There’s no PCI certificate to hang on the wall. That’s the first thing to clear up, because the phrase “PCI compliance certification” suggests an exam you pass and a document you frame, and the reality is closer to an annual tax filing.
What actually exists is validation: you pick the questionnaire that matches how you take money, answer it honestly, run a scan if your setup requires one, sign a document saying it’s all true, and send it to whoever asked. Then you do it again next year.
For most bakeries, florists, caterers, and wholesalers, this is a self-service process that costs a few hundred dollars and takes an afternoon, once you know which of the eight questionnaires is yours. Picking wrong is the expensive mistake, and it’s easy to make.
The Bottom Line
- PCI validation isn’t a certificate. It’s an annual self-assessment questionnaire plus a signed Attestation of Compliance.
- Merchants under 6 million annual transactions can generally self-validate instead of hiring an assessor (PCI Security Standards Council).
- There are eight SAQ types. Which one applies depends entirely on how card data reaches your processor.
- Quarterly ASV scans are required when you have internet-facing systems in scope, and commonly cost $100–$500 per quarter (SecurityMetrics).
- SAQ A eligibility tightened on March 31, 2025, and it now depends on your whole website, not just the checkout page.
Save 80% of delivery management time
We handle everything:
- Dedicated operations manager
- Real-time tracking dashboard
- Automated customer notifications
- Urgent issue resolution
Certification versus validation: what the word actually means
“Certification” gets used loosely in this space, mostly by companies selling something. Strictly, only two things get certified in the PCI world: assessors and scanning vendors. A Qualified Security Assessor is certified by the PCI Security Standards Council. An Approved Scanning Vendor is certified to run the external scans. Merchants aren’t certified; merchants validate.
Validation produces two artifacts. The self-assessment questionnaire is the long-form evidence: a series of yes/no questions covering the controls that apply to your environment, where a “no” obliges you to name a remediation date (PCI Security Standards Council). The Attestation of Compliance is the short cover document you sign, declaring the questionnaire is accurate. The AOC is what your processor or a corporate client actually asks to see.
Only Level 1 merchants, those over 6 million transactions a year, are required to bring in a QSA for an on-site assessment producing a Report on Compliance. Levels 2 through 4 can usually self-validate (Imperva). If you’re not sure which level you’re in, our overview of why PCI compliance matters for small businesses lays out the thresholds and the consequences of ignoring them.
Which self-assessment questionnaire applies to you
This is the decision the whole process hinges on. The SAQ isn’t chosen by business size or industry; it’s chosen by the path card data takes on its way to your processor.
| SAQ type | Who it fits | Typical small-business example |
|---|---|---|
| A | Ecommerce or MOTO with card handling fully outsourced to a compliant third party | Orders taken through a hosted checkout, no card data on your site |
| A-EP | Ecommerce where your site affects the payment page but doesn’t receive card data | A custom checkout using a processor’s embedded fields |
| B | Imprint machines or standalone dial-out terminals, no electronic storage | A terminal on an old phone line |
| B-IP | Standalone, PTS-approved terminals on an IP connection, no electronic storage | A countertop reader on your Wi-Fi |
| C-VT | Card data keyed into a web-based virtual terminal on an isolated computer | Phone orders typed into a processor’s browser portal |
| C | A payment application connected to the internet, no electronic card storage | An integrated POS in a shop with delivery |
| P2PE | A validated point-to-point encryption hardware terminal | A P2PE-listed reader carried by a driver |
| D | Everyone else, including any merchant that stores cardholder data electronically | A business keeping card numbers on file for wholesale accounts |
Questionnaire scope summarized from PCI Security Standards Council and Secureframe.
The spread between the ends of that table is enormous. One vendor guide puts SAQ A at 22 controls against 329 for SAQ D (Shuttle). Same revenue, same business, fifteen times the paperwork, decided by whether card numbers ever land in your systems.
Two situations push delivery-running businesses toward the heavy end without anyone noticing. Storing a card on file for a recurring wholesale account puts you in SAQ D unless your processor tokenizes it. And taking card numbers by phone drags the phone system, the workstation, and any call recording into scope. If either describes you, the fix is architectural rather than administrative, and it’s covered in the five steps behind the PCI DSS requirements.
The SAQ A change that caught merchants out in 2025
If you validated with SAQ A before 2025 and assumed this year would be the same, check again.
Requirements 6.4.3 and 11.6.1, payment page script management and page change detection, were removed from the SAQ A line items on March 31, 2025. They didn’t disappear. They were replaced by a broader eligibility criterion: to use SAQ A at all, you now have to confirm your site isn’t susceptible to attacks from scripts that could affect your ecommerce systems (Akamai).
That’s a wider net than it sounds. The old requirements pointed at the payment page. The new criterion points at the whole website. A restaurant site running a stack of marketing tags, a chat widget, and three analytics scripts alongside its hosted checkout now has to be able to say those scripts can’t reach the payment flow.
For a small merchant on a mainstream platform, the practical answer is usually to ask your platform and processor directly whether they support your SAQ A eligibility under v4.0.1, and keep the reply. Anyone running a custom site should raise it with whoever maintains the site.
Passing the ASV scan
If any system in your card environment is reachable from the internet, you need quarterly external vulnerability scans from an Approved Scanning Vendor. Not an internal tool, not your web host’s security add-on. It has to be an ASV on the Council’s list.
The mechanics are simple. You give the vendor your external IP addresses and domains, they scan, and they return a pass or fail with a list of findings. A fail means fixing what they found and rescanning until you pass. Four clean quarters is the target, and the scan reports are part of your evidence file.
Common reasons small merchants fail:
- Outdated TLS or weak ciphers on the web server, usually a hosting default nobody changed.
- An admin panel exposed to the open internet — the POS back office, a router interface, a remote-access tool left on after a support call.
- Unpatched CMS plugins, which is the single most frequent finding for merchants on WordPress and similar platforms.
- Scanning the wrong addresses, which produces a clean pass that proves nothing. If you’re not certain which IPs are in scope, ask your processor before you buy the scan.
Budget roughly $100–$500 a quarter for the scan itself (SecurityMetrics). Merchants who fully outsource card handling and have nothing in scope facing the internet may not need one at all, which is another reason scope reduction pays for itself.
What PCI validation costs and how long it takes
For a Level 4 merchant on a hosted checkout, the realistic annual cost is a few hundred dollars for scanning plus the hours it takes to answer the questionnaire honestly. Estimates for small merchants running a full program (SAQ, quarterly scans, some remediation) generally land between $500 and $3,000 a year, with more complex environments running higher (Sprinto).
The costs that make headlines belong to a different tier. QSA-led assessments average around $15,000, and a Report on Compliance for a large merchant runs from $35,000 into six figures (Sprinto). If someone quotes a small delivery business those numbers, they’re selling an enterprise engagement to a Level 4 merchant. Our look at which PCI compliance services a small merchant needs covers how to tell the difference.
On timing: the questionnaire itself is an afternoon if your documentation is in order and a couple of weeks if you have to chase down how your own systems are configured. The first year is always the slow one. Year two is mostly confirming that nothing changed.
When your compliance status expires
Validation is annual, and it lapses silently. Nothing stops working on the anniversary; you simply stop being compliant, and you find out when a breach or a corporate client’s vendor review raises the question.
Four things should trigger a fresh look before the calendar does:
- You changed how you take payments. New POS, new website checkout, new ordering platform, or you started taking phone orders. Any of these can move you to a different SAQ.
- You started storing cards on file. This is the one that moves merchants into SAQ D without a decision ever being made about it.
- Your transaction volume jumped. Crossing a level threshold changes your validation route.
- The standard changed. The v4.0 future-dated requirements became mandatory in March 2025, and the SAQ A eligibility criteria moved with them (PCI Security Standards Council).
Put the renewal in a calendar with a month’s warning. It’s a fifteen-second task that prevents the most common failure mode here, which isn’t getting something wrong. It’s forgetting the whole thing until someone asks.
Frequently asked questions
Is there such a thing as a PCI compliance certificate?
Not for merchants. Assessors and scanning vendors are certified; merchants validate by completing a self-assessment questionnaire and signing an Attestation of Compliance. Some service providers issue a branded “certificate of compliance” after you finish their process, but that’s their document, not a Council-issued credential. The AOC is the artifact that carries weight.
Who checks my self-assessment questionnaire?
Usually nobody, unless something goes wrong. Your acquiring bank or processor may ask you to submit it or attest through their portal. Its real test comes after a breach, when a forensic investigator compares what you attested to against what was actually running. An inaccurate SAQ is worse than a late one.
Do I need a QSA?
Only if you’re a Level 1 merchant, over 6 million transactions annually, or if your acquirer specifically requires one (Imperva). Smaller merchants can self-validate. Some businesses hire a QSA voluntarily for a complicated environment, but that’s a choice, not an obligation.
How long does PCI compliance last once I’ve validated?
One year. You revalidate annually and, where applicable, scan quarterly (PCI Security Standards Council). Compliance also effectively lapses the moment your environment changes materially. A new payment method or a new POS can invalidate the questionnaire you filed.
What changed for SAQ A in 2025?
Requirements 6.4.3 and 11.6.1 came out of the SAQ A line items and were replaced with an eligibility criterion covering your entire website’s exposure to malicious scripts, effective March 31, 2025 (Akamai). Those two requirements still apply to merchants on SAQ D and to on-site assessments.
Start with the questionnaire, not the paperwork
The order that works is: figure out where card data goes, pick the SAQ that matches, then fill it in. Most merchants do it backwards, downloading a questionnaire, discovering half the questions describe systems they don’t have, and concluding the whole thing is impenetrable.
Call your processor. Ask which SAQ they expect and whether your setup needs an ASV scan. Those two answers turn PCI validation from a vague obligation into a task with a defined end, and for most small businesses that take cards it’s a small one.
