E-Commerce PCI Compliance Benchmark

Most e-commerce merchants qualify for SAQ-A (48%) if they fully outsource payment processing to a PCI-compliant provider and only use iframes or redirects. Those who host their own payment pages or have custom JavaScript on checkout pages typically require SAQ-A-EP or higher.

PCI DSS v4.0 Requirement 6.4.3 introduced mandatory controls to authorise, monitor, and maintain an inventory of all payment page scripts. This was the top bottleneck for e-commerce merchants, affecting 74% of surveyed organisations and requiring significant engineering effort to implement.

Third-party checkout providers (Stripe, Braintree, Shopify Payments, etc.) can dramatically reduce PCI scope for e-commerce merchants. However, any custom JavaScript on the checkout page, cart functionality that stores session data, or post-order processing that touches card data can expand scope back to SAQ-A-EP or SAQ-D.

Approved Scanning Vendor (ASV) quarterly external vulnerability scans are required for all SAQ-A-EP, SAQ-C-VT, and SAQ-D merchants. E-commerce merchants often struggle with ASV scan remediation due to third-party components, CDN-delivered scripts, and dynamically loaded checkout widgets introducing vulnerabilities outside their direct control.