PCI DSS Readiness Check

Do you know which PCI Self-Assessment Questionnaire (SAQ) type fits how your business accepts cards, or have you confirmed it with your processor?

The SAQ you must complete depends on how you accept cards; using the wrong one leaves real gaps unaddressed. PCI DSS Requirement 12.5.1.

Do you avoid storing full card numbers in email, spreadsheets, paper files, or your point-of-sale system unless there is a clear business need?

Card data kept without a documented business need is exposed card data. Keep it only where required and protect it. PCI DSS Requirement 3.2.1.

Do you and your staff never write down, save, or store the 3- or 4-digit security code (CVV) after a transaction is approved?

Storing the security code after authorization is never allowed under any circumstance, even encrypted. PCI DSS Requirement 3.3.1.2.

When card numbers appear on receipts, screens, or reports, are they masked so staff never see more than the first six and last four digits?

Full card numbers should rarely be visible to employees; masking limits exposure if a device or report is lost. PCI DSS Requirement 3.4.1.

Do you keep a current list or diagram of every system, app, and device that stores, processes, or transmits card data?

You cannot secure what you have not identified; this scope inventory is the starting point for every other control. PCI DSS Requirement 12.5.1.

Are the firewalls, routers, or cloud network settings protecting your payment systems configured to a written standard and reviewed periodically?

Undocumented, ad-hoc network settings are hard to verify and easy to misconfigure without anyone noticing. PCI DSS Requirement 1.2.1.

Have you changed or disabled every default password on your POS systems, routers, Wi-Fi access points, and payment software?

Default vendor passwords are publicly known and are one of the most common ways attackers gain access. PCI DSS Requirement 2.2.2.

Are the computers and networks that process card payments kept separate from general office Wi-Fi, guest Wi-Fi, and other business systems?

Without separation, a breach anywhere on the network can reach payment systems. Not applicable if you use one intentionally flat network. PCI DSS Requirement 1.3.1.

Are critical security patches for your POS software, servers, and payment applications installed within about one month of release?

Attackers look for known, unpatched vulnerabilities; critical security patches must be installed within one month of release. PCI DSS Requirement 6.3.3.

Does every employee who touches payment systems log in with their own unique username, never a shared or generic login?

Shared logins make it impossible to trace who did what if something goes wrong. PCI DSS Requirement 8.2.1.

Is each employee's access to payment systems and card data limited to only what their specific job requires?

Broad, unnecessary access increases the damage a mistake, stolen password, or insider can cause. PCI DSS Requirement 7.2.1.

Is multi-factor authentication required for any remote or administrative access into systems that store or process card data?

A password alone is not enough; MFA has been mandatory for all such access since March 2025. PCI DSS Requirement 8.4.2.

Are passwords for payment systems at least 12 characters long and unique to each individual user?

Short or shared passwords are easily guessed or cracked; 12 characters is the current minimum standard. PCI DSS Requirement 8.3.6.

Is anti-malware software installed, actively running, and automatically updated on computers and servers that touch card data?

Malware is a common route to stolen card data; anti-malware tools must stay active and current to catch it. PCI DSS Requirements 5.2.1 and 5.3.

Does your email system automatically detect and block phishing emails before they reach your staff?

Automated mechanisms to detect and protect personnel against phishing have been required since 31 March 2025. PCI DSS Requirement 5.4.1.

If any payment system is internet-facing, do you get quarterly external vulnerability scans from a PCI-approved scanning vendor? (N/A if none are internet-facing.)

A passing quarterly scan by an Approved Scanning Vendor is required whenever a system touching card data is reachable from the internet. PCI DSS Requirement 11.3.2.

If your SAQ requires it, has a tester run an external penetration test on your payment environment in the past year? (N/A if not required.)

Penetration testing finds exploitable weaknesses that scans alone can miss; required for higher-risk merchant environments. PCI DSS Requirement 11.4.3.

If customers enter card numbers on your website, do you monitor the payment page's scripts for tampering? (N/A if you take no online payments.)

Malicious scripts injected into checkout pages can silently steal card data as customers type it; required for e-commerce since March 2025. PCI DSS Requirements 6.4.3 and 11.6.1.

Do you keep an up-to-date list of every card-swipe terminal and PIN pad, including location and serial number? (N/A if online-only.)

An accurate device inventory makes it possible to notice if a terminal has been swapped for a tampered one. PCI DSS Requirement 9.5.1.1.

Are card terminals and PIN pads regularly inspected for tampering, unfamiliar attachments, or signs of substitution? (N/A if online-only.)

Skimming devices are often added to legitimate-looking terminals; regular physical inspection catches them before large losses occur. PCI DSS Requirement 9.5.1.

Do you have a written information security policy that staff have read and acknowledged?

A documented policy sets expectations and gives staff something concrete to follow and be held to. PCI DSS Requirement 12.1.1.

Do employees receive security awareness training, including phishing and social engineering, at hire and at least once a year?

Untrained staff are the easiest target for attackers; annual refreshers keep awareness current as tactics change. PCI DSS Requirement 12.6.3.1.

Do you keep a list of every vendor that can access card data, with a signed agreement covering their security responsibilities?

Payment processors, POS vendors, and IT providers all extend your risk; agreements clarify who is responsible for what. PCI DSS Requirement 12.8.1.

Do you have a written plan for who to call and what to do first if you suspect a card data breach?

Confusion in the first hours of a breach increases cost and exposure; a plan speeds containment and required notifications. PCI DSS Requirement 12.10.1.