The mandatory security standard for handling card data. PCI DSS applies to every organisation that stores, processes, or transmits payment card information — and non-compliance carries real financial and operational consequences.
The Payment Card Industry Data Security Standard, now at version 4.0, sets twelve core requirements covering network security, data protection, vulnerability management, access control, monitoring, and security policy.
How you validate depends on how much card data you handle: smaller merchants complete a Self-Assessment Questionnaire, while larger volumes require a Qualified Security Assessor and a formal Report on Compliance.
It is maintained by the PCI Security Standards Council, and non-compliance can mean heavy fines, raised transaction fees, or loss of card-processing privileges altogether.
Anyone accepting card payments online or in person.
Businesses that process or route cardholder data as part of their service.
Vendors whose systems transmit or store payment information.
Delivered through our specialist network. We determine your merchant level and the right validation path, close the gaps against all twelve requirements, and prepare the SAQ or coordinate the QSA assessment — so you validate cleanly rather than scrambling at renewal.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
PCI DSS applies to any organisation that stores, processes or transmits payment card data, wherever it is based. The card brands and your acquiring bank decide how you must validate, which is why a US SaaS platform and a UK retailer can face very different obligations under the same standard.
Merchant or service provider? Merchants accept card payments for their own goods and services. Service providers handle card data on behalf of others, such as payment gateways, hosting providers and platforms. Service providers generally face stricter validation and are often asked by customers for an Attestation of Compliance.
Reducing scope is the biggest lever. The less card data touches your systems, the smaller your PCI scope and cost. Using a compliant payment processor with hosted fields or redirects, and segmenting the systems that remain in scope, often removes most of the burden. Scoping correctly at the start is where we spend the first effort.
SAQ or full assessment. Smaller merchants usually complete a Self-Assessment Questionnaire, while larger volumes and most service providers need a Qualified Security Assessor and a Report on Compliance. Your acquirer or card brand tells you which applies. See our penetration testing service, as PCI DSS requires regular testing.
Remote-first delivery. ISONEX works remotely with clients across the GCC, UK, EU and US. We handle scoping, gap assessment and remediation, and prepare you for your SAQ or QSA assessment. Book a free advisory session.
It depends on your transaction volume. Lower volumes validate through a Self-Assessment Questionnaire; higher volumes require an on-site assessment by a Qualified Security Assessor. We confirm your level and the correct path before any work starts.
Often, yes — by tokenising card data or routing it through a compliant payment processor, you can take large parts of your environment out of scope entirely. Scope reduction is usually the highest-value first move, and we plan for it early.
Yes. It is a global standard set by the card brands and applies wherever card data is stored, processed or transmitted. Your acquiring bank or payment provider will tell you how you must validate compliance.
It depends on your volume and role. Smaller merchants often complete a Self-Assessment Questionnaire, while larger merchants and most service providers need a Qualified Security Assessor and a Report on Compliance. Your acquirer or card brand sets the requirement.
Keep card data off your own systems by using a compliant payment processor with hosted payment fields or redirects, and segment any systems that must stay in scope. Correct scoping up front usually saves significant cost and effort.
Yes. ISONEX is a remote-first consultancy and we deliver PCI DSS programmes for clients in the US, the UK, Europe and the GCC. Everything is done online, scheduled around your working hours.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session