PCI DSS Compliance
scope reduction first, controls second.

PCI DSS (Payment Card Industry Data Security Standard) is the security framework required by the card brands (Visa, MasterCard, American Express, Discover, JCB) for any organization that stores, processes, or transmits cardholder data. Required parties include merchants (retailers, restaurants, e-commerce, SaaS billing), service providers (payment processors, gateways, hosting providers handling card data), and any business that touches cardholder data through their systems. Compliance is mandated by the card brand acquiring agreements — not by government regulation. Non-compliance penalties run from monthly fines ($5,000 to $100,000+ per month) up to loss of card-acceptance privileges entirely.

Merchant level is based on annual transaction volume. Level 1: over 6 million transactions per year (any card brand) — requires annual Report on Compliance (ROC) by a Qualified Security Assessor (QSA) and quarterly Approved Scanning Vendor (ASV) scans. Level 2: 1 to 6 million transactions per year — requires annual Self-Assessment Questionnaire (SAQ) and quarterly ASV scans, with some acquirers requiring ROC. Level 3: 20,000 to 1 million e-commerce transactions per year — annual SAQ plus quarterly ASV scans. Level 4: under 20,000 e-commerce or under 1 million total transactions — annual SAQ plus quarterly ASV scans. Service providers have their own level scheme.

SAQ (Self-Assessment Questionnaire) is a self-reported compliance document. There are 9 SAQ types matched to different acceptance scenarios — SAQ A for card-not-present fully outsourced, SAQ A-EP for e-commerce with payment redirect, SAQ B for imprint or standalone dial-out terminals, SAQ B-IP for IP-based terminals, SAQ C for payment applications connected to internet, SAQ C-VT for virtual terminals, SAQ D-Merchant for all others, SAQ D-Service Provider for service providers, and SAQ P2PE for point-to-point encrypted solutions. ROC (Report on Compliance) is an independent assessment performed by a QSA producing a 100+ page detailed report. Level 1 merchants and Level 1 service providers must produce a ROC; other levels typically use SAQs.

PCI DSS 4.0 replaced version 3.2.1 with full enforcement starting March 31, 2025. The 12 core requirements remained but with substantial updates. Key changes include: customized approach (allowing businesses to meet objectives through alternative controls validated by a QSA), expanded MFA requirements (now required for all access into the cardholder data environment, not just remote and administrative), more rigorous authentication requirements (phishing-resistant where feasible), expanded encryption requirements, more detailed third-party service provider monitoring, expanded vulnerability scanning, expanded penetration testing requirements, and new requirements around payment page scripting (combating Magecart attacks). The transition window closed March 31, 2025 — all assessments now reference 4.0.

For SAQs, WCC supports completion but the document is self-attested by the merchant. For Report on Compliance engagements, the assessment must be performed by a Qualified Security Assessor (QSA) firm registered with the PCI Security Standards Council. WCC partners with qualified QSA firms (Coalfire, Schellman, A-LIGN, and others) for ROC engagements. WCC handles the readiness work — scope analysis, SAQ classification, gap assessment, control implementation, policy authorship, ASV scanning coordination, and QSA pre-assessment preparation — then partners on the formal ROC assessment when required.

PCI DSS scope is every system that stores, processes, or transmits cardholder data, plus every system connected to those systems. Without deliberate scope reduction, the in-scope environment can grow to include most of the corporate network — multiplying the cost of compliance dramatically. Scope reduction techniques include network segmentation isolating cardholder data systems, tokenization (replacing card data with non-sensitive tokens), point-to-point encryption (P2PE) that takes systems out of scope entirely, and redirect/iframe payment integration that keeps card data off the merchant's systems. A well-scoped PCI DSS environment can cost 10-20% of an unscoped environment to maintain.

Depends on scope, current maturity, and target level. SAQ A (fully outsourced) can be completed in 4-8 weeks if controls are already in place. SAQ D for a merchant with retail operations and integrated payment systems typically runs 4-6 months including remediation. Level 1 ROC preparation runs 6-12 months from kickoff to ROC issuance, including the QSA on-site assessment period. Service provider ROC engagements are typically the longest given broader scope. The single largest variable is whether scope reduction work is required upfront — when network segmentation or tokenization is part of the project, add 2-4 months to most timelines.

PCI DSS is industry-mandated by the card brands for anyone touching cardholder data — non-negotiable if you accept payment cards. SOC 2 is market-driven by enterprise procurement — required by your enterprise customers, not by regulation. HIPAA is US federal regulation for protected health information. Many WCC customers maintain multiple frameworks simultaneously — for example a healthcare SaaS holding cardholder data needs HIPAA + SOC 2 + PCI DSS together. The control work overlaps substantially (MFA, encryption, logging, vulnerability management, incident response are all common), so one well-designed control program can satisfy multiple frameworks with minimal additional effort.