A guide to the 4 PCI DSS compliance levels

The Payment Card Industry Data Security Standard (PCI DSS) contains a set of requirements to help organisations prevent payment data breaches and payment card fraud.

But did you know that the same requirements don’t apply universally? In fact, there are four PCI compliance levels, which are determined by the number of transactions the organisation handles each year.

• Level 1: Merchants that process over 6 million card transactions annually.
• Level 2: Merchants that process 1 to 6 million transactions annually.
• Level 3: Merchants that process 20,000 to 1 million transactions annually.
• Level 4: Merchants that process fewer than 20,000 transactions annually.

Let’s take a look at how those levels affect the way you approach PCI DSS compliance.

Achieving PCI DSS compliance

PCI DSS is the result of collaboration between major car brands (American Express, Discover, JCB, Mastercard and Visa), with transaction processes closely monitored by the Payment Card Industry Security Standards Council (PCI SSC),

The objective is to ensure that card payments are subject to appropriate protections – and the first step to achieving that is to complete an assessment (the specifics vary based on your level), a quarterly network scan and the Attestation of Compliance Form.

For Level 1 organisations, the assessment should consist of an external audit performed by a QSA (Qualified Security Assessor) or ISA (Internal Security Assessor). They’ll perform an on-site evaluation of your organisation to:

• Validate the scope of the assessment;
• Review your documentation and technical information;
• Determine whether the PCI DSS’s requirements are being met;
• Provide support and guidance during the compliance process; and
• Evaluate compensating controls.

The auditor will then submit an RoC (Report on Compliance) to the organisation’s acquiring banks to demonstrate its compliance.

Organisations in PCI Levels 2-4 can complete an self-assessment questionnaire (SAQ) instead of an external audit. Level 2 organisations must also complete an RoC.

Self-assessment questionnaire

Several different types of SAQ apply depending on your merchant level and the way you process payment card information:

• SAQ A: For merchants that outsource their entire card data processing to validated third parties. This includes e-commerce transactions and mail/telephone order merchants.
• SAQ A-EP: For e-commerce merchants that outsource their payment processing but not the administration of the website that links to it.
• SAQ B: For e-commerce merchants that don’t receive cardholder data but do control the method through which data is redirected to a third-party payment processor.
• SAQ B-IP: For merchants that don’t store cardholder data in electronic form but use IP-connected point-of-interaction devices. These merchants may handle either card-present or card-not-present transactions.
• SAQ C-VT: For merchants that process cardholder data via a virtual payment terminal rather than a computer system. A virtual terminal provides web-based access to a third party that hosts the virtual terminal payment-processing function.
• SAQ C: For merchants with payment application systems connected to the Internet (no electronic cardholder data storage).
• SAQ D: For all other merchants not included in SAQ types A–C.
• SAQ P2PE: For merchants that use point-to-point encryption. It’s therefore not applicable to organisations that deal in e-commerce.

It’s essential that you select the right SAQ because each one has compliance requirements based on the ways payment card data is processed.

Find out more

You can find out more about your compliance requirements by reading PCI DSS: A pocket guide.

Now in its sixth edition, this book provides all the information you need to comply with PCI DSS.

It’s perfect as a quick reference for PCI professionals or as an introduction for new staff, covering:

• The fundamental concepts of the PCI DSS;  
• The consequences of a data breach, and to prevent one from occurring; and
• The steps you must take to comply with the PCI DSS and protect customers’ cardholder data.

PCI DSS: A pocket guide is available to purchase in physical, eBook, ePub and Kindle formats.

---

A version of this blog was originally published on 23 January 2020.