PCI DSS compliance help for small Canadian merchants

PCI DSS in Canada: what it is and who it applies to

PCI DSS is the Payment Card Industry Data Security Standard, a baseline of technical and operational requirements for any business that stores, processes or transmits cardholder data, or that can affect the security of that data.² The PCI Security Standards Council writes it, so a café in Ottawa and an online store in Gatineau answer to the same document.

The obligation reaches a merchant through the card brands and the acquirer. The Council publishes the standard and the questionnaires, while the individual payment brands decide whether a small merchant has to validate compliance, and the Council tells merchants to ask their acquirer, the bank or processor that settles their card sales, or the brand itself.³ The Canadian Centre for Cyber Security makes the same point for small organizations: its baseline controls ask that point-of-sale systems sit behind a firewall, apart from the internet and the office network, and that organizations consider following PCI DSS.¹⁸

Which PCI SAQ applies to your business

The PCI DSS SAQ that applies to you depends on one thing: the path a card number takes from the customer to the processor. Each self-assessment questionnaire covers only the requirements that fit one kind of payment setup, and the Council asks merchants to confirm eligibility with their acquirer, the payment brand or another compliance entity before they start.⁹⁵

A business with a counter terminal and an online store can end up with two questionnaires or one larger one. The table shows the usual starting point; your acquirer has the final word.

What changed in PCI DSS 4.0 and 4.0.1 for small merchants

The big change came with PCI DSS 4.0: of its 64 new requirements, 51 were future-dated and became effective on 31 March 2025, so a questionnaire filled in today reflects the full v4.x standard.⁴ Version 4.0.1, published in June 2024, corrected and clarified wording and added no requirements.¹

Online merchants felt the change most. The Council's 2024 guidance named quarterly ASV scans for SAQ A e-commerce merchants among the new requirements, along with an annual scope confirmation under requirement 12.5.2.⁴ In January 2025 the Council took two payment-page script requirements, 6.4.3 and 11.6.1, and the supporting risk analysis 12.3.1 out of SAQ A, and added an eligibility criterion in their place: the merchant confirms its site is not susceptible to attacks from scripts that could affect its e-commerce systems.⁶

The Council's FAQ 1588 explains how that confirmation works. It applies to pages that embed a provider's payment form, such as an iframe, and leaves out pages that redirect customers to the provider. The merchant confirms either through script-protection techniques, deployed by itself or a third party, or with written confirmation from its PCI DSS compliant provider that the embedded form, set up as instructed, protects the page.⁷ The underlying requirements stay in PCI DSS itself.⁶

Do you need a quarterly ASV scan?

You need a quarterly ASV scan when your questionnaire includes requirement 11.3.2, which asks for evidence of passing external scans performed by an Approved Scanning Vendor at least once every three months.¹⁵ For an SAQ A merchant, the Council limits those scans to the e-commerce system that hosts the web page redirecting to, or embedding, the provider's payment form.¹⁵ Your acquirer confirms which questionnaire, and therefore which scans, apply.

An ASV is an organization whose scanning solution PCI SSC has tested and approved before listing it, and which is re-approved every year; the Council's listing confirms the qualification and states that the Council does not endorse the vendor.¹⁶ We are not an ASV. When an ASV scan is needed, you sign with a listed vendor, we help set the targets, read the report with you and fix what fails, and the vendor rescans until the result passes. Our own vulnerability scanning is useful between quarters, and it never replaces the ASV report your acquirer asks for.

Who does what: merchant, acquirer, ASV, QSA and itopsi

Each party in PCI compliance has a fixed role, and the merchant is the one who signs. Qualified Security Assessor companies are independent security organizations qualified by the PCI Security Standards Council to validate an entity's adherence to PCI DSS.¹⁷ Whether a small merchant may self-assess or needs a QSA is set by the payment brands and passed on by the acquirer.³

How a payment provider changes your PCI scope

A good payment provider shrinks your PCI scope; the duty to validate stays with your business. When a hosted checkout or an embedded payment form takes the card number, your systems never hold it, and the questionnaire can be the short SAQ A. The website that sends customers to that form is still in scope, which is why the script criterion and the ASV scan apply to it.⁷¹⁵

At the counter, a validated point-to-point encryption terminal keeps clear card numbers off your computers and leads to SAQ P2PE, while an internet-connected point-of-sale system leads to SAQ C.¹⁴¹³ Changing the setup is often the simplest fix, so we look at it first.

What we do for PCI DSS compliance

Our PCI work prepares and fixes; the questionnaire and its signature remain yours. It starts with a 30-minute conversation and a scope letter that names the card channels, the systems and the dates.

What you have in hand when the work is done

You keep a plain-language record of your card setup and the evidence behind it. The report belongs to your business.

• A diagram of how card data reaches the processor, channel by channel
• A recommended SAQ for each channel, with the reasons and the questions for your acquirer
• The settings we changed, with a before-and-after report
• A folder of material for your SAQ and AOC, which your business completes and signs
• The ASV scan results and the record of what was fixed, when a scan applies