Compliance frameworks
What is PCI compliance? A PCI DSS compliance overview

What is PCI compliance? A PCI DSS compliance overview

What is PCI compliance? A PCI DSS compliance overview

Every time a new data breach hits the news, business leaders feel a fresh sensation of stress in the pits of their stomachs: the fear that they could be next. Data breaches can destroy a company’s reputation and ultimately its future. How can you protect your customers’ payment data and protect your business from a breach?

One way to know if you’re secure is by maintaining PCI compliance. Let’s break down the details of what PCI compliance is, an overview of PCI DSS compliance, and how you can use it as an asset for your business.‍

What is PCI compliance?

You’ve probably heard the term “PCI compliance,” but the full name is PCI DSS compliance. PCI DSS compliance stands for payment card industry data security standard compliance. That name makes it much clearer: PCI compliance involves adhering to a specific set of standards and practices that are meant to protect payment data.

PCI DSS includes 12 specific requirements that a company needs to meet to be PCI compliant. These PCI DSS standards are developed and maintained by the PCI Security Standards Council. This independent council was formed by the major credit card companies such as:

  • Mastercard
  • Visa
  • American Express

PCI DSS was created by these companies in an effort to better secure consumers’ payment data.

It’s important to note that PCI compliance is not a legal requirement. It’s more of a requirement throughout the payments industry. If you process payments or accept credit card payments in any way, PCI compliance is a way to ensure that major credit card companies and banks will continue working with you. PCI compliance also proves that you are maintaining trust with partners throughout the payment industry.

Who needs to be PCI compliant?

PCI compliance is considered to be a necessity within the business world for anyone who processes, stores, or transmits payment information. As we noted, PCI compliance isn't a legal requirement, so you won’t face direct legal or criminal consequences for skipping PCI compliance.

However, without PCI compliance, you may end up with fewer payment options. Without PCI DSS compliance you may even end up with fines of thousands of dollars per month from payment brands like Visa and Mastercard.

PCI compliance requirements

The PCI compliance requirements are designed to make your organization more secure, but before you dive in it’s helpful to get an understanding of the essentials.

What are the PCI compliance requirements?

The PCI DSS compliance requirements in their entirety are very detailed and complex, of course. At the core, there are 12 PCI DSS requirements, each with its own supporting details. Briefly, those requirements for PCI compliance include:

  • Protecting cardholder data with a firewall
  • Changing default passwords
  • Protecting any stored cardholder data
  • Encrypting cardholder data while it’s transmitted
  • Maintain anti-virus software
  • Keep applications and systems secure
  • Grant the minimum required access to cardholder data
  • Set up unique IDs for each person with computer access
  • Limit physical access to cardholder data
  • Monitor access to cardholder data
  • Test security systems routinely
  • Establish security policies for personnel

These 12 requirements give you a broad view of what PCI compliance covers.

Benefits of PCI DSS compliance

The idea of hefty fines from major banks could be enough of a reason to put PCI DSS compliance on your priority list. But you don’t just want to adhere to PCI DSS to avoid penalties. There are strong benefits of PCI compliance too.

Selling to the enterprise

One of the biggest motivations for PCI compliance is the ability to sell to large enterprise companies that require their vendors to be PCI DSS compliant. “Are you PCI compliant?” is one of the first questions that an enterprise asks before moving forward with a financial partnership. You’ll want to make sure you can confidently answer yes when asked if you’re PCI DSS compliant and make your partners confident.

Some organizations will require PCI compliance to even sign a contract or consider a vendor during the RFP process. Companies use PCI compliance to prove trust during the sales process and as a way of establishing security assurance throughout the partnership.

PCI compliance open options for payment processing

In any type of business, the easier you make your payment process, the more likely consumers will follow through with a purchase. One way to make your payment process easier is to give customers plenty of payment options and PCI DSS compliance is one of the most effective ways to offer more payment options. Being PCI compliant allows you to work with more payment brands so you can offer your customers all of their favorite payment options.

PCI compliance offers enhanced consumer trust

Data breaches are all over the news, and many of your customers have probably dealt with the hassle of a data breach personally. They know the frustration of:

  • Canceling credit cards
  • Disputing purchases
  • Potentially sending evidence for disputed purchases
  • Waiting for new credit cards
  • Changing their payment information on online platforms

If you’re PCI compliant, you can ensure customers that you are adhering to the most respected standards to protect their data. PCI compliance builds more trust and may lead to more loyal customers.

PCI DSS compliance lowers risk for data breaches

PCI DSS exists for a reason: it’s protecting your customers’ payment data. If you fall victim to a data breach, it damages your company’s reputation and hurts your profits because you may be financially liable for any damages. If you adhere to the standards of PCI DSS, you’ll know that you have secured the safety of your consumers and your own business as much as you can.

PCI DSS compliance levels

PCI compliance isn’t just a “yes or no” situation. There are multiple levels of compliance you can accomplish. PCI DSS separates merchants into four levels based on the number of credit card transactions they process annually:

  • Level 1: over six million transactions per year
  • Level 2: one million to six million transactions per year
  • Level 3: 20,000 to one million transactions per year
  • Level 4: under 20,000 transactions per year

The most notable difference in PCI compliance is that level 1 merchants must have an audit performed by a third-party auditor, along with additional paperwork. Merchants in levels 2-4 fill out a self-assessment questionnaire instead of having an external audit.

There are advantages to higher-level PCI compliance, like a stronger show of trust and security, but if you are a level 2-4 merchant, your “bare minimum” for PCI compliance is much lower.

Learn more about PCI DSS

Guide to PCI compliance costs

PCI compliance in 3 steps

Automate your PCI DSS compliance

Written by
No items found.
Access Review Stage Content / Functionality
Across all stages
  • Easily create and save a new access review at a point in time
  • View detailed audit evidence of historical access reviews
Setup access review procedures
  • Define a global access review procedure that stakeholders can follow, ensuring consistency and mitigation of human error in reviews
  • Set your access review frequency (monthly, quarterly, etc.) and working period/deadlines
Consolidate account access data from systems
  • Integrate systems using dozens of pre-built integrations, or “connectors”. System account and HRIS data is pulled into Vanta.
  • Upcoming integrations include Zoom and Intercom (account access), and Personio (HRIS)
  • Upload access files from non-integrated systems
  • View and select systems in-scope for the review
Review, approve, and deny user access
  • Select the appropriate systems reviewer and due date
  • Get automatic notifications and reminders to systems reviewer of deadlines
  • Automatic flagging of “risky” employee accounts that have been terminated or switched departments
  • Intuitive interface to see all accounts with access, account accept/deny buttons, and notes section
  • Track progress of individual systems access reviews and see accounts that need to be removed or have access modified
  • Bulk sort, filter, and alter accounts based on account roles and employee title
Assign remediation tasks to system owners
  • Built-in remediation workflow for reviewers to request access changes and for admin to view and manage requests
  • Optional task tracker integration to create tickets for any access changes and provide visibility to the status of tickets and remediation
Verify changes to access
  • Focused view of accounts flagged for access changes for easy tracking and management
  • Automated evidence of remediation completion displayed for integrated systems
  • Manual evidence of remediation can be uploaded for non-integrated systems
Report and re-evaluate results
  • Auditor can log into Vanta to see history of all completed access reviews
  • Internals can see status of reviews in progress and also historical review detail

The ultimate guide to scaling your compliance program

Learn how to scale, manage, and optimize alongside your business goals.

PCI Compliance Selection Guide

Determine Your PCI Compliance Level

If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.

When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.

Answer a few short questions and we’ll help identify your compliance level.


Does your business offer services to customers who are interested in your level of PCI compliance?


Identify your PCI SAQ or ROC level

The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.

Good news! Vanta supports all of the following compliance levels:


A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.

Get PCI DSS certified


A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.

Learn more about eCommerce PCI

for service providers

A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.

Use our PCI checklist

Level 1 for service providers

A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).

Automate your ROC and AOC

Download this checklist for easy reference


Learn more about how Vanta can help. You can also find information on PCI compliance levels at the PCI Security Standards Council website or by contacting your payment processing partner.

The compliance news you need. Delivered securely to your inbox.

Subject to Vanta's Privacy Policy, you agree to allow Vanta to contact you via the email provided for marketing and other purposes