PCI DSS Compliance & Certification Support in the Philippines

PCI DSS in the Philippines: what compliance takes, and what it buys you

PCI DSS — the Payment Card Industry Data Security Standard — applies to every organisation that stores, processes or transmits payment-card data, and to every organisation whose systems can affect its security. It is not a Philippine statute or an ISO standard you can politely defer: it is a contractual mandate flowing from the card brands — Visa, Mastercard, American Express, Discover, JCB — through your acquirer or payment facilitator into agreements you have already signed. Accept cards in Makati, run an online store on a gateway, or take phone payments in a Cebu contact centre for a US client, and PCI DSS already applies. The only question is whether you can prove compliance when your acquirer, your client or a forensic investigator asks.

The current version is PCI DSS v4.0.1, published by the PCI Security Standards Council in June 2024 — the only active version since v4.0 retired on 31 December 2024. The future-dated v4 requirements became mandatory on 31 March 2025, so every 2026 assessment tests the full standard, including the MFA, payment-page script and evidence requirements many organisations spent two years postponing. There is no partial credit left in the system.

Formal validation takes one of two shapes: a Self-Assessment Questionnaire (SAQ) with a signed Attestation of Compliance (AoC) for lower-volume merchants and smaller service providers, or an assessment by a Qualified Security Assessor (QSA) producing a Report on Compliance (RoC) and AoC at the higher levels. Nobody else’s letterhead counts. Sterling runs the full compliance programme — scoping, gap analysis, remediation and evidence — with formal assessments performed through our PCI SSC-qualified QSA partners, so the artefact your acquirer or client receives is the one the card brands actually recognise.

What a properly run PCI DSS programme buys you:

• Uninterrupted card acceptance. Your acquirer has no compliance grounds to escalate fees, hold settlement or terminate the facility.
• A defensible AoC you can hand to enterprise clients, overseas headquarters and vendor-security reviewers without flinching — renewed on schedule every year after.
• A smaller, cheaper compliance perimeter, because scope is engineered down — tokenisation, segmentation, validated channels — before anyone writes policies for systems that never needed to be in scope.
• Breach economics on your side. Demonstrated compliance materially changes how forensic investigations, brand assessments and liability arguments run after an incident.

The business case: PCI DSS is payment continuity

Strip away the acronyms and PCI DSS is about one commercial fact: accepting card payments is a privilege granted by your acquirer, and your acquirer answers to the card brands. Compliance is the condition attached to that privilege — which is why enforcement feels different from every other framework. Consequences do not arrive as government fines after years of due process; they arrive through the payments system itself, faster, quieter and harder to argue with.

What non-compliance looks like when it bites:

• Recurring non-compliance assessments levied by the brands on your acquirer and passed straight down to you, month after month, until you validate. Merchant agreements are written so acquirers never absorb these.
• Escalated validation demands. An acquirer that loses patience — or a breach — can reclassify you upward: a mid-tier e-commerce merchant wakes up carrying Level 1 obligations it never budgeted for.
• Post-breach machinery. After a suspected compromise, the brands can mandate a PCI Forensic Investigator (PFI) at your cost, assess you for fraud and reissuance losses, and at the extreme terminate the merchant facility — an industry-visible event that makes finding a new acquirer close to impossible.
• Quiet delisting for service providers. Enterprise procurement checks AoC dates annually; an expired attestation stalls renewals at exactly the moment the account is re-bid.

The positive case is just as concrete. For merchants, clean validation keeps interchange, settlement and acquirer relationships uncomplicated. For Philippine BPOs, processors, fintechs and software providers, a current service-provider AoC is a sales document: it clears US, UK, EU and Australian vendor-security reviews at first pass. And it is independently checkable — Visa and Mastercard maintain public registries of validated service providers, and sophisticated clients ask why a vendor is not on them.

One Philippine specific: a card-data breach here is also a personal-data breach under the Data Privacy Act, with notification duties to the National Privacy Commission and affected data subjects. PCI DSS does not discharge those obligations — but the two programmes share most of their technical controls, so a serious PCI programme is simultaneously most of your DPA security posture for payment data. Payment continuity, contract continuity, breach-cost containment, regulatory alignment: that is the business case, and every line of it is mechanical.

Who needs PCI DSS in the Philippines — and who is asking for it

The scoping rule is brutally simple: if cardholder data touches you, or your systems can affect its security, you are in. Philippine demand clusters into three groups.

• Merchants. Retail chains, supermarkets, restaurants and QSR franchises, hotels and resorts, airlines and travel agencies, hospitals and universities taking card payments, e-commerce brands, insurers, utilities and telcos with card-on-file billing. If a card number enters your website, terminal, kiosk, app or phone line, you carry merchant obligations.
• Service providers. Payment gateways and aggregators, payment facilitators, fintechs and e-wallet operators, hosting and managed-IT providers whose infrastructure touches cardholder data, fraud-screening vendors, loyalty platforms — any company whose service can affect the security of someone else’s card data. The category is broader than most Philippine firms assume, and the commercial upside is largest here: validation is a prerequisite for the contracts worth winning.
• The BPO voice-payment scope — the most Philippine of all PCI scopes. Contact centres taking agent-assisted phone payments for US, UK and Australian clients are service providers the moment an agent hears a card number. Agent desktops, softphones, the telephony platform, the recording estate and often the whole delivery floor become candidates for scope. The trap: recordings that capture card verification codes after authorisation are storing sensitive authentication data, which the standard flatly prohibits. The engineering answer — DTMF masking, segmented payment pods, clean-desk floor controls — is well understood, but it must be designed, not improvised after a client’s QSA finds the recordings.

Just as important: who is asking. Four buyers drive Philippine demand, rarely coordinating:

• Your acquirer or payment facilitator, at onboarding and every annual revalidation. Merchant-services teams at Philippine banks enforce the brand programmes with increasing seriousness — the brands hold them accountable for their portfolios.
• The overseas client or headquarters — the most powerful driver we see. PCI DSS obliges every assessed entity to manage its own third parties, so your client’s programme cascades onto you: their QSA wants your AoC, their contract wants your responsibility matrix, their renewal calendar becomes yours. Capability centres in Manila, Cebu and Iloilo inherit the HQ compliance calendar whether or not anyone locally signed up.
• Enterprise procurement. PCI AoCs now sit beside ISO 27001 certificates and SOC 2 reports in the standard Philippine vendor-security checklist, especially in banking, telco, airline and insurance supply chains.
• Regulatory adjacency. BSP-supervised acquirers and payment-system operators embed PCI DSS expectations into merchant and outsourcing agreements, and the NPC expects demonstrable security over payment data under the Data Privacy Act. Neither makes PCI DSS a statute; both make it unavoidable in practice.

If several frameworks are landing at once — PCI from the acquirer, ISO 27001 from procurement, GDPR clauses from an EU client — sequence them deliberately. Our Select the Standard advisory exists for exactly that decision.

What PCI DSS v4.0.1 actually requires

First, scope — the decision that prices everything

Every PCI DSS engagement stands or falls on scoping. The cardholder data environment (CDE) is the people, processes and technology that store, process or transmit cardholder data or sensitive authentication data — plus every system component that connects to the CDE or can affect its security. That second clause catches organisations out: the domain controller authenticating CDE administrators, the monitoring platform, the shared VLAN — all in scope until segmentation demonstrably says otherwise. Scope must be documented and confirmed at least annually — every six months for service providers under v4 — and if scope is wrong, everything downstream is wrong with it.

The twelve requirements

v4.0.1 organises its controls into twelve requirements under six security objectives. In practitioner shorthand:

• 1. Install and maintain network security controls — firewalls or their modern equivalents, with ruleset governance, between the CDE and everything else.
• 2. Apply secure configurations to all system components — hardened builds, no vendor defaults, documented standards.
• 3. Protect stored account data — keep only what you must, render PAN unreadable, never store sensitive authentication data after authorisation, govern the keys.
• 4. Protect cardholder data in transmission — strong cryptography over open, public networks.
• 5. Protect systems and networks from malicious software — anti-malware with teeth, plus the anti-phishing controls v4 added.
• 6. Develop and maintain secure systems and software — patch discipline, secure development, and the v4 payment-page requirements targeting e-skimming.
• 7. Restrict access by business need to know — least privilege, formally reviewed.
• 8. Identify users and authenticate access — unique IDs, twelve-character minimum passwords where passwords are used, multi-factor authentication for effectively every route into the CDE.
• 9. Restrict physical access — controlled entry, media handling, device custody; on a BPO floor, visitor control and clean desks.
• 10. Log and monitor all access — audit trails everywhere, time synchronisation, automated daily review, retained history.
• 11. Test security regularly — quarterly external scans by a PCI SSC Approved Scanning Vendor (ASV), authenticated internal scanning, annual and change-driven penetration testing, segmentation testing, tamper-detection on payment pages.
• 12. Support security with organisational policies and programmes — governance, risk analysis, awareness, incident response, and the third-party machinery (Requirements 12.8 and 12.9) that makes client demands cascade to vendors like you.

Merchant levels and service-provider levels: who decides how you validate

Compliance is universal; validation is tiered. The card brands define the levels and your acquirer assigns and enforces yours — which is why the first document we ask for is the acquirer correspondence, not the network diagram. On the Visa and Mastercard programmes, merchant Level 1 sits above six million transactions a year (American Express draws its line lower) and requires an annual RoC — QSA-led in practice, though the brands also accept a certified Internal Security Assessor (ISA) at merchants large enough to maintain one; Levels 2 to 4 validate by SAQ with quarterly ASV scanning as applicable, though brand rules differ and acquirers can always demand more. A breach can vault any merchant to Level 1 regardless of volume. Service providers have two levels: above roughly 300,000 transactions a year, Level 1 requires a full RoC — also the ticket onto the brand registries enterprise clients check — while smaller providers may use the service-provider SAQ D. Commercial reality outruns the thresholds: many enterprise clients simply demand a RoC from any provider they depend on. Your path is set partly by the brands, partly by your acquirer, partly by your most demanding customer.

SAQ or RoC: the validation paths

The SAQ family under v4.x is deliberately narrow and eligibility is strict. SAQ A covers merchants whose payment functions are fully outsourced to validated providers — the classic redirect or iframe checkout. SAQ A-EP covers e-commerce sites that don’t touch card data but whose systems affect the security of the payment page — an embedded or direct-post checkout, and a far heavier questionnaire. SAQ B and B-IP cover standalone payment terminals (dial-out and IP-connected); SAQ C covers connected payment-application environments; SAQ C-VT covers manual entry through a virtual terminal on an isolated workstation; SAQ P2PE applies when a validated point-to-point encryption solution carries the data; SAQ SPoC, new under v4, covers validated software-based PIN entry on commercial devices. Everyone who fits none of these — including any merchant storing account data electronically — lands in SAQ D; service providers use the dedicated SAQ D for Service Providers. Every path ends in a signed AoC; the RoC path adds an independent assessor examining evidence on site. Choosing the wrong SAQ is the most common self-inflicted wound in Philippine PCI work: a year validating the wrong controls, discovered at the worst moment.

What changed under v4.x — and is now fully in force

Organisations that last looked seriously at PCI DSS under v3.2.1 are looking at a different standard. The formerly future-dated requirements are mandatory as of 31 March 2025, and they are where 2026 assessments concentrate:

• Multi-factor authentication broadened to effectively all access into the CDE;
• Password minimums raised to twelve characters, with tighter account-lifecycle controls;
• Payment-page script management and tamper detection (Requirements 6.4.3 and 11.6.1), aimed at e-skimming attacks on checkout pages;
• Authenticated internal vulnerability scanning;
• Targeted risk analyses that force you to justify the frequency of periodic controls;
• Automated audit-log review and anti-phishing protections;
• Clearly assigned roles and responsibilities per requirement — the governance thread assessors pull first;
• A customized approach option: meeting a requirement’s objective by different means, with documented risk analysis and assessor validation — realistically a RoC-path option, not an SAQ shortcut.

Testing cadence governs calendars: quarterly ASV scans with passing results, internal scans, annual penetration testing — segmentation testing more often for service providers — and re-testing after significant change. Our VAPT practice runs these cycles to the standard’s method requirements, not a generic scan-and-PDF routine.

Version churn is now permanent. The march from v3.2.1 through v4.0 to v4.0.1 stranded organisations that treated their last assessment as the finish line, and the Council will publish again. Keeping validated organisations current as frameworks move is what our Revise™ practice exists to do — the discipline is the same whether the moving standard is ISO or PCI.

How Sterling delivers: the PCI DSS programme on Sterling OS™

Sterling has spent 20+ years building compliance programmes for 8,100+ clients across 60+ countries, and every engagement runs on Sterling OS™ — our four-phase delivery operating system: Design, Drive, Sustain, Automate. For PCI DSS the division of labour is explicit: Sterling runs the full compliance programme — scoping, gap analysis, remediation and evidence — and the formal assessments are performed through PCI SSC-qualified QSA partners. We prepare the environment; a qualified assessor validates it. Nobody marks their own homework.

Design™ — scope first, paperwork later

The Design™ phase begins with data flows, not documents: every channel where card data enters, moves, rests or echoes — web, app, terminal, mail order, and the voice paths BPO operators habitually underestimate. We run data discovery to find the PAN nobody admits to storing, establish your level from the acquirer and client correspondence, and determine the correct validation path against the actual v4.0.1 eligibility criteria. Then the step that decides the economics: scope-reduction engineering. Tokenisation so stored PANs leave your estate; validated P2PE or hosted payment pages so whole channels drop to lighter SAQs; DTMF masking so contact-centre recordings never contain card data; penetration-tested segmentation so the CDE is a fortified room rather than the whole building; responsibility matrices so you inherit provider controls instead of duplicating them. Only then do we run the requirement-by-requirement gap assessment — a gap assessment against an unengineered scope produces an impressive, expensive fiction. The phase ends with a scoped, sequenced, priced remediation plan.

Drive™ — remediation and evidence, run to assessment grade

The Drive™ phase closes the gaps in workstreams: the policy suite mapped to v4.0.1’s structure; technical remediation — MFA coverage, logging, key management, hardening, payment-page controls; ASV scan cycles started early so passing quarters accumulate while remediation proceeds; penetration and segmentation testing coordinated with our VAPT team; and personnel controls, from awareness training to voice-floor discipline. Evidence is built as we go, indexed to the exact SAQ line items or RoC testing procedures the assessor will work through — not assembled in a heroic final fortnight. We do not book an assessment until our own readiness review — run against the same criteria the QSA will use — says you will pass. Then the formal engagement proceeds through our QSA partners — a full Report on Compliance and AoC on the RoC path, or a rigorously evidenced SAQ and AoC — with our team in the room for interviews, walk-throughs and finding resolution.

Sustain™ — because PCI compliance expires quietly

PCI DSS validity decays by calendar: a missed quarterly scan or an unreviewed firewall ruleset can undo an assessment months before anyone notices. The Sustain™ phase installs the compliance calendar — quarterly scans, semi-annual service-provider obligations, annual reviews, training, testing — with named owners. It keeps providers’ AoC dates under watch, triggers scope reviews when the business changes, and turns annual revalidation into a scheduled event rather than an emergency.

Automate™ — evidence without the spreadsheet farm

The Automate™ phase moves evidence collection and control monitoring onto tooling: continuous checks on logging coverage, scan status, access reviews and configuration drift, with dashboards your management and your assessor can both read. Automation pays once for PCI and again across frameworks — most of what a QSA wants is what an ISO 27001 auditor or SOC 2 examiner wants, and collecting it once is a strategy, not an accident.

That leverage is deliberate. PCI DSS rarely arrives alone: acquirers want the AoC, procurement wants ISO 27001, EU clients push GDPR clauses and increasingly ask about ISO 27701 for privacy management. Sterling Trust 360™ runs these as one control plane with one evidence base instead of four parallel bureaucracies. For a fast read on where you stand across the ISO side of that stack, start with our free gap-analysis tool.

Timeline and cost: what actually moves the number

Any consultant quoting a fixed PCI DSS timeline or fee before mapping your data flows is guessing, and you will pay for the guess at remediation time. We quote after scoping, in writing, and stand behind it. What we can tell you honestly in advance is what drives both numbers:

• Scope breadth — channels, sites, systems and people inside the CDE: the master variable every other line item multiplies against.
• Validation path — a guided SAQ and a Level 1 RoC are different undertakings, and assessor effort on the RoC path scales with the scope you bring to it.
• Legacy stored PAN — finding, purging and tokenising historical card data is regularly the largest single remediation workstream, especially in voice-recording estates.
• Segmentation state — a flat network puts everything in scope and prices accordingly; proven segmentation shrinks both remediation and assessment.
• Control maturity against v4.0.1 — MFA coverage, logging depth, key management and payment-page controls are where pre-v4 environments carry the biggest changes.
• Evidence and operating history — assessors validate controls that demonstrably operate: passing quarterly scans, seasoned logs, executed reviews. Control cadence anchors the calendar, which is why we refuse day-count promises and sequence to the earliest defensible assessment date instead.
• Voice-payment complexity — recording remediation, telephony re-engineering and floor controls put contact-centre programmes in their own effort class, offset by how dramatically DTMF masking cuts scope.
• Assessment fees — QSA-partner fees are separate from consulting and scale with scope: a second, independent reason scope engineering pays for itself.

The cheapest PCI DSS programme is a smaller CDE. Scope engineering is where cost is decided; everything afterwards is execution — the argument for talking to us before the acquirer letter becomes urgent, not after.

Common PCI DSS mistakes — the expensive ones we get hired to undo

• Ticking the SAQ. Signing “yes” down the questionnaire without controls behind the answers holds up until a breach — when the signed AoC becomes evidence of misrepresentation rather than compliance. The SAQ is an attestation, not a survey.
• “We don’t store card data, so we’re out of scope.” Storage is one verb of three. Transmitting and processing count, and so do systems that merely affect security. The agent desktop displaying a PAN is in scope; so is the recording platform behind it.
• Validating against the wrong SAQ. The classic: claiming SAQ A on an embedded checkout that meets A-EP criteria, discovered by the client’s QSA after a year of misdirected effort. Gateway architecture decides eligibility, not preference.
• Call recordings holding card verification codes. Storing sensitive authentication data after authorisation is prohibited outright — encryption does not redeem it. Voice estates need engineered answers (DTMF suppression at the platform), not agent folklore about pausing recordings.
• Flat networks. No segmentation means the entire corporate environment is the CDE, and the assessment prices itself accordingly. Segmentation is the highest-leverage technical investment in most environments we scope.
• Assuming the gateway’s compliance covers you. Your provider’s AoC covers their services. You retain your own scope, your own SAQ or RoC, and under Requirement 12.8 a documented split of which requirements they manage and which stay yours.
• Treating compliance as an annual event. A missed quarterly ASV scan or a stale access review quietly invalidates the year. Organisations that find PCI DSS painful are running a project instead of a calendar.
• Buying a “PCI DSS certificate”. No certificate exists in the official scheme — the recognised artefacts are the RoC, AoC and SAQ. Decorative certificates from unqualified vendors do not survive first contact with an acquirer or a client’s QSA.
• Vaulting cards in-house “for convenience”. Storing PAN pulls the full weight of Requirement 3 — cryptography, key management, retention governance — onto your estate. Unless card storage is your business, tokenise with a validated provider and delete the problem.
• Leaving third-party management unmanaged. Requirements 12.8 and 12.9 are how client demands cascade down the chain; providers that cannot produce written responsibility acknowledgements stall enterprise deals at security review.

Why Sterling for PCI DSS in the Philippines

Sterling International Consulting has run compliance and certification programmes for over two decades — 8,100+ clients in 60+ countries — with a Philippine practice built around the sectors PCI DSS presses hardest: BPO and contact centres, fintech and payments, retail, hospitality and travel. Payment-card work is not a sideline bolted onto an ISO practice; it runs on the same delivery system, staffed by consultants who have scoped voice floors in Cebu and tokenisation programmes in BGC.

The official PCI DSS certification consultant — and exactly what that means

Organisations across the Philippines engage Sterling as their official PCI DSS certification consultant: one firm accountable for the outcome, end to end. The mechanism behind that phrase, stated plainly: PCI DSS scoping, remediation, assessment and attestation are delivered with our PCI SSC-qualified QSA partners — from SAQ guidance for smaller merchants to a full Report on Compliance for Level 1 environments. Sterling is not a QSA company and never presents itself as one; QSA status belongs to assessment firms qualified by the PCI Security Standards Council, and no consultancy issues RoCs, AoCs or certificates in its own name. Our role is to run the programme so thoroughly that the QSA assessment becomes a conclusion reached on evidence rather than an ambush survived on luck. Consultant builds, qualified assessor validates — that separation is how the scheme is designed, and it is why this claim survives scrutiny that folds lesser ones.

Our first-time-pass record rests on mechanism, not adjectives: readiness reviews run against the same testing procedures the assessor will use, evidence indexed to RoC and SAQ line items before assessment dates are booked, scan cycles started early enough to accumulate passing quarters, remediation verified rather than reported. The same discipline extends across the trust stack — ISO 27001, SOC 2, GDPR, privacy management — so controls are built once and reused everywhere a buyer asks. And because claims should be checkable, we publish what clients say on our client feedback wall.

PCI DSS rewards organisations that respect its mechanics and punishes those who shortcut them. If card payments matter to your revenue, the programme deserves an operator, not an improviser. That is the job we do.

Frequently asked questions about PCI DSS compliance in the Philippines

Is PCI DSS mandatory in the Philippines?

Not by statute — no Philippine law names PCI DSS. It is mandatory by contract: the card brands require it of acquirers, acquirers write it into every merchant agreement, and clients write it into service contracts. Refusing it means not accepting card payments — “voluntary” is the wrong mental model. Separately, the Data Privacy Act obliges you to secure card data as personal data — a parallel obligation, not a substitute.

What is the current version of PCI DSS in 2026?

PCI DSS v4.0.1, published in June 2024 — the only active version since v4.0 retired on 31 December 2024. The future-dated v4 requirements became mandatory on 31 March 2025, so 2026 assessments test the complete standard, including MFA expansion, payment-page script controls and authenticated internal scanning. v4.0.1 changed no requirements versus v4.0; it corrected and clarified.

Is there such a thing as a PCI DSS certificate?

Not in the official scheme. The recognised artefacts are the Report on Compliance (RoC) for assessor-led validations, the Self-Assessment Questionnaire (SAQ) for self-assessed paths, and the Attestation of Compliance (AoC) summarising either. Acquirers and clients ask for the AoC — never a certificate. Decorative certificates handed out as marketing carry no standing with the card brands. Sterling issues no certificates or reports in its own name: the deliverables that matter are produced through the formal QSA or SAQ process.

Do we need a QSA, or can we self-assess?

It depends on your level, which your acquirer assigns under card-brand rules. Level 1 merchants and Level 1 service providers need an annual RoC — QSA-led in almost every Philippine case, though the brands accept a certified Internal Security Assessor (ISA) at large merchants that maintain one; lower levels usually validate by SAQ. Two forces override the thresholds: acquirers can demand more than the minimum, and enterprise clients frequently require a RoC regardless of volume. We establish the required path from your acquirer and client correspondence first, then deliver it — SAQ or RoC — with the formal assessment through our PCI SSC-qualified QSA partners.

Which SAQ applies to our e-commerce store?

It turns on how the payment page is delivered. A full redirect or compliant iframe to a validated provider typically qualifies for SAQ A. If your site affects how card data is captured — an embedded form or direct-post integration — you are looking at the substantially heavier SAQ A-EP. Store account data electronically and you are in SAQ D. Gateway architecture decides the answer under v4.0.1’s strict criteria, so we verify eligibility technically before anyone starts answering questions — the wrong SAQ wastes a compliance year.

Our contact centre takes card payments by phone for a US client. Are we in scope?

Yes — as a service provider, from the first call. Agent desktops, softphones, the telephony platform and call recordings enter scope, and recordings must never retain card verification codes after authorisation — prohibited storage of sensitive authentication data, even encrypted. The engineered answer: DTMF masking so card digits never reach agents or recordings, segmented payment pods, floor controls. Expect your client to require an annual AoC and their assessors to question you directly — their PCI obligations cascade to you by design.

How long does PCI DSS compliance take?

Honestly: it depends on scope, and we will not pretend otherwise with a day-count. The calendar is governed by mechanics — CDE breadth, remediation depth against v4.0.1, and the fact that assessors validate controls with operating history, such as passing quarterly scan cycles and seasoned logs. Scope reduction shortens everything, which is why it comes first in Design™. We sequence each programme to the earliest assessment date the evidence will defensibly support, and put that plan in writing after scoping.

How much does PCI DSS compliance cost in the Philippines?

We publish drivers, not figures, because honest figures do not exist before scoping. Cost moves with the size of the cardholder data environment, the validation path (SAQ versus RoC), legacy stored card data, segmentation state, control maturity against v4.0.1, and voice-payment complexity. QSA assessment fees are separate and scale with scope. The dominant lever is scope-reduction engineering — tokenisation, validated channels, segmentation — which is why we engineer scope before quoting, then quote in writing.

We hold ISO 27001. Are we already PCI DSS compliant?

No. ISO 27001 certifies a risk-based management system you shape; PCI DSS prescribes specific technical controls for card data and tests them as written — twelve-character passwords, quarterly ASV scans, payment-page tamper detection. The overlap is real — access control, logging, vulnerability management, governance — so an existing 27001 programme cuts meaningful effort from PCI remediation. Running both on one control plane is exactly what Sterling Trust 360™ is built to deliver.

What actually happens if we ignore PCI DSS?

Through the payments system, in escalating order: recurring non-compliance assessments passed down by your acquirer; demands for accelerated validation, possibly at a higher level; and after a suspected breach, a mandated forensic investigation at your cost, brand assessments for fraud and reissuance losses, and potential termination of the merchant facility — industry-visible and hard to recover from. Service providers rarely reach termination; they simply stop winning renewals when AoC dates lapse. None of it requires a regulator to act — which is why it is dependable.

Our payment gateway is PCI compliant. Doesn’t that cover us?

It covers them. A provider’s AoC covers the services they deliver; you inherit those controls only for functions genuinely outsourced. You keep your own scope — however reduced — your own validation obligation, and under Requirement 12.8 a documented matrix of which requirements each provider manages versus which remain yours. Well-chosen validated providers are the best scope-reduction tool available; treating their compliance as a blanket over your whole business is a mistake we often unwind.

Is Sterling a QSA company?

No — and no consultancy should blur that line. QSA status is held by assessment firms qualified by the PCI Security Standards Council, and independence between builder and assessor is a feature of the scheme, not a gap in our offering. Sterling runs the complete programme — scoping, scope-reduction engineering, gap analysis, remediation, evidence, readiness — with formal assessments performed through our PCI SSC-qualified QSA partners, from SAQ oversight to full Level 1 RoCs. One accountable programme partner; one independent, brand-recognised validation.

Is training included with Sterling’s PCI DSS consulting?

Every Sterling engagement includes live training for your implementation team and preferential access to Sterling Academy, with complimentary security awareness training for your people for your people as part of the engagement. Special pricing applies to the wider catalogue — 93 Annex A Controls (ISO/IEC 27002:2022), Risk Management and Nonconformity Management — through your Sterling consultant. Learners who complete a course and its final exam receive a numbered Certificate of Completion, verifiable online, and the completion records serve as evidence for PCI DSS Requirement 12.6.

Last updated: July 2026 · Reviewed by Ann Reyes, Lead Auditor (Davao), Sterling International Consulting.