We take in-store POS and online payments — what does PCI DSS 4.0 require from us?

When taking payments online, does the customer enter their card details directly into a form on your site, or are they redirected to the bank's 3D Secure hosted payment page? That distinction completely changes which document you need to fill out.

Requirements 6.4.3 and 11.6.1 in PCI DSS 4.0 directly target script security on e-commerce sites. Malicious scripts injected into a payment page can harvest card details in the background. You're required to justify and document every single external script running on checkout pages.

We got that exact same email two months ago. We process about 40,000 transactions a year. A consulting firm quoted us 35,000 TL. We sat down and spoke directly with the bank, and because we use a redirect payment flow, they clarified that just filling out the SAQ-A form was sufficient. We knocked it out internally in 3 days, submitted it, and it was approved.

no reason to panic if you don't store card numbers in your db but banks blast these emails to everyone automatically for compliance fill out the form properly and send it back and you're done.

Correction: I misremembered the figure, it was a bit lower.

Bank info-sec departments tend to treat every mom-and-pop shop like an e-commerce giant and fire off generic templates. Don't rush out to spend thousands of liras on audits right away; first get written confirmation from your bank rep on whether SAQ-A is enough.

While filling out the form, you might get stuck especially on these 3 points: 1) Complexity and regular rotation of server and admin panel passwords, 2) Having two-factor authentication enabled for admin panel logins, 3) A serial number tracking list for physical POS devices.

First thing tomorrow, put the serial numbers on the bottom of the POS devices at your physical branches into a spreadsheet. Create a simple checklist where you inspect them weekly and sign off that 'no physical tampering' occurred; that directly checks off the audit question.

Don't let it intimidate you; even though PCI DSS 4.0 looks super complicated at first, the self-assessment guides prepared for small businesses are pretty clear. If you download the SAQ-A document from the official site, translate it to Turkish, and go step by step, you can finish it in half a day.

ill argue the opposite dont get mad. i mean forgotten test environments are more oftten the entry point than live systems.

if you have quesions write them; I'll answer as best I can.

Generally correct, but one part is missing. If it's your first time, start small; scaling comes later.

When we decide without measuring, we always end up in the same place. Just leaving this note, it might be useful.

I'll argue the opposite, don't get mad. The real issue isn't the number, but what it's based on.

This is my opinion, I'm not claiming it's absolute truth.

The most overlooked point about PCI DSS 4.0 requirements is this: The answer varies greatly by industry; there is no one-size-fits-all rule.

Correct me if I'm wrong.

Same here.

Let me summarize the topic, since several different answers were given. The biggest time-waster for us was not knowing who had the final say.

I'm also curious if anyone does it differently.

I'm a small business let me explain from my side. Any unwritten clause becomes a point of disagreement later as both sides remember it differently.

Correct me if I'm wrong.

Let me share my experience. Forgotten test environments are more often the entry point than live systems.

Proven by experience.

I was thinking the same thing. If you get three different answers on a topic, the question was asked wrong.

Thanks for writing this, that's the right way. Just because everyone does it doesn't mean it's right.

If it's your first time, start small; scaling comes later. Of course, it varies if your situation is different.