Attestation

PCI DSS

Q: Do you run ASV scans or penetration tests?

No. An Approved Scanning Vendor runs the quarterly external scans and a qualified, organizationally independent tester runs the penetration tests (11.4.2 and 11.4.3). Complyanz schedules these activities and records each result with its evidence.

Q: What changed in SAQ A in January 2025?

Revision 1 of SAQ A took out 6.4.3, 11.6.1 and 12.3.1 and asks an e-commerce merchant to confirm that its website is protected against script attacks, as PCI SSC FAQ 1588 explains.

PCI DSS v4.0.1 is the only active version of the payment card security standard, and its future-dated requirements have been mandatory since 31 March 2025. Complyanz helps you prepare for your Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC): it suggests the SAQ that fits how you take card payments, shows which requirements apply and why, and keeps your cardholder data environment (CDE) scope, testing calendar, compensating controls and targeted risk analyses in one place.

Start preparing Book a demo

What you get

One standard, prepared end to end

280requirements across the twelve principal requirements and Appendices A1, A2 and A3, each described in our own words under its official ID

10Self-Assessment Questionnaires the helper can suggest, from SAQ A to SAQ D for service providers, or a ROC when your level calls for one

17recurring activities on the testing calendar, from quarterly scans to yearly penetration tests, with six-month intervals where service providers need them

4languages: English, Brazilian Portuguese, European Portuguese and Spanish

The questionnaires

Which SAQ fits, and what it covers

Each SAQ covers a fixed set of requirements. Once you confirm yours, Complyanz marks every other requirement as not applicable, with the reason written next to it, and never overwrites a decision you made by hand.

Questionnaire	Who it fits	Requirements
SAQ A	Card-not-present merchants that hand all card handling to a validated provider and keep, at most, paper records	27
SAQ A-EP (unverified list)	E-commerce merchants that outsource processing but whose own website serves or controls part of the payment page	139
SAQ B (unverified list)	Merchants using only imprint machines or standalone dial-out terminals, with no electronic card storage	27
SAQ B-IP	Merchants using only standalone, PTS-approved terminals with an IP connection to their processor, kept apart from other systems	50
SAQ C	Merchants whose Internet-connected payment application runs at a single location, segmented from their other systems	123
SAQ C-VT	Merchants that key payments one at a time into a provider-hosted virtual terminal on an isolated computer	52
SAQ P2PE	Merchants that accept cards only through the terminals of a validated point-to-point encryption solution	19
SAQ SPoC	Merchants taking card-present payments through a validated SPoC solution, a secure card reader paired with a phone or tablet	20
SAQ D for merchants	Any merchant that fits none of the above, for example one that stores card data electronically	Requirements 1 to 12 without the service-provider-only items, plus A2.1.1
SAQ D for service providers	Service providers that their payment brand allows to assess themselves, since every other SAQ is for merchants only	Requirements 1 to 12 with Appendices A1 and A2

SAQ A follows its January 2025 revision, which removed 6.4.3, 11.6.1 and 12.3.1 and added an eligibility check that your website is protected against script attacks (PCI SSC FAQ 1588). The SAQ A-EP and SAQ B lists follow the v4.0 questionnaires because their v4.0.1 editions could not be checked, and Complyanz flags them as unverified. Merchant and service provider levels are set by the payment brands and your acquirer, so confirm with them which validation they expect.

In the platform

Everything your assessment will ask about

SAQ helper and applicabilityAnswer a short set of questions about your payment channels and how you accept cards, and get a suggested SAQ with its reasons and caveats. You confirm the choice, and Complyanz marks each requirement applicable or not, with a written reason, without ever overriding a decision you made yourself.

Requirement catalogAll 280 requirements of v4.0.1, described in our own words, each with its official ID, how often it recurs and whether it applies only to service providers. Keep your licensed copy of the standard at hand for the official wording.

CDE scope registerList the systems, networks, applications, people, processes, paper records and third parties in scope, sort them into CDE, connected-to, security-impacting and out-of-scope, and link them to your asset inventory. Confirm the scope every year, or every six months as a service provider, and keep the history.

Testing calendarTrack rule reviews, access reviews, wireless checks, internal and external vulnerability scans, penetration and segmentation tests and the yearly reviews, each with a due date, an owner and evidence. Record each run and its result; a failed run keeps the activity due until a passing or remediated run is recorded.

Compensating controls and risk analysesWrite each compensating control worksheet against one requirement, with its constraint, objectives, extra risk, validation and upkeep, and a yearly review date. Record targeted risk analyses that set the frequency of flexible requirements, which then drive the calendar, or that support a customized approach in a ROC.

Documents and risks12 document templates, from the information security policy to the incident response plan, and 25 payment-card risk scenarios such as e-skimming, segmentation failure and terminal tampering, in English, Portuguese and Spanish. An unofficial crosswalk to ISO/IEC 27001:2022 shows where your ISO work relates.

Scope

What is in scope, and what is not

Version 4.0.1 onlyVersion 4.0.1, published in June 2024, is the only active version. The 51 requirements that were future-dated became mandatory on 31 March 2025, so the catalog treats every one of them as in force.

Appendix A3 on requestThe supplemental validation for designated entities applies only when a payment brand or acquirer designates you. Turn it on in your profile; its IDs follow the v4.0 numbering and are marked unverified.

Out of scopePCI PIN, PCI 3DS, the P2PE standard itself, the Secure Software and PTS standards, and card-brand level calculations. The SAQ helper covers P2PE and SPoC eligibility only.

Not an assessorComplyanz is not a Qualified Security Assessor (QSA) or an Approved Scanning Vendor (ASV). It does not run scans or penetration tests, and it does not fill in or sign the official SAQ, ROC or AOC forms, which are PCI SSC templates. Complyanz is not affiliated with or endorsed by the PCI Security Standards Council.

Going further

Start with any framework, add the others later

PCI DSS and ISO 27001 overlap on access control, logging, vulnerability management and incident response. Complyanz keeps a crosswalk for each requirement group, graded partial or related, so you can see which ISO controls relate to work you have already done. The mappings are our own reading, not an official correspondence.

Add ISO 27001Much of PCI DSS, from access control to logging and incident response, relates to ISO 27001 Annex A controls, so an information security management system reuses the work. Add SOC 2Service providers are often asked for a SOC 2 report as well. Assets, risks and evidence are shared across both programs in one workspace.

Pricing

Included in Complete, or as an add-on

The PCI DSS module is included in the Complete plan and can be added to any other plan, priced by the number of people in scope like the plans themselves.

See pricing

Questions

PCI DSS FAQ

Which SAQ do we need?

It depends on how you accept cards. The SAQ helper asks about your payment channels, how card data reaches your provider and whether you store it, and suggests a questionnaire with its reasons. If your channels point to different SAQs, it suggests SAQ D and recommends asking your acquirer whether separate questionnaires are accepted. You confirm the choice, and your acquirer has the final say.

Does Complyanz validate our PCI DSS status?

No. Complyanz helps you prepare, but it does not assess, attest or sign anything. You validate with an SAQ that you complete and sign, or with a ROC by a Qualified Security Assessor, or by an Internal Security Assessor where your payment brand allows it; either one comes with an Attestation of Compliance, and your acquirer or payment brand decides what it accepts.

Do you run ASV scans or penetration tests?

No. External scans must be run by an Approved Scanning Vendor every three months (11.3.2), and internal and external penetration tests by a qualified, organizationally independent tester, who may be on your staff or from an outside firm (11.4.2 and 11.4.3). Complyanz schedules these activities, records each result with its evidence, and keeps a failed run due until a passing or remediated run is recorded.

What changed in SAQ A in January 2025?

Revision 1 of SAQ A for v4.0.1 took out 6.4.3, 11.6.1 and 12.3.1. In exchange, an e-commerce merchant now has to confirm that its website is protected against script attacks that could reach its payment process. PCI SSC FAQ 1588 explains that you can show this with protections you run yourself or through a third party, or with written confirmation from your payment provider that its embedded payment form includes them when set up as instructed.

Can we use compensating controls or the customized approach?

A compensating control needs a legitimate, documented constraint, has to meet the intent of the original requirement and go beyond what the other requirements already demand, and is reviewed every year. The customized approach is available only in a ROC and needs a targeted risk analysis for each requirement (12.3.2). The two cannot be combined on the same requirement, and Complyanz refuses that combination.

Is the official requirement text included?

No. PCI SSC licenses the text of the standard. Complyanz describes every requirement in its own words and cites only the requirement IDs and the names of the twelve principal requirements. Keep the standard from the PCI SSC document library at hand for the official wording.

Prepare for your PCI DSS assessment

Create an organization, tell the SAQ helper how you take card payments, and see which requirements apply to you, and why.

Get started free Book a demo