How PCI DSS applies to each way of taking card payments and to common business models: e-commerce, card-present retail, call centers, mobile acceptance, subscriptions, payment software vendors, small merchants and AI systems in payment environments.
How the way a checkout collects card data sets e-commerce PCI DSS scope: redirect and iframe pages under SAQ A, direct post and JavaScript forms under SAQ A-EP, accepting card data on your own site under SAQ D, script controls and ASV scans.
PCI DSS for stores and restaurants taking card-present payments: terminals as part of the CDE, device inspection and tamper protection, PTS approval and expiry, SAQ B, B-IP, C and P2PE options, and keeping POS networks isolated.
How card payments taken by phone affect PCI DSS: card verification codes in call recordings, suppression and deletion, compensating controls, VoIP scope, card data sent over chat or email, and local recording retention laws.
Taking cards on phones and tablets under PCI DSS: SAQ SPoC for listed solutions, the separate COTS standards and why they are not P2PE, how 9.5 treats merchant-owned phones, and when consumer-device apps are out of scope.
Storing cards for recurring and card-on-file payments under PCI DSS: why card verification codes cannot be kept, customer consent that does not count, rendering stored PAN unreadable, payment tokens and retention rules.
What PCI standards apply to companies that build payment software: PA-DSS retirement, Secure Software Standard validation including SaaS, the Secure SLC Standard v2.0, consumer-device apps, and PCI DSS Requirement 6 for bespoke and custom code.
What a small merchant actually has to do for PCI DSS: Level 4 thresholds and acquirer-set validation, choosing the simplest SAQ, outsourcing payments, quarterly ASV scans where applicable and the self-assessment steps.
How PCI DSS applies when AI tools touch payment data or payment systems: the SSC's 2026 AI supplement, scoping AI like any other technology, continual vulnerability management, AI in software lifecycles and assessments, and inventory and risk review duties.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.