Relevant to merchants, service providers and other entities that store, process or transmit cardholder data or sensitive authentication data, or can affect the cardholder data environment.
Sector standards / Industry security standard
PCI DSS v4.0.1Protect payment account data
The payment industry's technical and operational baseline for environments that handle payment account data or can affect the security of that environment.
Start with applicability
What it actually covers
A clearly bounded payment-data environment makes controls, provider responsibilities and assessment evidence more defensible.
The payment brands and acquirers set validation and reporting obligations. An outsourced payment flow does not automatically remove all scope. PCI SSC does not recognize informal 'PCI compliance certificates' as validation evidence.
The substance
Key areas to understand
An original operational reading of the official framework or legal text. Check the source for the authoritative wording.
Data flow and scope
Trace how payment account data enters, moves through and leaves the business. Include systems that can affect the security of the cardholder data environment, even when they do not store card data.
Twelve requirement groups
The standard organizes the security baseline around network controls, secure configurations, data protection, malware and vulnerability management, access, monitoring, testing and policy/process oversight.
Third-party responsibilities
Payment processors and other providers may operate part of the control set. The merchant still needs a clear responsibility split and appropriate assurance for the services it uses.
Defined and customized approaches
The standard permits different ways to demonstrate that an objective is met, but alternate approaches need documented analysis, testing and assessor treatment under the official standard.
Validation artifacts
Depending on eligibility and the compliance program, evidence may be documented in a Report on Compliance, a Self-Assessment Questionnaire and an Attestation of Compliance, with applicable scan reports.
From reference to work
A practical starting sequence
These steps organize work; they are not a claim that a short checklist completes the requirement.
Map the payment journey
Inventory channels, checkout scripts, processors, terminals, data stores, network paths and provider handoffs.
Agree the assessment boundary
Document the cardholder data environment, connected systems, segmentation assumptions and the requirements that apply; confirm reporting expectations with the acquirer or payment brand.
Operate and test controls
Assign owners for access, configuration, patching, logging, scanning, incident handling and provider monitoring; retain evidence throughout the year.
Validate in the official form
Use the applicable current PCI SSC ROC or eligible SAQ and AOC, and resolve findings according to the accepting entity's process.
Make it inspectable
Evidence to look for
The right records depend on the entity, scope and chosen assessment route.
- Card-data and system diagrams
Keep current data-flow and network diagrams with documented scope and segmentation rationale.
- Control and provider matrix
Show which party operates and proves each applicable requirement, including third-party services.
- Testing records
Retain access reviews, scan and remediation records, change tests, log reviews and response exercises for the relevant period.
- Official validation package
Keep the applicable ROC or SAQ, AOC and scan reports required by the acquirer or payment brand.
Illustrative situation
What this could look like
An online retailer moves card entry to a hosted checkout. Its scoping review still examines the merchant site, payment-page scripts, redirects and provider handoffs; the acquirer confirms the reporting path and the team documents who operates each remaining control.
Keep the role clear
The payment brands and acquirers set validation and reporting obligations. An outsourced payment flow does not automatically remove all scope. PCI SSC does not recognize informal 'PCI compliance certificates' as validation evidence.
Related, not equivalent
Where ISO/IEC can help
ISO/IEC 27001 and 27002 can support the broader security program, but an ISMS certificate does not replace payment-specific scoping, testing or PCI DSS validation.
Common distinctions
Questions worth asking
Is PCI DSS v4.0 still current?
No. PCI SSC retired v4.0 on 31 December 2024; v4.0.1 is the current published version as of this guide's review.
Does using a payment provider remove a merchant from scope?
No automatic exemption follows. Scope and validation depend on the payment flow, security-impacting systems, provider responsibilities and the accepting entity's rules.
Is a PCI certificate enough to demonstrate compliance?
No. PCI SSC recognizes its official forms and templates, including ROC, SAQ and AOC as applicable, not an informal certificate.
Primary-source trail
Read the official material
Research checked 2026-10-20. Edition, applicability and implementation rules can change. The links below take you to the responsible publisher or authority.