What PCI DSS is and why buyers ask for it
PCI DSS — the Payment Card Industry Data Security Standard — is a set of security requirements developed by the PCI Security Standards Council to protect cardholder data and reduce the risk of fraud and breaches across the payment card industry. Any organisation that stores, processes or transmits payment card data is expected to comply.
For fintechs, payment processors, e-commerce businesses and SaaS platforms that touch card data, PCI DSS is effectively contractual: acquiring banks and payment partners require evidence of compliance before — and throughout — the relationship. Because the standard is recognised globally, a single, well-scoped programme supports your obligations across the markets you operate in, and reassures enterprise customers that the part of your platform handling payments is held to a recognised baseline. ABS helps organisations get PCI DSS-ready and demonstrate compliance, as part of its wider Cyber Security work.
What the assessment covers
The current version is PCI DSS v4.0.1, published in June 2024; since 31 March 2025, all of its requirements, including those first introduced as future-dated, are mandatory. PCI DSS is organised around twelve requirements, grouped under six goals:
- Build and maintain a secure network — network security controls and secure configurations
- Protect cardholder data — protect stored account data and encrypt it in transit across open networks
- Maintain a vulnerability management programme — protect against malware and keep systems and software secure
- Implement strong access control — restrict access on a need-to-know basis, authenticate users, and limit physical access
- Monitor and test networks — log and monitor all access, and test security regularly
- Maintain an information security policy
The right validation route depends on how you handle card data and your transaction volume, and produces a Self-Assessment Questionnaire (SAQ), an Attestation of Compliance (AoC) or a Report on Compliance (RoC) — not a certificate. Where a formal QSA assessment is required, it is conducted independently by an authorised Qualified Security Assessor; ABS provides the readiness, scoping and remediation support to get you there. Scoping is the highest-leverage step: reducing and segmenting the environment that touches cardholder data is usually the single biggest way to lower both risk and cost.
Typical timeline
For an organisation with a reasonably mature environment, readiness plus assessment is typically achievable in 8–12 weeks. Heavily in-scope environments take longer. As with every engagement, you receive a firm timeline with your fixed-price quote, sent within 24 hours of scoping.
Common questions
Which PCI DSS validation level applies to us?
It depends on your role — merchant or service provider — and your annual card transaction volume. Lower volumes typically validate through a Self-Assessment Questionnaire (SAQ); higher volumes require an on-site assessment by a Qualified Security Assessor (QSA). We confirm the correct route during scoping so you are neither under- nor over-assessed.
Can we reduce our PCI DSS scope?
Almost always, yes. Tokenisation, outsourcing card capture to a compliant provider, and network segmentation can dramatically shrink the environment that touches cardholder data — lowering both risk and cost. Identifying these opportunities is a core part of the readiness review.
How does PCI DSS relate to ISO 27001 and SOC 2?
There is meaningful overlap in access control, monitoring and policy. Where SOC 2 covers broad trust criteria, PCI DSS focuses specifically on cardholder data. If you already hold ISO 27001 or run a SOC 2 programme, much of that evidence supports your PCI DSS work — which matters for financial services and fintech especially.
Is PCI DSS a one-time exercise?
No. PCI DSS compliance is ongoing — it must be maintained and re-validated, typically annually, and whenever your environment changes materially. The goal is a payment environment that stays compliant, not a point-in-time pass.
