A plain-English self-assessment of the controls a PCI-DSS questionnaire expects from any business that takes card payments — so you can find your gaps before your acquiring bank does. Free, no obligation.
The checklist tracks the PCI-DSS control areas to the way a small business actually operates — so you can score yourself honestly and shrink your scope where you can.
Want the full picture? See our PCI-DSS compliance guide and how we support retail businesses.
Enter your details and we'll email the PCI compliance checklist right away. No spam, no obligation.
In-store terminals, online checkout or both. See which controls apply and how to keep your SAQ simple.
Taking card details over the phone carries real risk. Check how you capture, handle and never store them.
Pressure-test your payment setup against what a PCI-DSS questionnaire actually asks, control by control.
Scope
If you store, process or transmit payment card data in any way — in person, online or over the phone — PCI-DSS applies to you. The level of validation (SAQ type) depends on how you take payments and your transaction volume.
The fewer systems that touch cardholder data, the fewer controls you have to prove. Using validated payment terminals and hosted/tokenized checkout can shrink your scope dramatically — the checklist shows where this applies.
The checklist
No. The checklist helps you self-assess the IT and security controls a PCI-DSS Self-Assessment Questionnaire asks about, so you can find your gaps first. Your acquiring bank or payment provider defines which SAQ you must formally complete.
Book a free IT & security risk assessment and we'll turn your checklist into a prioritized plan. No obligation.
Book a free risk assessment