Toolkit
PCI DSS readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any entity that stores, processes or transmits cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment.
Scope
- Covers merchants of every size and channel, payment processors, acquirers, issuers and relevant service providers
- Scope is the single biggest driver of effort — the cardholder data environment plus every connected system component
- Outsourcing payments reduces scope but rarely removes it entirely
Key requirements
- Map every channel and data flow that touches cardholder or sensitive authentication data
- Minimise and scope: remove unneeded card data, use tokenisation or validated point-to-point encryption, segment the network
- Meet the 12 requirements across the 6 goals: secure networks, protect account data, vulnerability management, access control, monitoring and testing, and an information security policy
- Use multi-factor authentication for all access into the cardholder data environment (mandatory since 31 March 2025)
- Manage and authorise scripts on payment pages, and detect unauthorised changes to them
- Run authenticated internal vulnerability scans and quarterly external ASV scans where required
- Validate annually via a Report on Compliance or the correct Self-Assessment Questionnaire, with an Attestation of Compliance
Evidence to gather
- Network and data-flow diagrams
- Annual scope confirmation records
- Configuration standards and key-management procedures
- Vulnerability scan and penetration test reports
- Access reviews and log-review evidence
- Service provider Attestations of Compliance and a responsibility matrix
- Targeted risk analyses supporting any flexible control frequencies
Common gaps
- Calling it 'PCI certified' — the PCI SSC doesn't certify merchants, entities validate compliance
- Assuming tokenisation removes systems from scope entirely — anything that can de-tokenise or affect the CDE stays in scope
- Filing the wrong SAQ type for how payments are actually accepted
- Scope creep through flat networks, shared admin credentials or unmanaged third-party scripts
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full PCI DSS guide, the official text, or a qualified adviser.