PCI DSS vs SOX

PCI DSS applies by function, not by industry. Any entity that stores, processes or transmits cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment, falls in scope, including merchants, processors, acquirers, issuers and service providers. The PCI SSC maintains the standard but does not decide who must validate. Compliance-accepting entities, typically the payment brands and acquirers, set the validation route: a Report on Compliance completed by a Qualified Security Assessor, or a Self-Assessment Questionnaire, each closed with an Attestation of Compliance. Ask your acquirer or payment brand in writing which level and route applies to you, because that answer, not your revenue, drives the evidence you must produce. Also confirm whether they will accept a subset-only ROC, since that decision changes the testing workload.

SOX 404 applies by listing status and size. Section 404(a) of the Sarbanes-Oxley Act requires each annual report to include management's assessment, as of fiscal year end, of the effectiveness of internal control over financial reporting. Whether the external auditor must also attest depends on filer status. Under SEC Rule 12b-2, an accelerated filer has $75 million or more but less than $700 million of public float, and a large accelerated filer has $700 million or more, both measured at the end of the second fiscal quarter. Issuers eligible for the smaller reporting company revenue test are excluded from that accelerated filer status. Confirm your status with counsel each year, because the float measurement date fixes it for the following year's filing. For context, the SEC estimated in 2020 (Release 34-88365) that an issuer newly exempt from the Section 404(b) auditor attestation would save about $210,000 per year on average, roughly $110,000 in audit fees and $100,000 in other costs. That estimate reflects one class of issuer, so model your own audit fee quote instead of using it as a budget.

PCI DSS asks for scope confirmation far more often than SOX asks for an ICFR assessment. Under Requirement 12.5.2, the entity itself must confirm PCI DSS scope at least every 12 months and whenever a significant change occurs, identifying data flows, locations of account data, connected components, segmentation controls and third-party connections. Service providers must repeat that confirmation every six months under 12.5.2.1. SOX Section 404(a), by contrast, requires management's assessment as of fiscal year end, and the external auditor's testing under AS 2201 varies in nature, timing and extent from year to year. Practically, a card environment that changes mid-year may need a documented scope check well before the next annual SOX cycle, so the two calendars should be mapped against each other early.

PCI DSS v4.0.1 is the only active version of the standard. It was published on 11 June 2024 as a limited revision of v4.0 with no added or deleted requirements, and v4.0 was retired on 31 December 2024. The PCI SSC ran a request for comments from 3 June to 20 July 2026 to begin the next iteration, but as of October 2026 it had announced no release date. Confirm with your acquirer or the payment brands which version and reporting template they expect for your next assessment, and track the SSC announcements so that a new version does not arrive during an audit window without a plan.

Sixty-four requirements were new in v4.0, and 51 of them were future-dated, becoming effective on 31 March 2025. Before that date they were best practices that could be marked not applicable. Teams that treated those dates as optional will find that the requirements now produce evidence obligations in every assessment. For a SOX-facing organization, the practical check is whether the controls supporting those requirements, such as access reviews and change management records, are also in scope for the financial reporting controls, so that one evidence set can serve both audits.

The PCI Security Standards Council does not enforce PCI DSS or impose penalties on anyone. Enforcement sits with the individual payment brands, which decide which entities must comply and validate and run any enforcement programs. In practice, a merchant or service provider that cannot produce a valid ROC or SAQ with an Attestation of Compliance may face consequences set by its acquirer or the card brands, and those terms usually live in the merchant agreement. Before you plan around this, confirm with your acquirer or processor which brand rules apply to your volume and level, what remediation timelines they impose, and what fees or restrictions follow a lapsed attestation. Ask counsel to read those contract terms, because the consequences are contractual and brand-specific rather than fixed by the standard.

SOX Section 404 works differently. Management's annual assessment of internal control over financial reporting must state whether ICFR is effective as of fiscal year end, and for accelerated and large accelerated filers that are not emerging growth companies, the external auditor attests to that assessment. A weak or ineffective IT general control can therefore appear as a control deficiency or material weakness in the report that investors read, and the consequences that follow, including SEC scrutiny, disclosure obligations, litigation exposure and market reaction, are set by the SEC and by the market rather than by a single enforcement body. Confirm with your securities counsel and audit committee how your company would disclose a deficiency, and which ITGC areas, such as access to programs and data or program changes, your auditor treats as high risk for your environment.

Both frameworks can produce a failure that reaches the same people, the CFO, the CISO and the board, but they reach them through different channels. A cardholder data gap leads to a conversation with the acquirer and card brands, while an ICFR gap leads to a conversation with the auditor, the audit committee and, potentially, the SEC. The practical step is to map who receives each notice in your organization and to agree on a single owner who can answer both. Ask your QSA and your external auditor, in writing, which findings they would escalate and to whom, so that a single control failure is not handled twice or inconsistently.