PCI DSS 4.0 (Engineering Checklist)

PCI DSS is the data security standard for payment card data. The single best PCI strategy is scope reduction: hand cardholder data to a PCI-compliant processor and never touch it. This skill is the playbook to do that — and the controls you still own.

When to use

• Building or auditing payment integration.
• Customer / acquirer asks for SAQ (Self-Assessment Questionnaire).
• Considering whether to use Stripe Elements / Razorpay Checkout vs. a custom card form.
• Sales-driven "are you PCI compliant?" question.

When NOT to use

• You don't accept card payments at all — not in scope.
• High-volume merchant (Level 1: > 6M transactions/year) — engage a QSA (Qualified Security Assessor); this skill is too high-level.
• Issuing cards / processor / gateway roles — entirely different scope.

Scope reduction is the only sane strategy