PCI DSS Templates

Copy-paste starting points for scoping and documenting PCI DSS. Adapt to your environment and confirm specifics with your acquiring bank or QSA.

Markdown pack

Take the full template set with you.

Open one plain Markdown file with all policy, scope, risk, PCI and evidence templates. It is crawler-friendly, copy-friendly and fast.

Open pack Download .md

Cardholder data flow and inventory

Find and document every place card data lives or moves. Shrinking this shrinks scope.

Open in full .md pack

For each flow: Source -> Transport -> Process -> Store?
Columns: Flow ID | Channel (web/phone/POS) | Data elements (PAN, expiry, CVV) | Systems touched | Encrypted? | Stored? (where/how long) | Owner

Example:
F-01 | E-commerce checkout | PAN, expiry | Browser -> Stripe.js -> Gateway | TLS 1.3 | No (tokenised) | Payments lead
F-02 | Phone orders | PAN read aloud | Agent -> virtual terminal | TLS | No | Support lead

PCI DSS scope definition

Document and validate scope at least annually (req 12.5).

Open in full .md pack

1. Cardholder data environment (CDE): [systems that store/process/transmit CHD]
2. Connected-to / security-impacting systems: [e.g. jump hosts, logging, IdP]
3. Out of scope (and why): [segmented systems with no CHD access]
4. Network segmentation in place: [yes/no, how verified]
5. Third-party service providers in scope: [list + what they handle]
6. Merchant level: [1-4]   SAQ type or ROC: [type]
Reviewed by: [name]   Date: [date]   Next review: [date]

SAQ selection quick-guide

Pick the right Self-Assessment Questionnaire for how you take payments.

Open in full .md pack

SAQ A      Card-not-present, payment fully outsourced to a compliant third party (e.g. hosted/redirect or iframe). Smallest scope.
SAQ A-EP   E-commerce, payment processing outsourced but your site can affect the payment (e.g. JavaScript on your page).
SAQ B      Imprint machines or standalone dial-out terminals. No electronic storage.
SAQ B-IP   Standalone, IP-connected payment terminals. No electronic storage.
SAQ C-VT   Web-based virtual terminal, one device, no storage.
SAQ C      Payment application connected to the internet, no storage.
SAQ P2PE   Hardware payment terminals in a validated P2PE solution. No storage.
SAQ D      Everything else, including all service providers. Largest scope.

Confirm your eligibility and level with your acquiring bank.

TPSP responsibility matrix

Split each requirement between you and each provider (req 12.8/12.9).

Open in full .md pack

Columns: PCI requirement | Your responsibility | TPSP responsibility | Evidence held

Example:
Req 3 (stored data) | We store no CHD | Stripe stores/tokenises CHD | Stripe AOC on file
Req 9 (physical) | Office + endpoints | AWS data-centre physical security | AWS AOC / shared responsibility
Req 11 (testing) | App pen test, internal scans | Provider infrastructure testing | Pen test report; provider AOC

PCI incident response plan (outline)

Required by req 12.10; must cover suspected card-data compromise.

Open in full .md pack

1. Roles and 24/7 contacts
2. Severity and what counts as a suspected card-data compromise
3. Immediate actions: contain, preserve evidence, do not wipe
4. Who to notify and when: acquiring bank, card brands, forensic (PFI) if required, regulators
5. Containment and recovery steps
6. Communication templates
7. Post-incident review and control updates
8. Test at least annually