PCI DSS v4.0.1 Policies for UK Retailers & SaaS
12 policies mapped to all 12 PCI DSS v4.0.1 requirement families. Written for UK retailers and e-commerce SMEs — ready for SAQ submission or QSA audit.
PCI DSS Retail Starter Pack pack
14 policies · £350 one-off
Lifetime access · no renewal · v4.0-ready
After checkout, answer questions about your business. Confirm your answers before generating policy drafts, then review and edit those drafts before use. The listed jurisdictions define this product’s coverage.
Free account · preview sample policies · buy pack when readyWhat is PCI DSS?
Quick answer. PCI DSS is the contractually-binding security standard for organisations that store, process or transmit cardholder data, maintained by the PCI Security Standards Council (Visa, Mastercard, Amex, Discover, JCB). The current version is PCI DSS v4.0.1 (effective March 2025), with 12 requirements covering network security, access control, encryption, testing and policy. Enforced via the merchant’s acquiring bank, not a government regulator.
PCI DSS (Payment Card Industry Data Security Standard) is the contractual standard governing every business that stores, processes or transmits cardholder data. It is enforced by the card schemes (Visa, Mastercard, Amex, Discover, JCB) via acquiring banks — not by a government regulator — but the penalties for non-compliance include fines, increased transaction fees, and loss of card-acceptance privileges.
The current version is PCI DSS v4.0.1 (v4.0.1 as of June 2024), with all future-dated requirements mandatory from 31 March 2025. Key v4.0 additions include targeted risk analysis, authenticated internal scans, phishing-resistant MFA, and script-integrity monitoring on e-commerce payment pages.
Who needs PCI DSS?
Quick answer. Any UK firm that stores, processes or transmits cardholder data — e-commerce merchants, payment service providers, SaaS firms with credit-card-on-file, and card-not-present BPOs. Scope depends on annual transaction volume (Level 1: 6m+, Level 2: 1m–6m, Level 3: 20k–1m, Level 4: under 20k). Even Level 4 SAQ-eligible merchants need the supporting policy set; larger firms add an annual QSA on-site audit.
- UK e-commerce retailers — every Shopify, WooCommerce, or custom-built store accepting card payments.
- UK SaaS firms that take card payments — either directly or via Stripe/Adyen/GoCardless.
- Subscription businesses and marketplaces processing recurring payments.
- Hospitality, ticketing, and events firms handling card-present transactions.
- Service providers and payment processors — stricter requirements under Section 12.
Policies you need for PCI DSS
Quick answer. PCI DSS v4.0.1 Requirement 12 prescribes a documented information-security policy plus 11 supporting policies: acceptable use (Req 12.3), risk assessment (Req 12.3), service-provider management (Req 12.8), incident response (Req 12.10), security awareness (Req 12.6), encryption / key management (Req 3, 4), access control (Req 7, 8), change management (Req 6), vulnerability management (Req 11), wireless and remote access (Req 1, 2), and physical security (Req 9).
Each of the 12 PCI DSS requirement families needs documented policies and procedures. Our PCI DSS Retail Starter Pack delivers all 12, bespoke to your merchant scope:
Information Security Policy
Req 12 — overarching ISMS owned by leadership.
Network Security
Req 1 — firewalls, segmentation, network diagrams.
Vulnerability Management
Req 6 & 11 — patching, scans, penetration tests.
Access Control
Req 7 & 8 — need-to-know, MFA, session timeouts.
Monitoring and Logging
Req 10 — audit logging, log retention, review cadence.
Security Testing
Req 11 — ASV scans, pen testing, script monitoring (v4.0).
Vendor Management
Req 12.8/12.9 — TPSP list, AoC tracking, responsibility matrix.
Incident Response
Req 12.10 — CDE breach handling, card-brand notification.
Physical Security
Req 9 — device controls, visitor logs, media handling.
Data Classification
Req 3 — PAN storage rules, masking, truncation.
Encryption
Req 3 & 4 — key management, TLS standards, in-transit encryption.
Change Control
Req 6 — change approvals, separation of environments.
Realistic timeline to PCI DSS compliance
Planning your rollout. There is no fixed readiness timetable. After purchase, complete the business questions and confirm your answers to generate editable drafts. Your team must review, approve and implement the policies. Evidence collection and any independent assessment take additional time.
Policy packs for PCI DSS
PCI DSS Retail Starter Pack
14 policies · £350 · all 12 PCI DSS v4.0.1 requirements
ISO 27001 Core Set
16 policies · £400 · broader ISMS for SAQ D / Level 1
InfoSec 38 Enterprise Pack
39 policies · £950 · full enterprise depth
Third-Party Risk & Contracting
18 policies · £500 · TPSP management Req 12.8/9
PolicySuite vs GRC platforms vs consultant vs DIY
Compare the scope. PolicySuite prepares editable policy drafts from your business answers. Compare the included documents and current shop price with the scope offered by a consultant, a template supplier or a governance platform. Implementation, specialist advice and independent assessment may require separate work.
Further reading
Frequently asked questions
Which PCI DSS version should I comply with?
PCI DSS v4.0.1 is the current version; v3.2.1 was retired on 31 March 2024. All future-dated v4.0 requirements became mandatory on 31 March 2025 — targeted risk analysis, authenticated scans, phishing-resistant MFA for admin, anti-phishing mechanisms, and client-side script integrity monitoring. Our pack uses v4.0/v4.0.1 language.
Do I need a QSA audit or can I self-assess?
Level 1 merchants (over 6 million transactions/year, or any merchant post-breach) need an annual QSA-led Report on Compliance. Levels 2–4 usually self-assess via the appropriate SAQ (A, A-EP, B, C, D). Most UK SMEs are Level 4 — SAQ plus quarterly ASV scan is sufficient.
Does outsourcing payments to Stripe make me compliant?
Using Stripe Checkout or a hosted iframe reduces scope to SAQ A — the lightest version — but you still need documented policies, access controls, a data-flow map, vendor management over Stripe, and v4.0 script monitoring on any page that interacts with card data. Our pack covers SAQ A, A-EP and D scenarios.
How much does PCI DSS cost for a UK SME?
SAQ A/A-EP: £300–£1,500/year for ASV scanning plus internal time. SAQ D: £3,000–£10,000 of consultant help if scope is complex. Level 1 QSA assessment: £15,000–£40,000. PolicySuite replaces the policy-drafting element with a one-off £400 pack.
What policies do I need for PCI DSS v4.0.1?
PCI DSS has 12 high-level requirements, each requiring documented policies and procedures. Our pack covers all 12 — information security, network security, vulnerability management, access control, logging, testing, vendor management, incident response, physical security, data classification, encryption, and change control.
What does the PCI DSS Retail Starter Pack include?
12 PCI DSS v4.0.1-aligned policies covering all 12 requirement families, written for UK retailers and e-commerce SMEs on Shopify, WooCommerce, Stripe Checkout and similar. Covers SAQ A and A-EP scoping explicitly — see live pricing.
Skip the PCI DSS paperwork
Explore the included policies, answer questions about your business after checkout, and generate editable drafts for review.
Get Started — £350References and primary sources
Quick answer. The framework guidance on this page is reviewed against the primary-source documents below. Each link resolves to an official regulator or standards-body publication so an auditor, procurement reviewer or DPO can verify the alignment without taking the page on trust.
- PCI SSC Document Library — the official PCI DSS 4.0 standard text and SAQ templates.
- NIST SP 800-53 — the federal control library cross-referenced by PCI DSS interpretations.
- CISA cybersecurity best practices — federal cyber guidance for retailers handling cardholder data.
- ISO 27001 alignment — the cross-walk most acquirers accept alongside a SAQ.
In our experience working with UK SMEs and similar organisations across the EU and US, the framework pages that survive enterprise vendor reviews are the ones that cite primary sources rather than secondary blog posts. Many UK SMEs typically discover this only after their first failed vendor questionnaire — the reviewer asked for a clause-to-source map and the standard reply pointed at a marketing page rather than the relevant regulator. The references above are the standing set we cite from inside the policies themselves so the chain stays intact end-to-end.