Establishing secure connection…Loading editor…Preparing document…

PCI DSS Compliance Checklist

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

PCI DSS Compliance Checklist

Client Name:     Service Provider Name:

WHEREAS

WHEREAS, Client requires validation and documented evidence of compliance with the Payment Card Industry Data Security Standard (PCI DSS) for systems, processes and third-party services that store, process, or transmit cardholder data; and

WHEREAS, Service Provider has agreed to perform an assessment, provide remedial recommendations where applicable, and maintain an ongoing checklist of controls, evidence, and attestations necessary for demonstration of compliance; and

WHEREAS, the parties wish to document the scope, responsibilities, and attestation for the PCI DSS control areas and confirm payment and termination terms associated with the engagement.

SCOPE OF WORK

The scope of the assessment includes all systems, applications, network segments, third-party service integrations, and processes that are in-scope for PCI DSS by virtue of storing, processing or transmitting cardholder data. Any changes to scope must be approved in writing by both parties.

PCI DSS REQUIREMENTS CHECKLIST

For each control area below, mark Compliant if the control is implemented and provide evidence and the responsible party. If Not Applicable, provide rationale in Evidence.

 Requirement 1: Install and maintain a secure network and firewall configuration to protect cardholder data.

 Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.

 Requirement 3: Protect stored cardholder data (apply strong cryptography where required).

 Requirement 4: Encrypt transmission of cardholder data across open, public networks.

 Requirement 5: Protect all systems against malware and regularly update anti-virus mechanisms.

 Requirement 6: Develop and maintain secure systems and applications; apply security patches promptly.

 Requirement 7: Restrict access to cardholder data by business need-to-know.

 Requirement 8: Assign a unique ID to each person with computer access.

 Requirement 9: Restrict physical access to cardholder data.

 Requirement 10: Track and monitor all access to network resources and cardholder data (logging).

 Requirement 11: Regularly test security systems and processes (vulnerability scanning, penetration testing).

 Requirement 12: Maintain a policy that addresses information security for all personnel.

ATTESTATION

By signing below, the signing representatives of Client and Service Provider certify, under penalty of perjury and to the best of their knowledge, that the answers, completion dates and evidence provided in this checklist accurately reflect the status of the controls as of the signature date and that any exceptions are documented in the Evidence / Notes fields.

Attestation:  I certify that the documented controls are implemented and operating as described.

PAYMENT TERMS

Total Fee: $     Invoice Schedule:

Late Payment: . Invoices unpaid after thirty (30) days may be suspended pending resolution.

TERM AND TERMINATION

Effective Date:     Term End Date:

This engagement shall commence on the Effective Date and continue until the Term End Date unless earlier terminated by either party for material breach or as otherwise provided herein. Either party may terminate without cause upon written notice to the other party given at least days prior to termination.

CONFIDENTIALITY

Each party acknowledges that, in the course of performance, it may receive Confidential Information of the other party. Confidential Information shall include cardholder data, security testing results, remediation plans, and any non-public information reasonably identified as confidential.

Each party agrees to: (a) hold Confidential Information in strict confidence; (b) use Confidential Information solely for the purposes of assessment, remediation and compliance reporting; and (c) restrict disclosure to employees, contractors or agents with a need to know and who are bound by confidentiality obligations no less protective than those herein. Obligations under this Confidentiality section survive termination.

GOVERNING LAW

This checklist and any related engagement shall be governed by and construed in accordance with the laws of the jurisdiction selected by the parties.

ENTIRE AGREEMENT

This Checklist, together with any statements of work, payment schedules and written amendments executed by the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings, whether written or oral.

GENERAL PROVISIONS

If any provision of this Checklist is held to be invalid, illegal or unenforceable, the remaining provisions shall remain in full force and effect. Neither party may assign its rights or obligations hereunder without the prior written consent of the other party, except to a successor entity in connection with a merger or sale of substantially all assets.

ADDITIONAL NOTES

Client Representative

Printed Name:

By:

Date:

Title:

Service Provider Representative

Printed Name:

By:

Date:

Title:

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What the PCI DSS Compliance Checklist Covers

The PCI DSS Compliance Checklist is a structured assessment tool that helps organizations confirm they meet the Payment Card Industry Data Security Standard requirements for protecting cardholder data. It breaks the standard into discrete control areas—such as network security, access control, encryption, logging, and monitoring—and records control status, owner, evidence references, and remediation steps. Teams use the checklist for self-assessments, preparing for Qualified Security Assessor reviews, and documenting recurring activities like quarterly ASV scans and annual penetration testing to validate ongoing compliance.

Why a Checklist Matters for Cardholder Data Security

A PCI DSS Compliance Checklist provides a repeatable way to document controls, consolidate evidence, and demonstrate due diligence to card brands and acquiring banks. It clarifies scope, prioritizes remediation, supports periodic scanning requirements, and reduces the operational risk and costs associated with breaches and forensic investigations.

Why a Checklist Matters for Cardholder Data Security

Who Typically Completes This Checklist

The checklist is used by security, IT, and compliance teams across merchants and service providers to align stakeholders and capture evidence before validation.

  • Merchant Security Lead coordinating card acceptance, SAQ completion, ASV scans, and remediation tracking within the business unit.
  • Service Provider Compliance Manager documenting hosted payment environments, contractually bound controls, and third-party vendor attestations.
  • Internal/External QSA or Auditor reviewing documented evidence, validating scope, and preparing the Report on Compliance or Attestation of Compliance.

It also guides external assessors and internal auditors during reviews so responsibilities and outstanding issues are clearly visible.

Typical Signatories and Owners

Merchant Compliance Officer

Responsible for maintaining the checklist, coordinating technical owners, and submitting SAQs or evidence to the acquiring bank. This role collects scan reports, documents segmentation, and certifies remediation timelines to demonstrate compliance posture.

Service Provider Security Lead

Owns controls in hosted or shared environments, provides evidence to customers, and coordinates third-party attestations. This person manages access control, vulnerability scanning, and operational processes needed for PCI validation.

Core Sections to Include in a Professional Checklist

Organize the checklist into discrete sections that map to PCI DSS control objectives and evidence types for clear validation and handoff.

Scope Definition

Define in-scope systems and data flows precisely, including payment channels, tokenization points, and third-party connections so only the relevant environment is assessed and controls are targeted correctly.

Network Controls

Document firewall rules, segmentation measures, and network device hardening; include ASV scan results and evidence that external-facing services do not expose cardholder data.

Access Management

Capture user account control, privilege assignments, multi-factor authentication status for administrative access, and procedures for onboarding and termination to minimize insider risk.

Data Protection

Record encryption in transit and at rest, key management practices, and handling rules for PAN data to ensure cryptographic safeguards align with PCI requirements.

Monitoring & Logging

List centralized logging, retention windows, and monitoring controls; include evidence of log collection, alerting, and regular review processes to detect and investigate incidents.

Testing & Remediation

Track vulnerability scan schedules, penetration test results, remediation owners, and verification steps so that corrective actions are documented and closed on time.

Step-by-Step: Complete the Checklist

Follow these sequential actions to prepare a defensible checklist and evidence package for PCI validation.

  • 01
    1. Identify Scope: Map systems storing or transmitting card data.
  • 02
    2. Collect Evidence: Gather config files, scan reports, and policies.
  • 03
    3. Record Controls: Mark status, owner, and remediation steps.
  • 04
    4. Review & Sign: Have owners and compliance review and certify.

Typical Submission and Record Flow

A concise workflow for completing, routing, and retaining the checklist when you use electronic forms and signatures.

  • Upload Document: Upload the checklist as PDF or DOCX.
  • Assign Reviewers: Route to technical owners for validation.
  • Authenticate Signers: Use email, SMS, or SSO-based verification.
  • Store Record: Retain signed PDF and audit trail.

Recommended Digital Workflow Settings

Configure routing, authentication, and evidence attachments to match your compliance and audit requirements.

Field Configuration
Authentication Method Email with optional SMS OTP for signer identity
Role Routing Sequential approvals by control owner then compliance
Evidence Upload Require PDF attachments for scans and configs
Retention Policy Retain signed records and logs per retention policy

Technical Requirements for eSubmission and Storage

Choose a platform that supports secure upload, role-based routing, and immutable audit trails for signed checklists.

  • Integrations: Salesforce, NetSuite, Google Workspace
  • File Formats: PDF, DOCX, XLSX
  • Authentication: Email, SMS OTP, SSO

eSignature Vendor Pricing and Feature Comparison

Compare starting prices and core features for common eSignature vendors used to collect and retain PCI evidence and signed attestations.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies Varies Varies Varies
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No
Envelope Cap None 100 envelopes/user/yr Varies Varies Varies

Security and Compliance Attributes to Record

Encryption: AES-256 at rest
Transport Security: TLS 1.2/1.3 in transit
Certifications: PCI DSS certified
Audit Standards: SOC 2 Type II
Healthcare: HIPAA (BAA required)
Regulated Records: 21 CFR Part 11 compliance available

Consequences of Incomplete or Inaccurate Checklists

Card Brand Fines: Fines and remediation costs
Forensic Costs: Paid investigations and reporting
Merchant Account Loss: Suspension or termination risk
Increased Chargebacks: Higher processing losses
Regulatory Penalties: State or federal enforcement
Reputational Harm: Customer trust and revenue impacts

Common Preparation Errors to Avoid

  • Failing to define scope clearly, which leads to missed in‑scope systems and incomplete evidence during assessment.
  • Attaching stale or mismatched scan reports that do not correspond to the assessment date or in‑scope IP ranges.
  • Using vague remediation descriptions without owners, target dates, or verification steps, which delays QSA acceptance.
  • Relying on screenshots alone instead of exportable configuration files and signed reports that auditors can verify.

Industry Examples and Real-World Use

These examples show how different organizations incorporate the checklist into their compliance program and evidence workflows.

Martin Properties — Real Estate

A small property management firm digitized its checklist to consolidate payment processors and record ASV scans.

  • Point: Reduced manual paperwork and missing items.
  • By centralizing control owners and attaching PDF scan reports to each checklist item, the team accelerated quarterly reviews and produced clearer evidence for their acquiring bank during validation.

BIS — Professional Services

A services firm integrated checklist workflows with its ticketing system to assign remediation tasks automatically.

  • Point: Faster remediation tracking and closure.
  • This integration provided an auditable trail from vulnerability identification to ticket remediation and final sign-off, improving internal audit readiness and reducing external assessor queries.

Practical Tips for Accurate and Efficient Completion

Follow these practical controls and process recommendations to streamline checklist completion and reduce reviewer friction.

Define Scope Precisely
Document exact network segments, IP ranges, and payment channels. Clear scope prevents later disputes with QSAs and ensures scans and tests target the correct systems.
Use Versioned Evidence
Attach dated scan reports, configuration exports, and signed remediation logs. Version control helps auditors validate that evidence corresponds to the assessment window.
Assign Clear Owners
For each non‑compliant or compensating control, record a named owner and realistic remediation SLA so that follow-up and verification are straightforward.
Automate Where Possible
Integrate vulnerability scanners and ticketing systems to auto‑attach results and change records. Automation reduces manual transcription errors and improves timeliness.

Recurring Deadlines and Submission Targets

PCI compliance includes recurring scans, periodic testing, and annual attestations; track these dates to remain validated.

Quarterly Scans:

External ASV scans must run quarterly and after significant changes.

Annual Pen Test:

Perform internal and external penetration testing at least annually.

SAQ/ROC Submission:

Complete and submit SAQ or ROC per acquirer schedule annually.

Log Retention Window:

Maintain logs for event review and forensic purposes per policy.

Remediation SLA:

Track remediation with defined 30/90 day targets depending on severity.

Key Milestones in a Checklist Validation Cycle

Track discrete milestones from scope definition through final validation to maintain an auditable timeline for compliance activities.

01

Scoping Complete

Define and approve the in‑scope environment before evidence collection begins.

02

Evidence Collection

Gather scans, configs, and policy documents tied to each control.

03

Internal Review

Technical owners and compliance review entries and close low‑risk items.

04

External Validation

QSA or acquirer review, then final attestation or SAQ filing.

Frequently Asked Questions

Answers to common questions about completing, signing, and retaining a PCI DSS Compliance Checklist in a U.S. context.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.