Free guide · PCI DSS v4.0.1

PCI DSS vs SOC 2 — what each one is for

PCI DSS is a prescriptive payment-security standard mandated by the payment brands for anyone handling card data; SOC 2 is an attestation performed by a CPA firm against the AICPA Trust Services Criteria, with controls the organisation itself defines. They overlap in evidence but not in authority — a SOC 2 report does not demonstrate PCI DSS compliance, and vice versa.

Find your SAQ All guides

Who requires them

PCI DSS: required by the payment brands and enforced through your acquirer whenever account data is stored, processed or transmitted.

SOC 2: not legally or contractually universal — usually requested by enterprise customers during vendor due diligence.

PCI DSS applies to a defined cardholder data environment; SOC 2 applies to a service organisation's chosen system boundary.

How they are assessed

PCI DSS: pass or fail against explicit requirements, validated through an SAQ or a QSA-led Report on Compliance.

SOC 2: an opinion issued by a licensed CPA firm; Type I tests design at a point in time, Type II tests operating effectiveness over a period.

PCI DSS tells you what the control must be; SOC 2 tests the controls you said you had.

Where they overlap

Access control, least privilege, MFA, logging and monitoring, vulnerability management, change management and incident response.

Evidence collected for one can often be reused for the other, provided the scope boundaries line up.

Vendor management maps closely: PCI DSS Requirement 12.8 and the SOC 2 subservice organisation treatment ask similar questions.

Where they do not

PCI DSS bans storage of sensitive authentication data after authorisation; SOC 2 has no equivalent prescriptive rule.

PCI DSS mandates quarterly ASV scanning and specific penetration testing; SOC 2 leaves testing frequency to the organisation.

PCI DSS scope is driven by account-data flows; SOC 2 scope is chosen by the service organisation.

Turn the reading into an answer

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Written by Haumaru Whānau QSAs. PCI DSS content paraphrased from PCI DSS v4.0.1 and PCI SSC published guidance; payment brand programmes are set by the brands and your acquirer. Independent summary; not endorsed by PCI SSC.