// Free PCI DSS checklist
Free PCI DSS self-assessment for small businesses
Seventeen questions on card-handling basics for businesses that take payments in person, online, or over the phone. About five minutes, with a scored report and suggested fixes sent by email.
If your business accepts credit or debit cards, your payment processor expects you to follow PCI DSS, the security standard set by the card brands. For most small businesses that means an annual Self-Assessment Questionnaire and, often, quarterly external scans. This checklist shows where you stand before you fill it in.
What the checklist covers
- Scope and card data. Every way you accept cards is written down, no full card numbers on paper or in files, no security codes, PINs, or magnetic-stripe data kept after payment, and the right SAQ completed in the last 12 months.
- Network and systems. Payment devices on their own network, nothing like remote management exposed to the internet, and vendor default passwords changed on every device.
- Access control. Individual logins on payment systems, MFA on remote and admin access, and same-day removal when someone leaves.
- Protecting card data. Card numbers never sent by email, text, or chat, managed antivirus on in-scope systems, patched payment systems with no end-of-life software, and terminals checked for tampering and skimmers.
- Vendors. Written agreements where your service providers accept their share of PCI responsibility.
- Policy, training, and response. Staff trained on card handling and skimming at hire and every year, and an incident plan that covers a suspected card breach.
Where to look first
Scope. The fewer systems that touch card data, the less there is to secure and document. Putting payment devices on their own network is usually the single biggest win, and it’s something we do routinely as part of network work for small businesses.
After the checklist
Your report shows your score and a suggested fix for every gap. If you’d like help, see how we handle PCI DSS in our compliance programs. Serving customers in Europe or Brazil too? The GDPR and LGPD checklists cover their data protection laws.
This is a self-assessment based only on your answers. Logos Tech Systems doesn’t conduct or verify it, and doesn’t endorse the report unless we’ve reviewed it with you in a consultation.
// Questions
Common questions
Is this the same as my Self-Assessment Questionnaire (SAQ)?
No. Your SAQ is the official form from the PCI Security Standards Council that your payment processor asks for. This checklist is a quick readiness check that shows where you're likely to struggle before you fill it in.
Our payment processor handles everything. Does PCI DSS still apply?
Yes, though often in a smaller way. Even with a hosted payment page or a processor's terminal, you're responsible for how cards are accepted, who has access, and the devices on your network.
Do you certify PCI compliance?
No. Small merchants self-assess with an SAQ; larger ones are assessed by a Qualified Security Assessor. We do the technical work and help you answer accurately.
// Next step
Is your SAQ coming due?
We shrink your PCI scope, secure the systems that stay in it, and help you answer your Self-Assessment Questionnaire accurately.