This piece is written for PCI consultancies and payment security specialists, not for merchants working on compliance. It is not compliance advice. It maps the questions merchants typically have about PCI DSS, distinguishes the roles of different PCI professionals, and translates both into content decisions.
Uncertainty is the starting point
Most merchants do not begin by looking for a PCI consultant. They begin confused: a payment provider mentions an annual questionnaire, an acquirer asks for an attestation, or the business changes how it takes payments and nobody knows what that means for compliance.
That confusion is structural. The PCI Security Standards Council publishes the standard and supporting documents, but, as the Council itself states, it does not define compliance requirements for individual organizations or set their validation responsibilities. Card brands, acquirers and payment facilitators do. Merchants therefore hear about obligations from several directions, in inconsistent terms.
The questions merchants actually have
Merchant questions tend to fall into a few groups:
- Scope. Which systems, people and processes handle cardholder data, and how outsourcing payments to a provider changes that.
- Validation. Which self-assessment questionnaire applies, whether an on-site assessment is needed, and who decides.
- Changes. What changed with PCI DSS v4.x, and what the updates mean for their setup.
- Gaps. What they are missing and how to fix it without rebuilding everything.
- Help. Whether they need outside expertise, and which kind.
Version 4 created a wave of specific questions
PCI DSS v4.x introduced requirements that were future-dated and became effective on 31 March 2025. Among them were requirements covering scripts on payment pages and detection of unauthorized changes to those pages, aimed at attacks that skim card data in the browser.
In January 2025, the Council announced changes for merchants validating with SAQ A: those payment-page requirements were removed from that questionnaire, and a new eligibility criterion was added requiring merchants to confirm their site is not susceptible to script attacks that could affect their e-commerce systems. Merchants who cannot meet the criterion may no longer qualify for that questionnaire.
Changes like this generate precise, high-intent questions from merchants who thought their compliance was settled.
Different merchants, different obligations
This is why the scope and validation questions above rarely have one answer: obligations differ significantly between merchants. A retailer using a fully hosted payment page, one embedding a provider's payment fields, one processing cards through its own systems and one with physical stores and payment terminals have very different scopes and validation paths. Validation expectations also vary with transaction volumes and the requirements of acquirers and card brands.
Which kind of PCI professional does the merchant need?
Merchants often do not know that PCI work involves distinct roles, and search results rarely explain the difference: broadly, an assessor validates compliance, a scanner tests externally, and an adviser helps prepare for either without necessarily being either one.
- Qualified Security Assessors (QSAs) are firms and individuals qualified by the Council to perform PCI DSS assessments.
- Approved Scanning Vendors (ASVs) are qualified to perform the external vulnerability scans that many merchants need.
- Internal Security Assessors (ISAs) are employees of an organization trained to perform internal assessments.
- Advisory consultancies help with scoping, gap analysis, remediation and readiness, and may or may not also hold assessor status.
Independence matters here: organizations often want to separate the advice that shapes their environment from the assessment that validates it, and assessors have their own rules on this.
Translating merchant questions into search and content decisions
The query types below are hypotheses to validate, not measured demand.
| Merchant question | Search to test | Page that serves it |
|---|---|---|
| Scope | Situation-led: PCI scope with a hosted payment page, does using Stripe make me PCI compliant | Scoping guide organized by payment setup, linked to scoping services |
| Validation | Which SAQ applies to my business, when is a QSA assessment required | Validation explainer with a clear route to advice |
| v4.x changes | Change-led: SAQ A eligibility criteria script attacks, PCI DSS 4.0.1 payment page requirements | Dated explainers citing PCI SSC sources |
| Gaps | Remediation-led: PCI gap assessment, fixing failed PCI requirements | Gap assessment and remediation service pages |
Accuracy is the competitive advantage in this segment. Payment security content is heavily produced and often wrong. A consultancy whose explanations are precise, dated and sourced earns trust from merchants and gives AI assistants reliable material to draw on.
Limits of this analysis
This article is not compliance advice. PCI DSS applicability and validation requirements depend on the merchant's setup and on requirements set by card brands, acquirers and other compliance enforcing entities. Always verify with primary PCI SSC sources and the relevant payment partners.
Standard and questionnaire references are current as of September 2026 and may be revised.
The query types are hypotheses. Validate them with merchant enquiries you receive and your Search Console data.
Common questions
Who actually sets PCI DSS validation requirements?
The PCI SSC publishes the standard itself but does not set individual validation requirements; card brands and acquirers do, which is a common source of merchant confusion.
What kinds of questions do merchants have about PCI compliance?
They split into scope, validation type, what changed in v4.x, gaps in their current setup, and which kind of help they actually need.
What changed with the January 2025 SAQ A update?
It replaced specific payment-page requirements with a new eligibility criterion about script attacks, which created precise, high-intent questions merchants are now searching.
What is the difference between a QSA, an ASV, an ISA and an advisory consultancy?
QSAs and ASVs are qualified by the PCI Council to perform assessments and scans, ISAs are trained employees who assess internally, and advisory consultancies help with scoping and remediation and may or may not also hold assessor status.
Accurate, sourced content that AI assistants can rely on is part of AI search optimization.
Kryston publications
Analysis for cybersecurity service firms on search, AI visibility and buyer trust.
