PCI DSS Basics for Product Teams
Key takeaway
The cheapest PCI DSS strategy is to reduce scope, not to satisfy more controls. If card data never touches your servers — using a payment provider's hosted fields or redirect — you qualify for a far simpler self-assessment and remove an entire class of breach risk.
PCI DSS applies to anyone who stores, processes, or transmits cardholder data. Teams usually meet it as a procurement blocker, panic, and start implementing controls. The productive first question is different: how do we handle fewer card numbers?
Scope reduction is the whole game
- Hosted payment page or redirect — the customer enters card details on the provider's domain. Smallest scope available.
- Hosted fields / iframe elements — the form looks like yours, but the card fields belong to the provider and the data never reaches your server.
- Tokenisation — you store a provider token, never a card number, for repeat billing.
- Direct API handling of raw card data — the largest scope, requiring the full control set and an annual audit at higher volumes. Avoid unless there's a compelling reason.
Levels and self-assessment
Merchant level is driven by annual transaction volume, and the applicable Self-Assessment Questionnaire is driven by how you accept payments. A small e-commerce business using a fully hosted page answers a short questionnaire; the same business handling card data directly answers a very long one and may need an external assessor. Confirm the specific requirements with your acquirer — they, not your developers, define what you must submit.
Controls that apply regardless of scope
- No shared administrative accounts; MFA on all remote and admin access.
- Network segmentation between payment-related systems and everything else.
- Encryption in transit everywhere, and never logging a full card number — accidental logging is the most common finding we see.
- Patch management with a defined timeline for critical vulnerabilities.
- Retained logs and a tested incident response plan.
Design decisions to make early
Adding payments late usually means retrofitting segmentation and rewriting a checkout flow under audit pressure. Decide your card-handling model during architecture — before the first line of checkout code — and write down the scope boundary. It's a one-hour conversation that routinely saves months.