Summary

PCI DSS requires a formal, documented security program. For SaaS companies, this includes: - Stronger authentication requirements — MFA is now mandatory for all CDE access - Extended transition period — some new requirements are “best practice” until March 31, 2025, then mandatory

PCI DSS Requirements List for SaaS: A Complete Compliance Guide

If your SaaS platform handles payment card data — even indirectly — you need to understand PCI DSS. The Payment Card Industry Data Security Standard sets the baseline for how cardholder data must be protected, and non-compliance can result in fines, lost payment processing privileges, and serious reputational damage.

This guide breaks down the full PCI DSS requirements list for SaaS companies, explains what each requirement means in a cloud-hosted context, and helps you understand where your compliance obligations actually begin.

What Is PCI DSS and Who Does It Apply To?

PCI DSS is a global security standard developed by the Payment Card Industry Security Standards Council (PCI SSC). It applies to any organization that stores, processes, or transmits cardholder data — including SaaS companies that integrate with payment processors, offer billing features, or handle customer card information in any way.

Even if you use a third-party payment processor like Stripe or Braintree, you are not automatically exempt. Your compliance scope depends on how your application interacts with card data and which Self-Assessment Questionnaire (SAQ) type applies to your environment.

The 12 PCI DSS Requirements for SaaS Companies

The current version, PCI DSS v4.0 (released March 2022), organizes requirements into six goals and twelve core requirements. Here is what each means for a SaaS environment.

Requirement 1: Install and Maintain Network Security Controls

Your SaaS infrastructure must have properly configured firewalls and network segmentation. This means:

Defining your cardholder data environment (CDE) clearly
Restricting inbound and outbound traffic to only what is necessary
Documenting all network connections and data flows
Reviewing firewall rules at least every six months

For cloud-hosted SaaS, this translates to security group configurations, VPC rules, and ensuring your cloud provider’s shared responsibility model is clearly understood.

Requirement 2: Apply Secure Configurations to All System Components

Default passwords and unnecessary services are a leading attack vector. SaaS teams must:

Change all vendor-supplied default credentials before deployment
Disable or remove unnecessary functions, ports, and protocols
Maintain a system configuration standard for every component type
Document and justify all enabled services

This applies to your servers, containers, databases, APIs, and any managed services within your CDE.

Requirement 3: Protect Stored Account Data

This is one of the most critical requirements for SaaS platforms. If you store any cardholder data (CHD), it must be protected using strong encryption. Key points:

Never store sensitive authentication data (full track data, CVV/CVC, PINs) after authorization
Truncate or mask Primary Account Numbers (PANs) wherever possible
Use strong cryptography (AES-256 or equivalent) for any stored PANs
Implement key management procedures for all encryption keys

The best practice for most SaaS companies is to avoid storing card data entirely by using tokenization through your payment processor.

Requirement 4: Protect Cardholder Data with Strong Cryptography During Transmission

Any cardholder data transmitted over open or public networks must be encrypted. For SaaS platforms, this means:

Enforcing TLS 1.2 or higher for all data transmissions
Never sending PANs via unencrypted email, messaging, or HTTP
Validating server certificates and using trusted certificate authorities
Disabling older protocols like SSL, TLS 1.0, and TLS 1.1

Requirement 5: Protect All Systems Against Malware

Every system component within your CDE needs anti-malware protection. SaaS requirements include:

Deploying anti-malware solutions on all applicable systems
Keeping anti-malware definitions current and running active scans
Ensuring malware protection cannot be disabled by end users
Logging all malware activity and maintaining those logs

Requirement 6: Develop and Maintain Secure Systems and Software

For SaaS companies, this requirement is heavily focused on your development lifecycle. You must:

Establish a formal vulnerability management process
Apply security patches within defined timeframes (critical patches within one month)
Follow secure coding guidelines (OWASP is widely referenced)
Conduct code reviews and application security testing before releases
Maintain a web application firewall (WAF) if your application faces the internet

PCI DSS v4.0 places stronger emphasis on software security, making this requirement especially important for development teams.

Requirement 7: Restrict Access to System Components and Cardholder Data

Access to cardholder data must be on a need-to-know basis. This means:

Implementing role-based access control (RBAC)
Documenting access control policies and approved access lists
Denying access by default unless explicitly approved
Reviewing user access rights at least every six months

Requirement 8: Identify Users and Authenticate Access to System Components

Every user accessing your CDE must have a unique ID and strong authentication. Requirements include:

Assigning unique IDs to all users — no shared accounts
Enforcing multi-factor authentication (MFA) for all access into the CDE
Setting minimum password complexity and rotation policies
Locking accounts after a defined number of failed login attempts
Reviewing and disabling inactive accounts within 90 days

MFA is now required for all access into the CDE under PCI DSS v4.0, not just remote access.

Requirement 9: Restrict Physical Access to Cardholder Data

For cloud-based SaaS, your physical security responsibility is largely shifted to your cloud provider (AWS, Azure, GCP). However, you must:

Obtain documentation confirming your provider’s physical security compliance
Secure any on-premises infrastructure, workstations, or media
Implement controls for any physical media containing CHD
Maintain a visitor log for any physical data center access

Requirement 10: Log and Monitor All Access to System Components and Cardholder Data

Comprehensive logging is non-negotiable. SaaS platforms must:

Log all access to cardholder data and critical system components
Capture user activity, administrative actions, and system events
Protect logs from unauthorized modification or deletion
Retain logs for at least 12 months, with the most recent 3 months immediately available
Review logs daily using automated tools or a SIEM solution

Requirement 11: Test Security of Systems and Networks Regularly

Regular security testing helps identify vulnerabilities before attackers do. Requirements include:

Conducting quarterly internal and external vulnerability scans
Using an Approved Scanning Vendor (ASV) for external scans
Performing annual penetration testing (and after significant changes)
Implementing intrusion detection or prevention systems (IDS/IPS)
Monitoring for unauthorized wireless access points

Requirement 12: Support Information Security with Organizational Policies and Programs

PCI DSS requires a formal, documented security program. For SaaS companies, this includes:

A comprehensive information security policy reviewed annually
A risk assessment process conducted at least annually
Security awareness training for all personnel
An incident response plan that is tested at least annually
Vendor management policies covering all third-party service providers

How PCI DSS Scope Works for SaaS Platforms

One of the most strategic decisions a SaaS company can make is reducing its compliance scope. The smaller your cardholder data environment, the less you need to comply with.

Common scope reduction strategies include:

Using hosted payment fields or iframes from your payment processor so card data never touches your servers
Tokenization — storing tokens instead of actual card numbers
Point-to-point encryption (P2PE) — encrypting card data at the point of entry

If you can demonstrate that cardholder data never enters your environment, you may qualify for a simpler SAQ type (such as SAQ A), significantly reducing your compliance burden.

PCI DSS v4.0: What Changed for SaaS?

Version 4.0 introduced several important updates relevant to SaaS businesses:

Stronger authentication requirements — MFA is now mandatory for all CDE access
Customized approach — organizations can now implement alternative controls to meet security objectives
Targeted risk analysis — more flexibility in setting frequencies for certain controls
Enhanced e-commerce security — new requirements targeting script management and skimming attacks (Requirements 6.4.3 and 11.6.1)
Extended transition period — some new requirements are “best practice” until March 31, 2025, then mandatory

Frequently Asked Questions

Does my SaaS company need to be PCI DSS compliant if we use Stripe or PayPal?

Using a third-party payment processor reduces your scope but does not eliminate your compliance obligations. You still need to complete the appropriate SAQ and implement controls relevant to how your application interacts with the payment flow. If card data never touches your systems (e.g., you use hosted fields), you may qualify for SAQ A, which has far fewer requirements.

What is the difference between PCI DSS SAQ types for SaaS?

SAQ types range from SAQ A (lowest scope, for fully outsourced card processing) to SAQ D (highest scope, for merchants storing card data). Most SaaS companies using modern payment integrations qualify for SAQ A or SAQ A-EP. Your payment processor or a Qualified Security Assessor (QSA) can help determine the right SAQ for your setup.

How often do SaaS companies need to renew PCI DSS compliance?

PCI DSS compliance must be validated annually. Additionally, certain controls — such as vulnerability scans, penetration tests, and access reviews — must be performed on a quarterly, semi-annual, or annual basis throughout the year.

What happens if a SaaS company fails a PCI DSS audit?

Non-compliance can result in fines from card brands (typically $5,000–$100,000 per month), increased transaction fees, mandatory forensic investigations after a breach, and potential loss of payment processing privileges. Reputational damage from a publicized breach can be even more costly.

Can a SaaS company achieve PCI DSS compliance without a QSA?

Smaller SaaS companies may self-assess using the appropriate SAQ without a QSA. However, Level 1 merchants (processing over 6 million transactions annually) must have a QSA conduct an on-site assessment. Even if not required, working with a QSA is strongly recommended for complex environments.

Start Your PCI DSS Compliance Journey the Right Way

Working through all 12 PCI DSS requirements from scratch is time-consuming, and gaps in your documentation can put your entire compliance program at risk.

Save weeks of work with our ready-to-use PCI DSS compliance template library. Our professionally crafted templates cover every requirement — from information security policies and risk assessment frameworks to incident response plans and vendor management agreements — all pre-formatted and ready to customize for your SaaS environment.

👉 Browse our PCI DSS template packages today and get audit-ready faster, with confidence that nothing has been missed.