PCI DSS compliance checklist

A practical checklist for any business that stores, processes or transmits cardholder data, aligned to PCI DSS v4.0.

The checklist

1. Determine your level — your merchant or service-provider level, and the right Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC).
2. Scope your cardholder data environment (CDE) — and reduce it wherever you can.
3. Install and maintain network security controls — and remove vendor-supplied defaults.
4. Protect stored account data — minimise storage and render the PAN unreadable (encryption, truncation, tokenisation).
5. Encrypt cardholder data in transit with strong cryptography.
6. Run vulnerability management — anti-malware, patching, and secure software development.
7. Enforce strong access control — least privilege, unique IDs, MFA, and physical access controls.
8. Log, monitor and test — track all access, and run ASV scans and penetration tests.
9. Maintain a security policy and complete your annual SAQ or ROC with an Attestation of Compliance (AOC).

A practical starting checklist, not a QSA assessment. Your validation requirements depend on your level and your acquirer.