PCI Compliance Checklist: 12 Requirements

The PCI DSS compliance checklist is a 12-requirement framework that any business storing, processing, or transmitting cardholder data must follow to secure that data. You work through the checklist by assessing your environment against each requirement, fixing gaps, and then validating compliance with a Qualified Security Assessor (QSA) or a self-assessment questionnaire (SAQ). This article breaks down the full checklist, explains how to apply it, and answers common questions about scope, cost, and validation.

What the 12 Requirements Actually Cover

The PCI Data Security Standard (DSS) is organized into six goals and twelve requirements. Each requirement has sub-requirements that define the specific controls you need. Here is the full checklist as published by the PCI Security Standards Council:

Build and Maintain a Secure Network – Requirement 1: Install and maintain firewalls. Requirement 2: Do not use vendor-supplied defaults for passwords or other security parameters.
Protect Cardholder Data – Requirement 3: Protect stored cardholder data (encrypt it, mask PANs, and retain only what you need). Requirement 4: Encrypt transmission of cardholder data across open, public networks.
Maintain a Vulnerability Management Program – Requirement 5: Protect all systems against malware and update antivirus software. Requirement 6: Develop and maintain secure systems and applications (patch management, secure coding).
Implement Strong Access Control Measures – Requirement 7: Restrict access to cardholder data by business need-to-know. Requirement 8: Identify and authenticate access to system components (unique IDs, MFA). Requirement 9: Restrict physical access to cardholder data.
Regularly Monitor and Test Networks – Requirement 10: Track and monitor all access to network resources and cardholder data (logging). Requirement 11: Regularly test security systems and processes (vulnerability scans, penetration tests).
Maintain an Information Security Policy – Requirement 12: Maintain a policy that addresses information security for all personnel.

These twelve are the core. Most merchants also need to complete the corresponding SAQ, which is a condensed version of these requirements tailored to how you accept payments.

How to Use the Checklist: Step by Step

Working through the checklist is not a one-time event; it is an annual cycle. Here is the practical sequence most organizations follow:

Determine your scope. Identify every system that stores, processes, or transmits cardholder data, plus any system that could connect to those systems. This is called the cardholder data environment (CDE).
Pick your SAQ. The PCI Council publishes several SAQ types (A, A-EP, B, C, D, etc.). Choose the one that matches your payment channel – for example, SAQ A if you outsource all processing to a third party and never store card data electronically.
Perform a gap analysis. Go through each requirement in your SAQ and mark whether you meet it, partially meet it, or do not meet it. Document evidence for each control.
Remediate gaps. Fix anything that fails. Common gaps include default passwords, missing network segmentation, and incomplete logging.
Complete the SAQ. Answer every question honestly. If you answer “no” to a required question, you must either fix it or document a compensating control.
Pass a vulnerability scan. If you are a service provider or a merchant that uses a payment application, you must have a quarterly ASV (Approved Scanning Vendor) scan of your external IPs.
Submit the SAQ and attestation. Send the completed SAQ and the Attestation of Compliance (AOC) to your acquiring bank or payment brand.

If you are a Level 1 merchant (over 6 million transactions per year) or a service provider, you must instead have an on-site assessment by a QSA and file a Report on Compliance (ROC).

Common Mistakes and Misconceptions

One of the biggest misconceptions is that using a third-party payment processor means you are automatically compliant. That is only true if you completely outsource all storage, processing, and transmission of cardholder data – and even then, you still have obligations under SAQ A, such as confirming your processor is PCI compliant and not storing any sensitive data yourself.

Another common mistake is ignoring network segmentation. Many breaches happen because the CDE is on the same flat network as the rest of the business. Segmentation is not a formal requirement, but it dramatically reduces scope – and the cost of compliance – because systems outside the CDE do not need to meet every requirement.

A third mistake is treating the checklist as a paperwork exercise. The point is to reduce breach risk. A company that checks every box but has no real monitoring or incident response plan is still vulnerable. The checklist is a floor, not a ceiling.

How to Choose the Right SAQ

Choosing the wrong SAQ is a frequent problem. Here is a quick guide based on how you accept payments:

SAQ A – You outsource all processing to a third party, and you never store card data electronically. You might still have paper copies or a physical imprint.
SAQ A-EP – You outsource processing but your website controls how the card data is collected (e.g., you embed an iframe or redirect to a processor).
SAQ B – You use only standalone, dial-out terminals or imprint machines, and you do not store card data electronically.
SAQ C – You use a payment application connected to the internet, but you do not store card data electronically.
SAQ D – Everything else, including any merchant that stores cardholder data electronically, or that does not fit another category.

Read the SAQ instructions carefully. If you are unsure, ask your acquiring bank or a QSA. Choosing a lower-level SAQ than you qualify for is a violation and can result in fines or loss of processing privileges.

Costs and Effort of PCI Compliance

There is no fixed price for PCI compliance. The cost depends on your size, complexity, and current security posture. Typical expenses include:

SAQ processing fees charged by your acquirer (often $50–$300 per year, but this varies).
ASV scans if required (typically $200–$500 per quarter per IP).
Penetration testing (often $5,000–$50,000 depending on scope).
Remediation costs – for example, upgrading systems, implementing MFA, or hiring a security consultant.
If you are Level 1, the QSA assessment itself can cost $10,000–$50,000 or more.

Non-compliance is usually more expensive. Card brands can fine acquiring banks, who then pass those fines to you. More importantly, a breach costs far more than compliance – the 2024 IBM Cost of a Data Breach report puts the global average at $4.88 million, though that figure includes all industries.

PCI Compliance vs. Other Security Frameworks

PCI DSS is often compared to ISO 27001, NIST CSF, and SOC 2. The key difference is that PCI DSS is prescriptive and mandatory for anyone handling card data, while the others are voluntary (though often required by business partners). ISO 27001 is a management system standard; NIST is a risk-based framework; SOC 2 is an auditing standard for service providers. Many organizations use PCI as a starting point and then layer on NIST or ISO to cover broader risks. PCI DSS 4.0, released in 2022, moved closer to these frameworks by emphasizing continuous risk assessment and customized approaches.

Frequently Asked Questions

What happens if I don’t become PCI compliant?

If you fail to validate compliance, your acquiring bank may impose fines, increase your processing fees, or ultimately terminate your ability to accept credit cards. In the event of a breach, non-compliance can also make you liable for fraud losses and legal costs that might otherwise be partly covered by your processor.

Do I need a QSA to become compliant?

Only Level 1 merchants and service providers are required to have a QSA perform an on-site assessment. Smaller merchants can self-assess using an SAQ, but they must still complete it accurately and submit it to their acquirer. Some merchants hire a QSA or a PCI consultant to help, but it is not mandatory for lower levels.

Can I store credit card numbers after a transaction?

You can store the Primary Account Number (PAN) if you have a legitimate business need, but you must render it unreadable (encrypt it or hash it) and you can never store the card verification code (CVV2) or the full magnetic stripe data after authorization. You also need a documented retention policy and a secure deletion process.

Is PCI compliance a one-time thing?

No. You must validate compliance annually, and you are expected to maintain the controls continuously throughout the year. Many SAQs require quarterly vulnerability scans, and all requirements are ongoing – for example, you must keep logs, update software, and review access rights regularly.

What is the difference between PCI DSS and PA-DSS?

PA-DSS (Payment Application Data Security Standard) applied to software vendors who develop payment applications. It was retired in 2022 and replaced by the Secure Software Lifecycle (SSL) requirements within PCI DSS 4.0. Merchants should use payment applications that are listed on the PCI Council’s list of validated payment software.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →