeter, Devon, but with PCI DSS compliance clients across the South West, the UK and the world beyond, the Securious team hear many questions relating to PCI and PCI compliance. Here are 42 of the most common, but if we haven’t answered your question, just send it to us via email at pci@securious.co.uk. 

Click here to read our Ultimate Guide to PCI Compliance 

1. What is PCI Compliance?

To achieve PCI compliance means to meet the standards of the Payment Card Industry Data Security Standard (PCI DSS). This standard contains a set of requirements designed to increase data security and protect merchants and customers when taking and making payments by debit or credit card.

2. Is PCI Compliance the same as PCI DSS Compliance?

Yes. The full term is PCI DSS Compliance, but in practice, most people refer to it as PCI Compliance.

3. To whom does the PCI DSS apply?

The PCI DSS applies to all organisations that process, store, or transmit payment card information (both credit and debit cards).

4. Where can I find the PCI Data Security Standard (PCI DSS)?

The PCI DSS can be found on the PCI Security Standards Council website.

5. What are the PCI compliance ‘levels’ and how are they determined?

There are four levels of PCI DSS compliance, based on the number of annual transactions a business processes: Level 1 (over 6 million transactions per year), Level 2 (1 million to 6 million transactions per year), Level 3 (20,000 to 1 million transactions per year), and Level 4 (fewer than 20,000 transactions per year).

6. Are there any specific technologies or solutions required for PCI DSS compliance?

No, there are no specific technologies or solutions required for PCI DSS compliance. Organisations can implement any combination of security measures as long as they meet the requirements of the standard.

7. What does a Level 1 merchant have to do in order to satisfy the PCI DSS requirements?

Level 1 merchants are required to undergo an annual on-site PCI DSS assessment by a Qualified Security Assessor (QSA) and to complete a  Report on Compliance (RoC) and Attestation of Compliance (AoC)

8. What does a Level 2 merchant have to do in order to satisfy the PCI DSS requirements?

Level 2 merchants may be required to complete a Self-Assessment Questionnaire (SAQ) In some cases your acquirer may insist on a PCI QSA-led assessment and completion of the SAQ or RoC.

9. What does a Level 3 merchant have to do in order to satisfy the PCI DSS requirements?

Level 3 merchants are required to complete a Self-Assessment Questionnaire (SAQ).

10. What does a Level 4 merchant have to do in order to satisfy the PCI DSS requirements?

Generally applicable to small-sized businesses (Level 4 merchant) with low transaction volumes, and can validate PCI compliance through the completion of a Self-Assessment Questionnaire (SAQ).

11. How can I ensure continued compliance with PCI DSS?

To ensure continued compliance with PCI DSS, organisations should regularly review and update their security policies and procedures, monitor their networks for potential vulnerabilities, and maintain an incident response plan.

If you are interested in seeking support with maintaining your PCI DSS compliance, you can read about our Managed PCI DSS Compliance Service by clicking here.

12. How does taking credit cards by phone work with PCI?

Credit card transactions taken by phone can be made compliant with PCI DSS by using a secure method for processing the payment card information It is important not to record the calls, as you will be storing full card data, and it is worth looking at outsourcing payment card capture function to remove the risk of payment card data being written down or other mishandling of this.

13. If I only accept payment cards over the phone, does PCI DSS still apply to me?

Yes, PCI DSS still applies, although likely to be a smaller scope and reporting requirements.

14. Do organisations using third-party payment processors have to be PCI DSS compliant?

Organisations using third-party payment processors are still required to be PCI DSS compliant, as they are still responsible for systems that interact or could interfere with the safe handling of payment card data.

15. My business has multiple locations, is each location required to validate PCI compliance?

PCI DSS organisations will agree scope for PCI compliance and that should include all locations that payment card data is processed, stored and transmitted.

16. How much does it cost to achieve PCI compliance?

The cost of PCI engagement will depend on scope which includes a number of different scenarios. It will also depend on where you are and how much work is needed to meet the appropriate compliance levels, following an initial PCI DSS gap analysis. For more guidance, you can send us an email to pci@securious.co.uk or try our free online PCI DSS quote generator by clicking here.

17. What is an SAQ (Self-Assessment Questionnaire)?

A Self-Assessment Questionnaire (SAQ) is a self-validation tool to attest PCI DSS compliance It’s suitable for organisations that fall outside of Level 1 of the PCI DSS.

If you would like support with your PCI DSS SAQ, you can read about our Assisted PCI DSS SAQ Compliance Service by clicking here.

18. What is the difference between SAQ and RoC?

A Self-Assessment Questionnaire (SAQ) is a document that merchants and service providers can use to assess their compliance with PCI DSS. A Report on Compliance (RoC) is a more formal assessment conducted by a Qualified Security Assessor (QSA) that includes on-site testing and examination of policies and procedures.

19. What is a PCI QSA company?

Qualified Security Assessor (QSA) companies are independent security organisations that have been qualified by the PCI Security Standards Council to validate an organisation’s compliance with PCI DSS.

20. What is a PCI QSA employee?

Quality Security Assessor (QSA) employees are individuals who are employed by a QSA Company and have satisfied and continue to satisfy all QSA Requirements.

21. We only do e-commerce. Which SAQ should we use?

If a business only does e-commerce, they should always check with their acquirer, but will likely be able to use SAQ A for their self-assessment.

22. My company doesn’t store payment card data so PCI compliance doesn’t apply to us, right?

No, PCI DSS applies to any organisation or merchant that processes, stores, or transmits payment card information, regardless of whether or not they store the data.

23. Are debit card transactions in scope for PCI?

Yes, debit card transactions are in scope for PCI DSS. If the payment card displays any of the following logos, VISA, Mastercard, American Express, Discover, JCB or UnionPay, you will be in scope for PCI DSS.

24. Am I PCI compliant if I have an SSL certificate?

Depending on PCI DSS scope, having an SSL certificate does not guarantee PCI DSS compliance. PCI DSS has specific requirements for protecting payment card information that go beyond just having an SSL certificate.

25. My company wants to store payment card data. What methods can we use?

Businesses that want to store payment card data must first understand what data is allowed to be stored. Any Sensitive Authentication Data (SAD) This data includes the full magnetic stripe data found on the back of the card, as well as any equivalent data on the EMV chip or elsewhere. SAD also includes the CVV (or equivalent data) as well as the PIN and PIN block. SAD cannot be stored after authorisation. Businesses can use methods such as One-way Hash functions, Truncation, tokenisation and strong cryptography.

26. What are the penalties for non-compliance?

Penalties for PCI DSS non-compliance can include an increase in transaction costs, fines, and the loss of the ability to accept payments.

27. What is defined as ‘cardholder data’?

Cardholder data is defined as any PII information related to a credit card or debit card, including the cardholder’s name, account number, expiration date, and security code.

28. What is the definition of ‘merchant’?

A merchant is defined as any business that accepts payment cards as payment.

29. What constitutes a Service Provider?

A Service Provider is a company that handles payment card information on behalf of a merchant or other organisation.

30. What constitutes a payment application?

A payment application is software that is used to process or facilitate payment card transactions.

31. What is a payment gateway?

A payment gateway is a service that securely processes payment card transactions and communicates the transaction information between the merchant, the payment processor, and the acquiring bank.

32. What is PA-DSS?

PA-DSS (Payment Application Data Security Standard) is a set of requirements for payment applications to help ensure that they are secure and do not store sensitive cardholder data.

33. Can the full payment card number be printed on the consumer’s copy of the receipt?

The full payment card number should not be printed on the consumer’s copy of the receipt. A maximum of the first six and last four digits is permitted.

34. Do I need vulnerability scanning to validate compliance?

Depending on your PCI DSS scope, vulnerability scanning may be required in order to validate PCI compliance.

35. Do I need logging and monitoring?

One of the requirements of PCI DSS is to implement logging and monitoring of all access to cardholder data and systems. The specific logging and monitoring requirements will depend on the size and complexity of your company’s PCI DSS scope and environment.  Securious can help determine whether your company is required to implement PCI DSS logging and monitoring, and even provides it as a service. For more information, call us now on 01392 247 110 or email pci@securious.co.uk!

36. What is a vulnerability scan?

A vulnerability scan is a security assessment that identifies vulnerabilities in a system or network that could be exploited by hackers.

37. How often do I have to have a vulnerability scan?

The frequency of vulnerability scans required for PCI DSS compliance depends on the PCI DSS scope. Level 1 merchants and Service Providers using network segmentation to reduce scope must perform internal and external vulnerability scans every 90 days, or  after any significant changes to their cardholder data environment For help with vulnerability scans, contact us at pci@securious.co.uk

38. What if my business refuses to cooperate?

Although not a legal requirement to be PCI DSS compliant, you will be open to extra transaction charges and your acquirer is likely to push you to take action to become PCI compliant, or even go as far as to withdraw your payment facility.

39. If I’m running a business from my home, am I a serious target for hackers?

Any business that processes, stores, or transmits credit card information is a potential target for hackers, regardless of the size or location of the business.

40. What should I do if I’m compromised?

If a business is compromised, they should immediately report the incident to the bank and follow the appropriate incident response procedures.

41. Is PCI V4.0 going to change PCI Compliance much?

Yes! This is the biggest change to PCI since v3.2.1 in 2018. Although there is a transition period, it is important you understand the implications and prepare for them. Learn more here

42. Should I use a local PCI QSA company?

Any qualified PCI QSA company can undertake PCI DSS compliance work anywhere in the world, so it isn’t essential. However, if you are lucky enough to have a good local PCI QSA company then there are many benefits in using them. For example, annual PCI Compliance for larger merchants normally requires time on-site so travel and overnight stays can mean costs escalate quickly. At Securious, we offer a 5% discount to companies based in the South West to recognise the mutual benefits. Learn more here

Need some help with you PCI DSS compliance?

Securious has been a PCI QSA company since 2016 and has a team of qualified, highly experienced PCI DSS QSA and 3DS assessors who can help you achieve and maintain compliance with the latest PCI DSS.

We are based in Exeter, Devon but undertake PCI QSA work nationally and internationally. We are the only PCI DSS QSA company in the region, so if you are based in Devon, Cornwall or Somerset, you will also benefit from cost efficiencies with on-site assessments.

Our mission is to build cyber security confidence and when it comes to PCI DSS compliance, we will work with you to make the process as efficient as possible, helping you understand what you need to do, and why.

We have three different options for helping our clients with PCI DSS compliance:

1: PCI DSS QSA Gap Analysis & Assessment (one-off fee)

We’ll help you achieve PCI DSS compliance by conducting a gap analysis, telling you what needs to change and assessing you once remediation is complete.

• We start by assessing your situation to determine the scope and what level you need to be reporting at. Then, we conduct a gap analysis, looking at what you already have in place against the requirements. From this, we can determine any additional measures you need to implement to achieve compliance.
• We will then advise and assist with any remediation work needed to meet the standard.
• Finally, we will carry out your assessment and complete the necessary reports and questionnaires as required.

If you would like to know how much a PCI DSS engagement with Securious is likely to cost, you can try our free online PCI DSS quote generator by clicking here.

Read more about our PCI DSS QSA Gap Analysis & Assessment by clicking here.

2: Managed PCI DSS Compliance Service (fixed monthly fee)

We’ll help you maintain PCI DSS compliance on an ongoing basis, ensuring everything is in good shape before the annual assessment for a much simpler process.

• Our PCI DSS Compliance Managed Service works proactively to ensure your organisation maintains continuous compliance with the latest PCI DSS.
• By focusing on ongoing documentation management, continuous monitoring, and regular risk and compliance reviews, we’ll help you stay ahead of security requirements and minimise the stress of annual assessments.
• This approach is tailored to your specific needs and is well-aligned with the latest PCI DSS V4 standard, which prioritises continuous compliance.

Pricing starts from £535 (+ vat) per month.

Read more about our Managed PCI DSS Compliance Service by clicking here.

3: Assisted PCI DSS SAQ Compliance Service (one-off fee)

We’ll help you with your PCI DSS SAQ so you know what the questions mean and how to answer them, so you can easily achieve compliance.

• We’ll give you qualified support with your SAQ
• So you know what the questions mean and how you should answer them
• The result is far less time wasted trying to understand the SAQ and much greater peace of mind

Pricing starts from £975 (+ vat).

Read more about our Assisted PCI DSS SAQ Compliance Service by clicking here.

To learn how we can help with your specific situation, please call now on +44 (0) 1392 247 110, email pci@securious.co.uk or fill in the contact form below

To see more of our PCI resources, click here