A guide to the 4 PCI DSS compliance levels

The PCI DSS (Payment Card Industry Data Security Standard) contains a set of requirements to help organisations prevent payment data breaches and payment card fraud.

But did you know that the same requirements don’t apply universally? In fact, there are four PCI compliance levels, which are determined by the number of transactions the organisation handles each year.

• Level 1: Merchants that process over 6 million card transactions annually.
• Level 2: Merchants that process 1 to 6 million transactions annually.
• Level 3: Merchants that process 20,000 to 1 million transactions annually.
• Level 4: Merchants that process fewer than 20,000 transactions annually.

Let’s take a look at how those levels affect the way you approach PCI DSS compliance.

Achieving PCI DSS compliance

PCI DSS is the result of collaboration between major card brands (American Express, Discover, JCB, Mastercard and Visa), with transaction processes closely monitored by the Payment Card Industry Security Standards Council (PCI SSC).

The objective is to ensure that card payments are subject to appropriate protections – and the first step to achieving that is to complete an assessment (the specifics vary based on your level), a quarterly network scan and the Attestation of Compliance Form.

For Level 1 organisations, the assessment should consist of an external audit performed by a QSA (Qualified Security Assessor) or ISA (Internal Security Assessor). They’ll perform an on-site evaluation of your organisation to:

• Validate the scope of the assessment;
• Review your documentation and technical information;
• Determine whether the PCI DSS’s requirements are being met;
• Provide support and guidance during the compliance process; and
• Evaluate compensating controls.

The auditor will then submit an RoC (Report on Compliance) to the organisation’s acquiring banks to demonstrate its compliance.

Organisations in PCI Levels 2-4 can complete an self-assessment questionnaire (SAQ) instead of an external audit. Level 2 organisations must also complete an RoC.

You can find out more about this process by reading PCI Audit Success in Nine Essential Steps.

This green paper help organisations to prepare for a PCI audit and ensure a successful outcome.

It contains:

• Nine essential tips to prepare for a successful RoC audit;
• A checklist of what the auditor will be looking out for on the day;
• Invaluable tips to avoid unnecessary delays and frustrations;
• Advice on identifying non-conformities before the audit takes place; and
• Guidance on how to choose the right QSA.

Self-assessment questionnaire

Several different types of SAQ apply depending on your merchant level and the way you process payment card information:

• SAQ A: For merchants that outsource their entire card data processing to validated third parties. This includes e-commerce transactions and mail/telephone order merchants.
• SAQ A-EP: For e-commerce merchants that outsource their payment processing but not the administration of the website that links to it.
• SAQ B: For e-commerce merchants that don’t receive cardholder data but do control the method through which data is redirected to a third-party payment processor.
• SAQ B-IP: For merchants that don’t store cardholder data in electronic form but use IP-connected point-of-interaction devices. These merchants may handle either card-present or card-not-present transactions.
• SAQ C-VT: For merchants that process cardholder data via a virtual payment terminal rather than a computer system. A virtual terminal provides web-based access to a third party that hosts the virtual terminal payment-processing function.
• SAQ C: For merchants with payment application systems connected to the Internet (no electronic cardholder data storage).
• SAQ D: For all other merchants not included in SAQ types A–C.
• SAQ P2PE: For merchants that use point-to-point encryption. It’s therefore not applicable to organisations that deal in e-commerce.

It’s essential that you select the right SAQ because each one has compliance requirements based on the ways payment card data is processed.

PCI DSS compliance made easy

For those looking for help completing their PCI DSS compliance requirements, IT Governance is here to help.

Our PCI DSS Documentation Toolkit contains everything you need to complete the project, including template documents and a document checker to ensure you select and amend the appropriate records.

The toolkit supports all self-assessment questionnaires, regardless of your specific payment scenario.

It’s fully aligned with the PCI DSS, so you can be sure that your policies are accurate and compliant. All you have to do is fill in the sections that are relevant to your organisation.

---

A version of this blog was originally published on 23 January 2020.