PCI DSS: what it is, who it applies to and when a firm needs a penetration test

PCI DSS applies to anyone who stores, processes or transmits card data, or who can affect its protection, regardless of size. It is not a law. Who has to demonstrate compliance and how is decided by the payment brands and banks, not by PCI SSC. The standard does not ask everyone for a penetration test: it depends on which questionnaire (SAQ) your bank assigns you. For a web shop that merely redirects payment to a certified gateway, the SAQ A questionnaire has no penetration test. A firm that accepts card data on its own website does, under SAQ D, an internal and an external test at least once every 12 months.

What PCI DSS is and who enforces it

PCI DSS is a set of technical and operational requirements for protecting payment data, issued by the PCI Security Standards Council (PCI SSC). According to PCI SSC the standard applies to merchants, firms that process payments, banks, card issuers and service providers. It applies globally: PCI SSC writes that compliance is expected of anyone who stores, processes or transmits card data, regardless of country.

Someone else enforces it. On its site PCI SSC answers the question of whether it enforces compliance with a no: who has to demonstrate compliance is decided by the individual payment brands and their own programs. PCI SSC imposes no consequences for non-compliance. The payment brands may, however, have their own programs, including financial or operational consequences for firms that fail the standard. Which ones and when, your bank, which handles your card payments, will tell you. We found no amounts or fines in the official sources, so we do not state any here.

This applies to small merchants too. PCI SSC writes that the standard is meant for everyone, although small firms often have simpler environments. Whether they have to demonstrate compliance is again decided by the payment brands, and PCI SSC advises asking the bank or the brand.

Which questionnaire you have and what it says about the penetration test

A merchant who demonstrates compliance on its own fills in a self-assessment questionnaire (SAQ) with an attestation of compliance (AOC). The finished questionnaire goes to whoever asks for it, that is, the bank or the payment brand. Which questionnaire you may use is set by the criteria in it and by your business partner. The table is based on the version 4.0 questionnaires from April 2022.

Two additions. First, SAQ A changed from 31 March 2025: PCI SSC removed requirements 6.4.3, 11.6.1 and 12.3.1 on protecting the payment page and added a criterion that the firm confirms its website is not exposed to script attacks. We did not open the new version (SAQ A r1), because the PDF in the PCI SSC library returns a 403 error. Second, the ASV scan stays even with fully outsourced payment: PCI SSC confirms this in an answer from June 2026 for websites that redirect the customer to the provider or embed the provider's iframe.

What requirement 11.4 says about the penetration test

Whoever does a penetration test must, under the SAQ D and A-EP questionnaires, have a documented procedure that includes, among other things:

• recognised methods,
• the whole card environment perimeter and critical systems,
• a test from inside and from outside the network,
• a check that the card environment is really separated from the rest of the network, and of other steps that reduce the scope,
• a test of both the application layer and the network layer,
• threats and holes the firm has experienced in the last 12 months,
• retention of results and fixes for at least 12 months.

The test must be done by a qualified internal employee or an external firm, and the tester must be organisationally independent. A QSA or ASV certificate is not required. Weaknesses found are fixed according to a risk estimate and the penetration test is then repeated to confirm the fixes (11.4.4). What a retest looks like and what the cybersecurity act says about it is described in the article on the retest. What to focus on when writing the brief is shown in the article on web and internal network tests and the article on black, grey and white box: the PCI SSC guide writes that tests for PCI DSS are usually done as white or grey box.

The twelve requirements in a nutshell

The SAQ D questionnaire is divided into six goals and 12 requirements:

1. Network protection (1) and securely configured systems (2).
2. Protection of stored card data (3) and strong ciphers when it travels over public networks (4).
3. Protection against malicious code (5) and secure development and maintenance of systems (6).
4. Access only for those who need it (7), a clear identity for users (8) and physical access (9).
5. Records of access (10) and regular tests (11), which include the scan and the penetration test.
6. Rules and procedures in the firm (12).

What a firm of twenty people does

1. Ask your bank or payment brand which questionnaire you have to fill in and whom to hand it to. PCI SSC explicitly leaves that to them.
2. Check what your payment looks like. A redirect to a gateway, an embedded iframe, or your own form on the website? That decides between SAQ A, A-EP and D.
3. If a third party handles the payment, ask for its AOC. The SAQ A criteria want you to read it and make sure the provider meets the standard.
4. For SAQ A-EP and D, schedule a penetration test at least once every 12 months and after a significant change to the website or network. Preparation is described in the article on preparation.
5. Keep the results of the test and the fixes for at least 12 months.

Mistakes that keep repeating

• The gateway is taken as settled. Even with SAQ A the ASV scan remains and the firm is responsible for its own requirements, PCI SSC writes.
• The wrong questionnaire is filled in. The SAQ A criteria want all elements of the payment page to come directly from a certified provider.
• The test is done by whoever runs the website. The tester must be organisationally independent.
• A one-off test. The requirement is for 12 months and for every significant change.

Sources

• PCI SSC, PCI Data Security Standard, viewed 25 October 2026: https://www.pcisecuritystandards.org/standards/pci-dss/
• PCI SSC, FAQ 1004, 1015, 1022, 1024, 1328 and 1588, 1604 (June 2026): https://www.pcisecuritystandards.org/faqs/1004, https://www.pcisecuritystandards.org/faqs/1015, https://www.pcisecuritystandards.org/faqs/1022, https://www.pcisecuritystandards.org/faqs/1024, https://www.pcisecuritystandards.org/faqs/1328, https://www.pcisecuritystandards.org/faqs/1588, https://www.pcisecuritystandards.org/faqs/1604
• PCI SSC, Just Published: PCI DSS v4.0.1, 11 June 2024: https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1
• PCI SSC, Important Updates Announced for Merchants Validating to SAQ A, 30 January 2025: https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a
• PCI SSC, Request for Comments: PCI DSS v4.0.1, 3 June 2026: https://blog.pcisecuritystandards.org/request-for-comments-pci-data-security-standard-pci-dss-v4.0.1
• PCI SSC, PCI DSS v3.2.1 is Retiring on 31 March 2024, 31 January 2024: https://blog.pcisecuritystandards.org/pci-dss-v3-2-1-is-retiring-on-31-march-2024-are-you-ready
• PCI DSS v4.0, SAQ A, SAQ A-EP and SAQ D for Merchants, April 2022: https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-A.pdf, https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-A-EP.pdf, https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Merchant.pdf
• PCI SSC, Information Supplement: Penetration Testing Guidance, version 1.1, September 2017: https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf