If your business takes card payments, PCI DSS applies to you. For most merchants that means two things: a passing ASV scan of your website every quarter, and a yearly self-assessment questionnaire (SAQ).
ServerScan runs the scan and gives you the Attestation of Scan Compliance your bank asks for. Plans start at $47 a quarter.
New to PCI? Start with PCI Compliance 101.
-
Approved Scanning Vendor
Scans by a PCI SSC Approved Scanning Vendor. -
Attestation included
Every passing scan comes with an Attestation of Scan Compliance. -
Unlimited rescans
Fix a problem and scan again, at no extra charge. -
Site seal included
A "Security Verified" seal for your site.
Step 1: Check if PCI DSS applies to you
If you accept Visa, Mastercard, American Express, Discover or JCB, PCI DSS applies to you. It doesn't matter how small you are. It also applies if you never store card numbers and a payment company handles the card for you. PCI DSS comes from the card brands, not from a government, so it applies wherever you are, including the EU and the UK. Your bank or payment processor is the one who asks you to prove it.
Step 2: Find your SAQ
Every merchant fills in a self-assessment questionnaire (SAQ) once a year. Which one you use depends on how you take payments. Your SAQ also decides whether you need a quarterly ASV scan. Not sure which one is yours? Our guide Which SAQ do I need? walks you through it.
| SAQ | Who it is for | ASV scan? |
|---|---|---|
| A | Online, mail or phone sales where a payment company hosts the card form. Your site sends the shopper to their page, or shows it in an iframe. | Yes |
| A-EP | Online sales where your own site serves the payment page or its scripts, but the card data goes straight to the payment company. | Yes |
| B | In-person sales on imprint machines or standalone dial-out terminals only. No e-commerce. | No |
| B-IP | In-person sales on approved card terminals that connect to the processor over the internet. No e-commerce. | Yes |
| C | A payment application or system connected to the internet. No stored card data. No e-commerce. | Yes |
| C-VT | You type one payment at a time into a virtual terminal on your processor's website, and that is your only way of taking cards. | No |
| P2PE | In-person sales on a validated point-to-point encryption (P2PE) solution only. | No |
| SPoC | In-person sales on a phone or tablet with a PCI-listed SPoC app and an approved card reader. | No |
| D | Everyone else, including any merchant that stores card data. Service providers use their own version of SAQ D. | Yes |
Most small online businesses use SAQ A. Since the January 2025 revision of SAQ A, you also confirm that your site is not open to script attacks on the payment page. Your bank can confirm which SAQ they expect from you. This table follows PCI DSS v4.0.1.
Step 3: Pass a quarterly ASV scan
If your SAQ calls for it, an Approved Scanning Vendor has to scan your website from the outside at least once every three months. The scan looks for known weaknesses that an attacker could use. Here's how it works with ServerScan. You enter your domain or IP address and pick a plan. We scan it, and you can scan quarterly or as often as every day at no extra charge. If the scan finds a problem, the report tells you what it is and how to fix it. Fix it and scan again as many times as you need. When you pass, you get an Attestation of Scan Compliance to send to your bank.
What you send your bankThis is what a passing scan gives you: an Attestation of Scan Compliance with your scan date, result and expiry date. The customer details in this sample are made up.
See a sample attestation (PDF, 180 KB)
Start your PCI scan, from $47 a quarter
Your merchant level
Banks sort merchants into four levels by how many card transactions they take each year. Your level decides how you report, not whether you need a scan. Your SAQ decides that. Here are the Visa and Mastercard levels.
| Level | Card transactions a year | What you file |
|---|---|---|
| 1 | Over 6 million | A Report on Compliance from an on-site audit by a QSA |
| 2 | 1 to 6 million | A yearly SAQ. Some brands want it signed off by a QSA or an internal auditor. |
| 3 | 20,000 to 1 million online | A yearly SAQ |
| 4 | Under 20,000 online, or up to 1 million in total | A yearly SAQ |
American Express, Discover and JCB set their own numbers. Your bank or processor makes the final call on your level, and it can ask more of a business it sees as high risk, such as one that has had a breach.
Common questions
I use Stripe or PayPal. Do I still need a scan?
Usually yes. If your site sends shoppers to the payment company's page, or shows their form in an iframe, you most likely use SAQ A. SAQ A includes a quarterly ASV scan of your website.
What happens if my scan fails?
The report lists each problem and how to fix it. Fix them and scan again. Rescans cost nothing extra, and you only need one passing scan each quarter.
What do I send to my bank?
Usually two things: the Attestation of Scan Compliance from your passing scan, and your completed SAQ with its Attestation of Compliance. Your bank will tell you if it needs anything else.
Does PCI DSS apply outside the US?
Yes. The card brands set it, so it applies in every country where their cards are accepted.