PCI-DSS v4.0 Readiness Checker

Do you use a tokenizing payment processor (Stripe, Paystack, Flutterwave, Adyen, etc.)?

If yes, you never touch raw card data — the processor returns a token. This is the SAQ A path and dramatically reduces your scope.

Confirm: NO full PAN, CVV, or magnetic-stripe data is stored in your database, logs, or backups (even briefly)?

Tokens, last-4-digits, and BIN-prefixes are fine. PCI-DSS Req 3 forbids storing CVV/CVC after authorization, ever. Storing full PAN unencrypted = audit failure regardless of intent.

Does your payment form use the processor's hosted iframe or redirect (NOT your own form posting card data through your server)?

If you POST card details to your own server (even briefly before tokenizing), you're in SAQ D scope — much harder. Stripe Elements, Stripe Checkout, Paystack popup all qualify as iframe.

Is all payment-flow traffic on TLS 1.2 or higher with no fallback to TLS 1.0/1.1 or SSL?

PCI-DSS Req 4 requires strong cryptography for transmission. Your nginx / load-balancer should explicitly disable TLS 1.0 and 1.1.

Does your payment page implement SRI (Subresource Integrity) on third-party scripts and a strict Content-Security-Policy?

PCI-DSS v4.0 Req 6.4.3 + 11.6.1 added e-skimming controls — script-src must be locked down on payment pages, with monitoring for unauthorized changes.

Is MFA enforced for ALL administrative access to systems handling cardholder data (payment dashboards, gateway portals, infrastructure)?

PCI-DSS v4.0 Req 8.4 — MFA required for all non-console administrative access. Includes remote SSH, cloud consoles, and your payment processor's admin UI.

Are all payment-related events (payment attempts, successes, failures, refunds, disputes) logged with actor + timestamp?

PCI-DSS Req 10 — audit trails required for all events touching cardholder data. Most processors log this on their side; you also need logs for your own state changes (e.g. order created, refund issued).

Are payment audit logs retained for at least 1 year, with the most recent 3 months immediately searchable?

PCI-DSS Req 10.7 — minimum retention. Most cloud log services (CloudWatch, Datadog, Splunk) handle this with a tiered storage policy.

Do you run external vulnerability scans on internet-facing systems at least quarterly (and after significant changes)?

PCI-DSS Req 11.3 — quarterly scans by an ASV (Approved Scanning Vendor) for SAQ D. Self-scans suffice for SAQ A.

Do you patch critical security vulnerabilities within 30 days of disclosure?

PCI-DSS Req 6.3 — critical patches must be applied within 30 days. Track via Dependabot / Snyk / pip-audit and verify deploys actually shipped.

Do you have a written incident response plan that specifically addresses suspected payment data breaches?

PCI-DSS Req 12.10 — incident response plan required, must be tested annually. Should include: who to call (acquirer + processor), evidence preservation, customer notification.

Are your payment processor and other PCI-relevant vendors named in a written agreement that includes their PCI-DSS responsibilities?

PCI-DSS Req 12.8 — vendor management. Stripe, Paystack, etc. provide an Attestation of Compliance (AoC) on request — keep it on file.