After Passing an ASV Scan: What Happens Next?
After passing an ASV scan, here's what to submit, how long results last, and how to set up your next quarterly compliance cycle without gaps.
PCI compliance for e-commerce isn’t optional, and it doesn’t scale down for small stores. If you accept credit or debit cards online, the Payment Card Industry Data Security Standard (PCI DSS) applies to you today, not once you hit a certain revenue threshold. The standard is set by the major card brands (Visa, Mastercard, American Express, Discover, JCB) and enforced through your acquiring bank or payment processor, which means non-compliance shows up as real business risk, not an abstract audit checkbox.
What actually trips up most online retailers isn’t the concept of PCI compliance; it’s figuring out which specific requirements apply to their setup. A Shopify store on Shopify Payments carries a very different compliance burden than a custom-built checkout that touches its own servers. This guide walks through the parts of PCI DSS for online stores that hold true no matter what platform you run, so you know exactly where you stand before diving into platform-specific steps.
PCI DSS: PCI DSS (Payment Card Industry Data Security Standard) is the security framework that all merchants, processors, and service providers must meet to handle cardholder data.
SAQ (Self-Assessment Questionnaire): The annual compliance validation form. Which version you use depends on how your checkout is architected.
ASV (Approved Scanning Vendor): A company certified by the PCI Security Standards Council to run the external vulnerability scans required under most SAQ types. You can read more in our breakdown of what an ASV scan actually checks.
Cardholder Data Environment (CDE): Any system, network segment, or process that stores, processes, or transmits card data.
Merchant Level: A classification (1–4) based on annual transaction volume that determines how you validate compliance, self-assessment versus a formal audit.
PCI compliance for e-commerce means meeting PCI DSS requirements for any online store that accepts card payments; there is no size or revenue exemption, only differences in how you validate it.
Many people think PCI DSS is something only large retailers need to worry about. In practice, your merchant level (based on annual card transaction volume) only changes how you prove compliance via self-assessment or a formal Qualified Security Assessor (QSA) audit, not whether you need to comply. Even a Level 4 merchant processing a few hundred transactions a month is contractually obligated by their payment processor to maintain PCI compliance. For a deeper look at where the SAQ and QSA paths diverge, see our comparison of an ASV scan versus a QSA assessment.
Get a free assessment of your e-commerce checkout architecture and find out your exact SAQ type in minutes.
Your SAQ type depends on how much of the checkout flow runs through your own servers; fully outsourced checkouts usually qualify for SAQ A, while checkouts that touch your own code need SAQ A-EP or SAQ D.
Choosing the right SAQ for e-commerce is the single decision that determines your entire compliance workload:
If you’re unsure which applies, your acquirer or ASV can confirm it based on how your checkout is built; this is a common step we walk merchants through directly.
Every online store, regardless of SAQ type, should never store sensitive authentication data, use a compliant payment processor, patch software regularly, scan quarterly where required, and submit its SAQ annually.
A working e-commerce PCI compliance checklist looks like this:
Your e-commerce platform determines how you meet PCI requirements, not whether they apply; hosted checkout platforms generally simplify compliance, while custom builds carry more of the burden themselves.
PCI DSS for online stores plays out differently depending on your tech stack:
Confirm your scan requirement based on your platform and payment setup before your next compliance deadline.
Look for an ASV that's certified by the PCI Security Standards Council, understands e-commerce-specific architecture, and can work around your scanning windows without disrupting checkout uptime.
Keeping a PCI compliant online store long-term means treating quarterly scanning as an operational habit, not a one-off task. Not every ASV is built for e-commerce specifically; cart integrations, CDN configurations, and peak-traffic scan timing all matter. Our guide on how to choose an ASV vendor covers the questions worth asking before you commit to one.
Beyond SAQ submission and scanning, retailers often overlook maintaining an asset inventory of anything touching card data and reviewing third-party plugin access regularly.
Some of the most commonly missed PCI compliance requirements for online retailers:
PCI compliance for e-commerce follows the same logic no matter what you sell or what platform you’re on: identify your SAQ type based on how your checkout is architected, meet the baseline security requirements, scan quarterly if required, and revalidate every year. Get the SAQ type right first; nearly everything else about your compliance workload follows from that one decision.
Run your first PCI ASV scan with a vendor that understands e-commerce checkout architecture.
Not a federal law in most jurisdictions; it's a contractual requirement enforced through your payment processor or acquiring bank.
No. SAQ types requiring external scanning must use a PCI SSC-certified Approved Scanning Vendor; self-scans don't satisfy the requirement.
Often the marketplace absorbs most of the compliance burden since it owns the payment flow, but you should confirm this directly with the marketplace's merchant terms.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.