PCI DSS Checklist
Shrink the scope, then comply.The cheapest PCI strategy is architectural: reduce what touches cardholder data before implementing controls around what remains. This checklist runs scope first, deliberately.
01 Reduce scope before anything else
- Map every system, network segment, and person that touches cardholder data
- Outsource payment capture where possible: hosted fields, redirects, or tokenized SDKs
- Confirm you store no PAN data — if you must, document why and tokenize
- Segment the cardholder data environment from the rest of your network
- Determine your merchant level and SAQ type (SAQ A vs A-EP vs D changes everything)
02 Build and maintain secure systems
- Install and maintain network security controls between the CDE and everything else
- Replace all vendor defaults: credentials, SNMP strings, configurations
- Protect stored account data with strong cryptography and documented key management
- Encrypt cardholder data in transit over open networks
- Deploy anti-malware and keep systems patched within defined windows
- Develop software securely with code review and dependency scanning
03 Control access and monitor
- Restrict CDE access to need-to-know, with unique IDs and MFA
- Restrict physical access to systems handling cardholder data
- Log all access to systems and cardholder data; retain 12 months
- Run quarterly external scans via an Approved Scanning Vendor (ASV)
- Run internal vulnerability scans and an annual penetration test
04 Validate and maintain
- Maintain the information security policy and annual risk assessment
- Complete your SAQ (or ROC via a QSA at Level 1) annually
- Submit the Attestation of Compliance to your acquirer on their schedule
- Re-validate scope after any payments architecture change — before it ships
One number worth internalizing: moving from SAQ D to SAQ A cuts the requirement set by roughly an order of magnitude. If you’re designing payments now, that decision is worth more than every other item on this list combined — see ROC vs SAQ for how validation paths are decided.
PCI DSS Compliance
PCI DSS compliance services: scoping, segmentation, SAQ guidance or full RoC preparation, and continuous control monitoring for payment-handling companies.
Book a CallWhich SAQ do we need?
Fully outsourced payment pages (hosted redirect or iframe): SAQ A, the shortest. Your site serves the payment form but a processor handles data: usually SAQ A-EP. You touch or store cardholder data: SAQ D — the near-full standard. The architecture decision is the compliance decision.
Does using Stripe make us PCI compliant?
It makes compliance dramatically smaller, not automatic. You still validate annually for your integration type — Stripe's own docs map integration methods to SAQ types — and you still own the security of everything around the payment flow.
What changed in PCI DSS v4?
Stronger authentication requirements, more prescriptive e-commerce protections (script integrity on payment pages), and formalized targeted risk analyses. Future-dated v4 requirements became mandatory in 2025, so treat the full v4 set as current.