Summary

Level 1: Over 6 million transactions per year — requires an annual on-site audit by a Qualified Security Assessor (QSA) - Level 2: 1–6 million transactions per year — requires an annual Self-Assessment Questionnaire (SAQ) - Level 3: 20,000–1 million ecommerce transactions per year — requires an SAQ

PCI DSS Checklist for Ecommerce: Everything You Need to Stay Compliant

Running an ecommerce store means handling payment card data — and that comes with serious responsibility. The Payment Card Industry Data Security Standard (PCI DSS) exists to protect cardholders and merchants alike. But for many online retailers, navigating the requirements feels overwhelming.

This PCI DSS checklist for ecommerce breaks down exactly what you need to do, organized by category, so you can assess your current security posture and take action where it matters most.

What Is PCI DSS and Why Does It Matter for Ecommerce?

PCI DSS is a set of security standards developed by the PCI Security Standards Council (PCI SSC) to protect payment card data during storage, processing, and transmission. Any business that accepts, processes, stores, or transmits cardholder data must comply — and ecommerce merchants are no exception.

Non-compliance can result in:

Heavy fines from payment processors and card brands
Data breach liability and customer lawsuits
Suspension of your ability to accept card payments
Irreparable damage to your brand reputation

The current standard, PCI DSS v4.0, was released in 2022 and became the sole active version in March 2024. If you haven’t reviewed your compliance posture against v4.0 yet, now is the time.

Understanding Your PCI DSS Merchant Level

Before diving into the checklist, you need to know your merchant level. PCI DSS assigns levels based on annual transaction volume:

Level 1: Over 6 million transactions per year — requires an annual on-site audit by a Qualified Security Assessor (QSA)
Level 2: 1–6 million transactions per year — requires an annual Self-Assessment Questionnaire (SAQ)
Level 3: 20,000–1 million ecommerce transactions per year — requires an SAQ
Level 4: Fewer than 20,000 ecommerce transactions per year — requires an SAQ

Most small to mid-sized ecommerce businesses fall into Level 3 or 4 and will complete a Self-Assessment Questionnaire (SAQ). The most common SAQ types for ecommerce merchants are SAQ A (fully outsourced payment processing) and SAQ A-EP (partially outsourced with a payment page on your server).

PCI DSS Checklist for Ecommerce Merchants

1. Build and Maintain a Secure Network

Your network is the foundation of your security posture. Attackers look for weak entry points — don’t give them one.

[ ] Install and maintain a properly configured firewall between your public network and cardholder data environment
[ ] Restrict inbound and outbound traffic to only what is necessary
[ ] Change all vendor-supplied default passwords and security parameters before deployment
[ ] Document and review firewall and router rules at least every six months
[ ] Segment your cardholder data environment (CDE) from the rest of your network

2. Protect Cardholder Data

This is the core of PCI DSS. You must know where cardholder data lives and protect it at every point.

[ ] Map all locations where cardholder data is stored, processed, or transmitted
[ ] Do not store sensitive authentication data (CVV, PIN blocks, full magnetic stripe) after authorization — ever
[ ] Mask the Primary Account Number (PAN) when displayed — show only the first six and last four digits
[ ] Encrypt stored PAN data using strong cryptography (AES-256 or similar)
[ ] Implement a documented data retention and disposal policy
[ ] Securely delete cardholder data when no longer needed

3. Maintain a Vulnerability Management Program

Attackers exploit known vulnerabilities. Staying patched and protected is non-negotiable.

[ ] Use and regularly update antivirus and anti-malware software on all systems
[ ] Develop and maintain secure systems and applications — apply security patches within one month of release
[ ] Conduct quarterly vulnerability scans using an Approved Scanning Vendor (ASV)
[ ] Perform annual penetration testing on your network and application layers
[ ] Address identified vulnerabilities based on a risk-ranked remediation plan

4. Implement Strong Access Control Measures

Limiting who can access cardholder data dramatically reduces your risk surface.

[ ] Restrict access to cardholder data on a need-to-know basis
[ ] Assign a unique user ID to every person with computer access — no shared credentials
[ ] Implement multi-factor authentication (MFA) for all access to the cardholder data environment
[ ] Enforce the principle of least privilege across all user roles
[ ] Revoke access immediately upon employee termination or role change
[ ] Maintain a current list of users with access to cardholder data

5. Secure Your Ecommerce Payment Page

This is especially critical for ecommerce. Your checkout page is a prime target for skimming attacks (like Magecart).

[ ] Use a PCI DSS-compliant payment gateway or processor
[ ] If using a redirect or iframe solution (SAQ A), ensure your payment provider is PCI compliant
[ ] If your server serves the payment page (SAQ A-EP), conduct regular code reviews and monitor for script changes
[ ] Implement Content Security Policy (CSP) headers to prevent unauthorized scripts from executing
[ ] Monitor all third-party scripts loaded on your payment pages and maintain an inventory
[ ] Use HTTPS with TLS 1.2 or higher across your entire website — not just checkout

6. Regularly Monitor and Test Networks

You can’t protect what you can’t see. Monitoring and logging are essential for detecting and responding to threats.

[ ] Implement audit logging for all access to cardholder data and system components
[ ] Retain logs for at least 12 months, with the most recent three months immediately available
[ ] Review logs daily using automated tools or a SIEM (Security Information and Event Management) system
[ ] Deploy file integrity monitoring (FIM) on critical system files and configuration files
[ ] Test security controls, limitations, and procedures at least annually

7. Maintain an Information Security Policy

Documentation isn’t just paperwork — it’s proof that your security program is real and repeatable.

[ ] Develop, publish, and maintain a formal information security policy
[ ] Conduct annual security awareness training for all staff
[ ] Establish an incident response plan specifically for suspected cardholder data breaches
[ ] Document roles and responsibilities for PCI DSS compliance
[ ] Perform an annual risk assessment to identify threats to cardholder data

Special Considerations for Ecommerce Under PCI DSS v4.0

PCI DSS v4.0 introduced several requirements that are particularly relevant to ecommerce merchants:

Requirement 6.4.3 and 11.6.1: These new requirements specifically address payment page security. Merchants must maintain an inventory of all scripts on their payment pages, confirm authorization for each, and implement a change-detection mechanism. These requirements became mandatory in March 2025.
Customized Approach: v4.0 allows organizations to meet the intent of a requirement using alternative controls — useful for businesses with unique technical environments.
Multi-Factor Authentication: MFA is now required for all access to the CDE, not just remote access.

FAQ: PCI DSS for Ecommerce

Do I need to be PCI compliant if I use Stripe, PayPal, or Shopify Payments?

Yes — but your compliance scope is significantly reduced. When you use a fully hosted payment solution, you’re not directly handling cardholder data. However, you still need to complete the appropriate SAQ (typically SAQ A), ensure your site uses HTTPS, and meet basic security requirements. Using a third-party processor does not eliminate your compliance obligation.

How often do I need to complete a PCI DSS assessment?

Compliance is an annual requirement. You’ll need to complete your SAQ or undergo a QSA audit every year. Additionally, quarterly vulnerability scans are required for most merchant levels. Think of PCI DSS as an ongoing program, not a one-time project.

What is the difference between SAQ A and SAQ A-EP?

SAQ A applies when all payment processing is fully outsourced to a PCI-compliant third party and your website only redirects customers to the payment provider. SAQ A-EP applies when your ecommerce website serves the payment page but uses a third-party processor to handle the actual transaction. SAQ A-EP has significantly more requirements due to the increased risk exposure.

What happens if I experience a data breach and I’m not PCI compliant?

The consequences are severe. Card brands can impose fines ranging from $5,000 to $100,000 per month. You may be required to undergo a forensic investigation at your own expense. Your payment processor may terminate your merchant account. And depending on your jurisdiction, you may face regulatory penalties and civil liability from affected customers.

Can I become PCI compliant on my own, or do I need a consultant?

Many Level 3 and Level 4 merchants successfully complete their SAQ independently using the right documentation and guidance. A consultant is valuable for complex environments or if you’re unsure about scoping your CDE. The most important thing is to take the process seriously and document everything thoroughly.

Take the Guesswork Out of PCI DSS Compliance

Working through PCI DSS requirements from scratch is time-consuming — and mistakes can be costly. Whether you’re completing your first SAQ or preparing for a formal audit, having the right documentation framework in place makes all the difference.

Our ready-to-use PCI DSS compliance templates include:

Pre-built SAQ A and SAQ A-EP documentation packages
Information security policy templates aligned with PCI DSS v4.0
Incident response plan for cardholder data breaches
Risk assessment worksheets and evidence checklists
Employee security awareness training outlines

Stop building compliance documentation from a blank page. Download our PCI DSS ecommerce compliance template bundle today and get audit-ready in a fraction of the time — with confidence that nothing has been overlooked.