Knowledge hub

PCI DSS

Payment Card Industry Data Security Standard. The security standard for any business that handles card payments. Requirements, levels, v4.0, and how to comply.

All 12 requirements

Sub-requirements, how to meet them, examples

PCI DSS templates

Data-flow, scope, SAQ guide, and more

Control-to-policy map

Match PCI controls to access, data, supplier, incident, and crypto policies

PCI DSS starter pack

Shrink card-data scope before you collect evidence.

Use this path when you need to identify payment flows, choose the right SAQ, and prove cardholder-data controls.

Open Markdown pack ->

Start

Readiness check

Route PCI against SOC 2, ISO 27001, and ISO 42001 priorities.

Docs

PCI DSS templates

Cardholder data flow, scope, SAQ guide, TPSP matrix, incident plan.

Policies

IT policy templates

Access, data handling, supplier, incident, endpoint, and cryptography policies.

Map

Control-to-policy map

Connect PCI requirements to operational policies and evidence records.

Controls

All 12 requirements

Requirement and sub-requirement pages with practical evidence guidance.

Tools

PCI DSS software

Tools for scoping, evidence, vendor assurance, and continuous monitoring.

Decision

Compare frameworks

See where PCI DSS stands apart from trust reports and certifications.

Guides

7 min read

What Is PCI DSS? A Plain-English Guide

PCI DSS is the security standard for any business that handles card payments. Here is what it covers, who must comply, and what happens if you do not.

6 min read

PCI DSS Compliance Levels and Validation

Your PCI DSS obligations depend on how many card transactions you process. Here are the four merchant levels and how each one validates.

6 min read

PCI DSS 4.0: What Changed and the Deadlines

PCI DSS v4.0 is now the active version. Here is what changed from v3.2.1, the customised approach, and the dates that mattered.

6 min read

PCI DSS Compliance Checklist

A practical, ordered checklist to get from zero to PCI DSS compliant, whether you self-assess or need a full audit.

6 min read

PCI DSS SAQ Types: Which Self-Assessment Questionnaire Applies?

The PCI DSS Self-Assessment Questionnaire you complete depends on how your business handles card data. Here is what each SAQ type covers.

7 min read

PCI DSS Scope Reduction: Shrink the Problem Before You Solve It

The cheapest PCI DSS requirement is the one that no longer applies to you. Here is how segmentation, tokenisation, and outsourcing shrink your cardholder data environment and downgrade your SAQ.