Skip to content

Financial · PCI Security Standards Council

PCI DSS v4.0.1

All future-dated requirements became mandatory March 31, 2025. If you take cards, this applies now.

Take the 3-minute Cyber Hygiene Test

Rather skip the call? Get a fixed-fee PCI DSS quote in writing.

One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing

Who it applies to

The businesses that carry PCI DSS, and the pages written for them.

Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.

Healthcare & DentalFinancial ServicesLaw FirmsAccounting & Tax FirmsRetail & Multi-Location StoresNonprofits & AssociationsAuto Repair & Skilled TradesRestaurants, Hotels & HospitalityPrivate Schools & Tutoring

Which packages prepare you for it

Cyber and Data Protection Assessment

Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year

Fixed feescoped in 30 minutes
Details →

There is no PCI DSS package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the PCI DSS-specific requirements are scoped with you in a 30-minute call.

What it asks for

In plain English, what PCI DSS expects you to have in place.

  • Cardholder data scoped and segmentedKnow where card data flows, and keep everything else out of scope.
  • Twelve requirementsNetwork controls, secure configurations, protection of stored and transmitted account data, vulnerability management, access control, logging, testing and a policy program.
  • The right validationA Self-Assessment Questionnaire or a Report on Compliance, depending on your volume and how you take cards.
  • E-commerce page controlsScript management and tamper detection on payment pages under v4.0.1.
  • Third partiesProcessors and hosting providers listed, with their compliance evidence on file.
  • Continuous rhythmQuarterly scans, annual validation and a targeted risk analysis for the requirements that allow flexibility.

A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.

Or start with the 3-minute test

Where it starts

Your one-stop shop for PCI DSS

For most small merchants PCI is a questionnaire, a scan and a bank that keeps asking. The cost is decided by one thing: how much of your network touches card data.

The PCI Security Standards Council publishes the standard and the Self-Assessment Questionnaires; your acquiring bank decides which one you file and how often. Keep card data off your systems and you file SAQ A. Store, process or transmit it yourself and you are in SAQ D, with most of the 12 requirements in play.

Most platforms give you the questionnaire as a form. We redraw the network so the questionnaire gets shorter, fix what is left, run the scans and hand your bank a complete file.

Which receipt is yours: pick how you take cards

Pick one and we show the likely questionnaire. Your acquiring bank has the final say.

The steps

Seven steps from "the bank sent a PCI form" to a filed attestation

The whole PCI journey, short version. We handle every step with you.

find the card data

Map where cards are read, sent and stored

Terminals, the website, the phone, the back office, the spreadsheet someone keeps. Scope is everything that touches card data and everything connected to it.

With AccuSights: we trace it with you and draw the diagram your bank will ask for.

shrink the till

Reduce the scope

Hosted payment pages, P2PE terminals and network segmentation move whole systems out of scope. Every system removed is a requirement you no longer evidence.

With AccuSights: the first thing we look for is the change that moves you to a shorter SAQ.

pick the receipt

Choose the right SAQ

SAQ A for fully outsourced e-commerce, B and B-IP for terminals, P2PE for validated encryption, D for everyone else. Your bank's program confirms it.

SAQ A or SAQ D

SAQ A: card-not-present merchants that outsource all card handling to a validated provider. The shortest questionnaire, with the v4.0.1 payment page requirements added.

SAQ A vs SAQ D at a glance
FeatureSAQ ASAQ D
Who files itFully outsourced card-not-present merchantsMerchants that handle card data on their own systems
LengthThe shortest questionnaireThe longest; most requirements apply
ScansRequired where the page is hosted by youQuarterly external scans by an approved vendor
Typical fixKeep the redirect clean, watch the payment page scriptsSegmentation, MFA, logging, testing
check for holes

Run the gap assessment

Each applicable requirement in v4.0.1, including the ones that became mandatory on 31 March 2025: scripts on payment pages, authenticated scans, targeted risk analyses.

With AccuSights: your engineer scores it requirement by requirement and writes the fix list.

fix and scan

Close the gaps and run the scans

Segmentation, MFA, patching, logging, the quarterly external scan by an approved vendor where your SAQ requires it.

With AccuSights: remediation is in-house or with your IT provider, scans scheduled and filed.

keep it running

Stay compliant between filings

Requirements are continuous, the attestation is yearly. A new terminal or a website change pulls systems back into scope.

Scope monitorIllustration
  • Terminals on their own networkPassing
  • Quarterly scan passedPassing
  • No card numbers in emailPassing
  • Payment page scripts unchangedPassing

With AccuSights: our monitoring flags the change before the bank does.

file it

Sign the attestation

The SAQ, the attestation of compliance and the scan reports go to your bank. Larger merchants need a QSA for a Report on Compliance; we are not a QSA, and we get you ready for one.

With AccuSights: we assemble the file and sit with you through the bank's questions.

Why AccuSights

Why small merchants pick AccuSights for PCI

The platforms assume you have an IT department to segment the network. Most restaurants and clinics have a card terminal and a Wi-Fi password.

Priced for a startup, not a Series D

One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.

The endpoint agent is built in

Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.

A human who has done this before

A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.

One till, many rules

The same controls answer HIPAA for a clinic, FTC Safeguards for a dealer and the cyber insurance form, so the work counts more than once.

PCI DSSHIPAAFTC SafeguardsCIS ControlsNIST CSF 2.0

What it costs

What PCI DSS costs, in plain numbers

Scope decides the bill. Here is what one QSA publishes.

$50 to $200The Self-Assessment Questionnaire route for a small business, with scanning at $100 to $200 per IP address.Source: SecurityMetrics, How Much Does PCI Compliance Cost?, updated 4 June 2026
Around $15,000The average onsite assessment by a QSA, for merchants that need a Report on Compliance.Source: SecurityMetrics, How Much Does PCI Compliance Cost?, updated 4 June 2026
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)

Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.

Get my PCI quote

Self-serve compliance software

  • You get a portal and drive it yourself.
  • Expert help is often a separate purchase or a partner referral.
  • Device checks usually need an MDM you set up first.
  • Pricing comes after a sales call.

AccuSights

  • A named engineer runs it with you.
  • Guidance and remediation are included, not referred out.
  • The endpoint agent ships with the platform.
  • A fixed fee, in writing, within 24 hours of the intake form.

Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing

Questions

PCI DSS questions we get every week

What is PCI DSS?
The Payment Card Industry Data Security Standard is a set of security requirements from the PCI Security Standards Council for any business that stores, processes or transmits card data. It is enforced through contracts with card brands and processors, not by a government. Version 4.0.1 is current. We help merchants and service providers understand and meet it.Source: PCI Security Standards Council document library (PCI DSS v4.0.1)
When did PCI DSS v4 requirements take effect?
Version 4.0 replaced 3.2.1, which retired in March 2024, and version 4.0.1 made clarifications. The future-dated requirements, such as stronger authentication and payment page script controls, became mandatory on 31 March 2025. If your last validation predates that, check what changed. Our assessment maps your card flows to the current requirements.Source: PCI Security Standards Council document library (PCI DSS v4.0.1)
Which self-assessment questionnaire do I need?
It depends on how you accept cards: e-commerce with a fully hosted payment page, standalone terminals, validated point-to-point encryption, or an integrated POS each map to different questionnaires. Your acquirer decides which applies and whether you need a qualified assessor instead. We map your setup and suggest changes that shrink scope.Source: PCI Security Standards Council document library (PCI DSS v4.0.1)
Should we share our PCI Attestation of Compliance?
The PCI Security Standards Council explains how the Attestation of Compliance is intended to be used in its FAQ, and service providers commonly share it with customers as evidence. Merchants typically provide theirs to their acquirer. Check the Council's FAQ and your contracts before sending it widely. We help you prepare an accurate one.Source: PCI SSC FAQ 1568
Does using a payment processor make us PCI compliant?
No. A compliant processor reduces your scope but does not remove your duties. You still validate your own environment, keep terminals and payment pages secure, manage staff access and follow your questionnaire. A "non-compliance fee" on a merchant statement usually means validation is missing. We help you close that gap.Source: PCI Security Standards Council document library (PCI DSS v4.0.1)
What does PCI require for e-commerce payment pages?
Version 4.0.1 includes requirements to manage scripts on payment pages and to detect unauthorized changes, because skimming code is usually injected there. Eligibility for the shortest questionnaires depends on how your checkout is built, so confirm it in the current documents from the PCI Security Standards Council. Our assessment checks your checkout and tells you what applies.Source: PCI Security Standards Council document library (PCI DSS v4.0.1)
Do you certify PCI DSS compliance?
No. We do not certify, and the regulator, examiner or independent auditor for PCI DSS has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with PCI DSS?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do PCI DSS separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.

Also in Financial: FTC Safeguards · SEC Reg S-P · NYDFS 500 · FINRA · every framework by industry

Next step

Thirty minutes, an engineer, a written scope for PCI DSS.

Book the demo and see how one control set carries PCI DSS and everything else you owe. Or leave your details and an engineer replies within one business day.

Get a fixed-fee quote

See how we use your information

3-min test