PCI DSS compliance · GRC software
PCI DSS compliance that holds up after the assessment.
If you store, process or transmit card data, or your systems can affect its security, PCI DSS applies to you. AEGIS maps PCI DSS 4.0.1 onto the same controls as SOC 2 and ISO 27001, collects the evidence your assessor asks for, and keeps it current between assessments.
Every framework on every plan, priced by team size. You choose your auditor.
The basics
What is PCI DSS?
PCI DSS (Payment Card Industry Data Security Standard) is the security standard for any organisation that handles payment card data. It is set by the PCI Security Standards Council, founded by the major card brands, and enforced through your acquiring bank and payment partners rather than by law.
The current version is PCI DSS v4.0.1. Version 3.2.1 was retired in March 2024, and the requirements v4.0 introduced as future-dated became mandatory on 31 March 2025, including new rules for scripts on payment pages and multi-factor authentication for all access to cardholder data.
Requirements
The 12 PCI DSS requirements
Grouped into six goals. How many apply to you depends on how card data flows through your systems, which is why scoping comes first.
- Secure network1. Network security controls. 2. Secure configurations for all system components.
- Protect account data3. Protect stored account data. 4. Encrypt cardholder data over open, public networks.
- Vulnerability management5. Protect systems from malware. 6. Develop and maintain secure systems and software, including payment-page scripts.
- Access control7. Restrict access by business need to know. 8. Identify users and authenticate access, with MFA. 9. Restrict physical access.
- Monitor and test10. Log and monitor all access to system components and cardholder data. 11. Test security regularly: scans, penetration tests and change detection.
- Security policy12. Support information security with organisational policies, risk analysis and programs.
Explained
SAQ or Report on Compliance: how is PCI DSS validated?
Most merchants validate with a Self-Assessment Questionnaire (SAQ) and an Attestation of Compliance. The largest merchants and service providers need a Report on Compliance (ROC) from a Qualified Security Assessor (QSA). Which one you need depends on your transaction volume, your card brands and your acquirer.
The SAQ type depends on how you take payments. A fully outsourced, hosted payment page usually means SAQ A, which since 2025 also asks you to confirm your site is not open to script attacks. If you handle card data on your own servers, expect SAQ D or a ROC. There is no official "PCI certification": what you get is a validated SAQ or ROC and an Attestation of Compliance.
Checklist
PCI DSS checklist
What an auditor or regulator will want to see. AEGIS generates each of these as a control, policy or evidence task, with an owner.
- Scope: map how card data flows and which systems touch it, then shrink the scope.
- Policies: an information security policy set that covers all 12 requirements.
- MFA: multi-factor authentication for all access into the cardholder data environment.
- Payment-page scripts: an inventory of every script on payment pages, with change detection.
- Logging: logs for all access to cardholder data, reviewed regularly.
- Scans: quarterly external scans by an Approved Scanning Vendor and internal scans.
- Penetration testing: internal and external pentests at least once a year and after significant changes.
- Risk analysis: targeted risk analyses for requirements that let you set your own frequency.
With AEGIS
Get PCI DSS ready, then stay ready.
Gets you compliant
From zero to ready
- A short security interview scopes PCI DSS for your company, with a reason for every control.
- Controls, policies, risk register and evidence backlog are generated in an afternoon.
- AI drafts each policy in your real context; a person on your team approves it.
- Evidence collects from your cloud, code, identity and devices.
Keeps you compliant
Current every day after
- Checks keep running and evidence keeps collecting after the audit.
- Access reviews, training and policy sign-offs come round on schedule, with owners.
- A control that drifts shows up before your next audit, and a check that cannot run never counts as a pass.
- PCI DSS shares one control set with every other framework, all included on every plan.
Your auditor, your choice
Pick the auditor that fits your buyers.
A ROC must be completed by a Qualified Security Assessor (QSA) company listed by the PCI Security Standards Council, and QSAs operate in both the US and India. You choose the QSA that fits your acquirer and budget, tier 1, 2 or 3, and AEGIS gives them read-only access to your evidence. If you self-assess, AEGIS keeps the evidence behind every SAQ answer.
Works with Nexus Void
Security work that becomes PCI DSS evidence.
VAPT
Penetration testing
PCI DSS requirement 11.4 asks for internal and external penetration tests at least once a year and after significant changes. Our VAPT covers that pentest, and the report files into AEGIS as evidence. Quarterly external scans must come from a PCI-approved scanning vendor (ASV), which is separate.
Explore VAPTARGUS
Code security
Requirement 6 is about secure software. ARGUS scans your code, dependencies and secrets, flags leaked keys that are still live, and lists the third-party services your code calls, and its findings become risks and evidence in AEGIS.
Explore ARGUSOther frameworks
One control set, every framework included.
FAQ
PCI DSS questions, answered
Answers to the questions teams ask us most. Updated 22 October 2026.
Still have questions? Contact us
Who needs to comply with PCI DSS?
Any organisation that stores, processes or transmits payment card data, or whose systems can affect its security: merchants, payment service providers, and SaaS platforms that touch card data. Your acquiring bank or payment partner is usually the one who asks for proof.
Is there a PCI DSS certification?
Not officially. You validate compliance with a Self-Assessment Questionnaire or a QSA's Report on Compliance, and sign an Attestation of Compliance. People call that PCI certification, and it is what your acquirer or partner will ask to see.
Do we need PCI DSS if we use a payment gateway?
Usually yes, but less of it. A fully hosted payment page or redirect often qualifies for SAQ A, the shortest questionnaire. Since 2025 it also asks you to confirm your site is not open to script attacks that could tamper with the payment page.
What changed in PCI DSS 4.0?
v4.0 added MFA for all access into the cardholder data environment, rules for managing and monitoring scripts on payment pages, targeted risk analyses, stronger password rules and more. Those future-dated requirements became mandatory on 31 March 2025. v4.0.1 is the current version.
How often does PCI DSS require penetration testing?
At least once every 12 months and after any significant change, for both internal and external tests. If you use segmentation to reduce scope, it must be tested too, every six months for service providers. Quarterly external vulnerability scans by an Approved Scanning Vendor are a separate requirement.
Does PCI DSS apply in India?
Yes, through card networks and RBI rules. RBI requires payment aggregators to be PCI DSS compliant and to make sure their merchants are, and card-on-file tokenization rules stop most merchants from storing card numbers at all, which shrinks scope.
How much does PCI DSS compliance cost?
With AEGIS, PCI DSS is included on every plan, priced by team size rather than per framework. A QSA's Report on Compliance and ASV scans are billed by those firms, and our VAPT starts at ₹15,000 for up to 100 APIs.
PCI DSS with AEGIS
Get PCI DSS ready, and keep it that way.
Tell us who is asking for it and we will show you the path, and which auditors fit.