PCI DSS frequently asked questions
Understand payment security scope, validation and evidence.
Who is PCI DSS relevant to?
Consider environments that store, process or transmit payment card data and systems or services that can affect its security. Scope depends on actual connections and responsibilities.
What should CDE scoping consider?
Card-data flows, relevant systems, connectivity, third parties and the effectiveness of segmentation inform the assessment scope.
What is an SAQ?
A Self-Assessment Questionnaire is a validation tool for eligible organisations. All eligibility criteria must be met, and the approach should be confirmed with the entity accepting the assessment.
Can a service provider use a merchant SAQ?
No. PCI SSC identifies SAQ D for Service Providers as the only SAQ for eligible service providers. Other SAQs are intended for merchants.
What are ROC and AOC?
The ROC records assessment findings against requirements. The AOC attests to the assessment and its scope. Documentation must suit the entity type and the accepting party’s requirements.
What evidence should be prepared?
Prepare scope and data flows, asset inventories and owners, policies and procedures, configuration and operational records, test results and provider information, mapped to applicable requirements.
Which requirement dates matter?
Some PCI DSS v4.x requirements changed status on 31 March 2025. Check the current standard, reporting template and Council guidance when planning an assessment.
How do we begin with ALPHASEC?
Share your business model, payment flows, systems, providers, previous assessment status and timeline using the PCI DSS questionnaire to discuss the appropriate scope.
Further guidance: PCI SSC SAQ FAQ · Service provider eligibility · Requirement dates