What Is PCI Certification? Levels, Requirements, and v4.0.1 Deadline

PCI certification is the shorthand businesses use for proving they comply with the Payment Card Industry Data Security Standard (PCI DSS), the security rulebook every organization that stores, processes, or transmits credit card data has to follow. The standard is maintained by the PCI Security Standards Council, founded in 2006 by American Express, Discover, JCB International, Mastercard, and Visa.1PCI Security Standards Council. About Us The current version is PCI DSS v4.0.1, and it applies to every merchant and service provider handling cardholder data, regardless of size.

One thing to clear up first: the Council doesn’t hand out a certificate. What people call PCI certification is really compliance validation — assessments, scans, and paperwork that show you meet the standard. No business is ever permanently certified. You revalidate every year, and you’re expected to stay compliant in between. If your controls slip six months after a clean assessment, you’re non-compliant, even if nothing on paper has expired yet. In everyday use, though, “PCI certified” and “PCI compliant” mean the same thing, and when a processor asks whether you’re certified, they want to see the validation documents described below.

Who Has to Comply

Anyone who accepts, transmits, or stores credit card information. That covers merchants of every kind — retailers, e-commerce shops, restaurants, subscription businesses — and service providers such as payment gateways, hosting companies, and data centers that touch cardholder data on a merchant’s behalf.

A frequent misconception: outsourcing your payment processing does not eliminate your PCI obligations. The Council is explicit that the merchant keeps ultimate responsibility for compliance no matter how tasks are split with a provider.2PCI Security Standards Council. Information Supplement – Third-Party Security Assurance Outsourcing can shrink what you have to validate and simplify the work, but you still need to confirm the provider is compliant and document who covers what. A written responsibility matrix listing provider-owned, merchant-owned, and shared controls is the standard tool.

Your Compliance Level Determines What You Do

Card brands sort merchants into four levels based on annual transaction volume. The thresholds below reflect Visa’s widely adopted framework; other brands use similar cutoffs.

  • Level 1: More than 6 million transactions per year across all channels, or any merchant that has suffered a data breach. Requires an annual on-site assessment by a Qualified Security Assessor (QSA) and quarterly network scans.3Mastercard. Revised PCI DSS Compliance Requirements for L2 Merchants
  • Level 2: Between 1 million and 6 million transactions per year. Annual Self-Assessment Questionnaire (SAQ) and quarterly scans. Some brands require the SAQ be completed with a QSA or an Internal Security Assessor.3Mastercard. Revised PCI DSS Compliance Requirements for L2 Merchants
  • Level 3: Between 20,000 and 1 million e-commerce transactions per year. Annual SAQ and quarterly scans.
  • Level 4: Fewer than 20,000 e-commerce transactions, or up to 1 million total transactions per year. This is where most small businesses sit. Annual SAQ and quarterly scans, with specifics set by your acquirer.

Service providers use a shorter two-tier structure. Level 1 covers providers handling more than 300,000 transactions annually and requires an annual Report on Compliance (ROC) by a QSA plus quarterly scans. Level 2 covers everyone below that threshold and calls for an annual SAQ and quarterly scans. The service provider bar is set much lower than the merchant bar because one compromised gateway can expose data from thousands of merchants at once.

Your acquiring bank — the institution that processes your card transactions — assigns your level and tells you which documents to submit. If you don’t know where you fall, start there.

What the Standard Requires You to Do

PCI DSS is organized into 12 requirements grouped under six goals. The requirements cover the minimum architecture of a secure payment environment rather than a set of one-off tasks. The 12, in brief:

  1. Install and maintain network security controls, including firewalls that separate the cardholder data environment from untrusted networks.
  2. Apply secure configurations to all systems. Change default passwords and factory settings on routers, servers, and terminals before deployment.
  3. Protect stored account data. If you must store it, encrypt, truncate, or hash it so it’s unreadable.
  4. Encrypt cardholder data whenever it crosses open or public networks.
  5. Protect systems from malicious software with anti-malware tools kept up to date.
  6. Develop and maintain secure systems and software. Patch known vulnerabilities promptly and use secure coding practices for custom applications.
  7. Restrict access to cardholder data to the people whose jobs need it.
  8. Give every user a unique ID and authenticate access to system components.
  9. Restrict physical access to cardholder data using locks, cameras, and visitor controls.
  10. Log and monitor access to network resources and cardholder data. Review logs regularly and retain them for at least a year.
  11. Test security systems and processes regularly, including quarterly vulnerability scans and annual penetration testing.
  12. Maintain a written information security policy covering all personnel, contractors, and third parties.

Shrinking What You Have to Secure

The less of your environment that touches cardholder data, the fewer systems fall under the standard. Two technologies do most of the work here.

Tokenization replaces the primary account number with a substitute value that has no exploitable meaning if stolen. Systems that only ever see tokens can fall outside your cardholder data environment entirely, so PCI DSS no longer applies to them.4PCI Security Standards Council. Information Supplement – PCI DSS Tokenization Guidelines The token vault and the point of capture still need protection, but the number of in-scope components drops sharply.

Point-to-point encryption (P2PE) encrypts card data at the terminal and keeps it encrypted until it reaches the processor’s decryption environment. Merchants using a PCI-validated P2PE solution qualify for SAQ P2PE, which has 33 questions instead of the 329 in the full SAQ D.5PCI Security Standards Council. P2PE At a Glance For brick-and-mortar merchants, validated P2PE is one of the fastest ways to simplify compliance.

How You Actually Validate

Most merchants below Level 1 complete a Self-Assessment Questionnaire. The Council publishes several versions, each keyed to a specific payment setup:6PCI Security Standards Council. Understanding the SAQs for PCI DSS

  • SAQ A — merchants who fully outsource all cardholder data functions to PCI-validated third parties, with no card data on their own systems. Shortest form.
  • SAQ B — standalone, dial-out terminals with no electronic storage.
  • SAQ B-IP — standalone terminals with an IP connection to the processor, no storage.
  • SAQ C-VT — one-at-a-time manual entry into a validated web-based virtual terminal.
  • SAQ C — internet-connected payment application systems with no electronic storage.
  • SAQ P2PE — merchants using a PCI-validated P2PE solution with hardware terminals and no storage.
  • SAQ D — the catch-all for merchants who store cardholder data or don’t fit a simpler form. Longest and most demanding.

Choosing the wrong SAQ wastes time and can leave real controls unaddressed. If you’re not sure which one fits, ask your acquiring bank before you start.

Level 1 merchants and Level 1 service providers skip the SAQ and complete a Report on Compliance based on an on-site audit by a QSA. Every business, regardless of level, also files an Attestation of Compliance summarizing its status. If you engage a QSA, verify their current status through the Council’s public professionals lookup before signing anything.7PCI Security Standards Council. Verify a Professional

Quarterly Vulnerability Scans

Beyond the questionnaire or audit, PCI DSS requires two kinds of recurring scans. External scans must be run at least quarterly by an Approved Scanning Vendor listed on the Council’s site. A passing scan means no vulnerabilities scoring 4.0 or higher on the Common Vulnerability Scoring System.8PCI Security Standards Council. Can Entities Be PCI DSS Compliant if They Have Performed Vulnerability Scans at Least Once Every Three Months but Do Not Have Four Passing Scans If a scan fails, you remediate and rescan until it passes. Internal scans also run quarterly, and you can perform these yourself. To show full compliance, you need passing internal and external scans for each of the previous four quarters.

Once your scans and documentation are in order, you submit everything to your acquiring bank, which reviews the materials and confirms your status with the card brands. Compliance renews annually. Miss the renewal and your acquirer or the card brands can restrict or revoke your ability to process transactions.

What Non-Compliance Costs

PCI DSS is not a law. It’s a contractual requirement enforced through the agreements between merchants, acquirers, and card brands. The penalties are still serious.

Acquirers and card brands can charge monthly fines that grow the longer violations persist. Non-compliant merchants also see higher per-transaction processing fees and, in extreme cases, lose the ability to accept cards at all. For most businesses, losing card acceptance is worse than any fine.

After a breach, the picture gets more expensive. Card brands may require the compromised merchant to engage a PCI Forensic Investigator, who must be able to begin the investigation within five business days.9PCI Security Standards Council. Responding to a Cardholder Data Breach The merchant pays for that work. On top of forensic costs come liability for fraudulent charges, card-reissuance costs charged back by issuing banks, and potential lawsuits from affected cardholders. Cyber liability insurance may cover some of this, but insurers routinely exclude or cap PCI-related fines when the merchant can’t show compliance at the time of the breach.

PCI DSS v4.0.1 and the March 31, 2025 Deadline

The current version of the standard is PCI DSS v4.0.1, released in June 2024. It was a limited revision that clarified v4.0 without adding new requirements.10PCI Security Standards Council. Now Is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x

The date to know: 51 of the 64 new requirements introduced in version 4.0 were originally future-dated to give organizations time to prepare. That grace period ended on March 31, 2025. All requirements in v4.0.1 are now fully in effect, and assessors check against them during every validation.10PCI Security Standards Council. Now Is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x If your last validation was under v3.2.1 or early v4.0 and you haven’t updated controls for the previously future-dated items, expect gaps to be flagged at your next assessment.