PCI DSS is the Payment Card Industry Data Security Standard: a set of controls for any business that accepts card payments through terminals, e-commerce, mobile, phone, or other channels. For a U.S. specialty retailer, that covers nearly every register and web checkout.
This article explains how Level 4 works, which requirements commonly apply, how validation is determined, and what to do next.
Key Takeaways
- Level 4 is a validation category, not a lighter PCI DSS or an exemption.
- Your SAQ, AOC, scan duties, and deadlines depend on your payment setup and acquirer instructions.
- Inventory every payment channel, stop storing card data, secure POS access, and keep evidence.
- A well-configured processor and POS can reduce scope, but you remain responsible for validation.
What PCI Level 4 Means
Merchant levels generally follow annual card-transaction volume, and each brand sets its own thresholds. Confirm your level with your acquirer rather than relying on a generic chart.
Brand thresholds differ:
- Visa and Mastercard: Level 4 is typically the catch-all below the e-commerce and overall transaction bands
- Amex: four tiers, with Level 4 at fewer than 10,000 Amex transactions
- Discover: three tiers
Who Decides What
PCI SSC publishes the PCI DSS framework. Payment brands and acquirers define validation programs, classifications, forms, and submission requirements. PCI SSC doesn't collect merchant reports or issue fines.
Level Is Not Risk
A small retailer can still expose payment pages, terminals, remote-access tools, stored account data, or third-party integrations. Attackers don't check your tier first.
Compared With Higher Levels
Top-tier merchants typically need a formal Report on Compliance from a QSA. Level 4 validation usually involves an eligible Self-Assessment Questionnaire (SAQ). A brand or acquirer can still require more assurance after a compromise, a risk designation, or an unusual payment environment. Discover, for instance, may require higher-level validation after an actual or suspected compromise.
PCI Level 4 Requirements Under PCI DSS
PCI DSS v4.0.1 was published in June 2024, and its future-dated requirements became mandatory on March 31, 2025. It has 12 high-level requirements. Which controls apply depends on your cardholder data environment, payment channels, SAQ, and documented eligibility.
Networks, Defaults, and Stored Data
- Install and maintain network security controls on routers and firewalls (Requirement 1)
- Change vendor default passwords and remove unused default accounts (2.2.2)
- Don't keep sensitive authentication data, such as card verification codes, after authorization, even encrypted (3.3.1)
- Render any stored card number unreadable and delete expired data (3.2.1, 3.5.1)
- Use strong cryptography when card data crosses public networks (Requirement 4)
In a shop, that means checking terminals, receipts, backups, and email inboxes where card numbers might linger.
Secure Systems
Requirements 5 and 6 cover malware protection and secure software. In practice:
- Run supported operating systems and POS software
- Patch promptly
- Review plug-ins on your web store
- Control how support vendors reach your systems remotely
Access and Physical Security
- Give every user a unique ID (8.2.1)
- Use passwords of at least 12 characters where supported (8.3.6)
- Require MFA for administrative and remote access into the card environment (8.4.1 to 8.4.3)
- Limit access to what each role needs
- Lock down terminals and paper records
- Remove former employees immediately
- Never share administrator logins
Monitoring, Testing, and Policies
Requirements 10 through 12 cover logging, regular testing, and written policies. Where relevant, that includes:
- Script monitoring on payment pages (6.4.3 and 11.6.1)
- Staff training on security procedures
- A tested incident response plan with defined roles, brand and acquirer contacts, and an annual test (12.10)
How Level 4 Merchants Validate Compliance
Pick your SAQ from the eligibility statements and your actual payment setup. Don't choose the shortest form, and don't trust a processor's marketing description.
Common SAQ Paths
| Environment | Possible SAQ |
|---|---|
| Fully outsourced e-commerce | A |
| Imprint machines or dial-out terminals | B |
| Standalone IP-connected PTS terminals | B-IP |
| Manually keyed virtual terminal | C-VT |
| Validated P2PE solution only | P2PE |
| Handles or stores account data | D for Merchants |
Treat this as orientation, not a prescription. Have someone review your architecture before choosing. If you run separate channels, you may be able to use separate SAQs when segmentation isolates them.
SAQ, AOC, and Scans
- The SAQ is your self-assessment.
- The Attestation of Compliance (AOC) declares your results and carries an executive signature. It isn't a vendor-issued certificate.
- ASV scans are external vulnerability scans from a PCI SSC-qualified provider, required at least quarterly where they apply. PCI SSC's ASV guide includes them in SAQs A, A-EP, B-IP, C, and D.
Scan and AOC duties aren't identical for every Level 4 merchant. Even where an SAQ omits scans, your acquirer may still ask for them. Submit the SAQ, AOC, and other requested evidence to whoever requires it.
PCI Level 4 Next Steps: A Practical Compliance Plan
1. Start With Your Acquirer or Processor
Confirm these details in writing:
- Assigned merchant level
- Accepted SAQ type
- Required forms and scan obligations
- Due dates and submission portal
- Any brand-specific rules
2. Map Every Payment Flow
List all the places card data can enter:
- In-store terminals
- E-commerce and mobile devices
- Phone orders
- Refunds and recurring payments
- Fallback procedures
- Remote support and third-party providers
3. Shrink Your Scope
Don't store card data. Purge it from email, paper, spreadsheets, logs, recordings, and backups. Email isn't banned outright, but sending or receiving card numbers pulls that channel into scope.
Consider validated P2PE, tokenization, or hosted checkout. PCI-listed P2PE can reduce applicable requirements, though it doesn't eliminate PCI DSS. Tokenization allows later refunds without keeping real card details.
4. Secure and Maintain
- Change default credentials and assign unique accounts
- Enable MFA where it applies
- Keep payment devices off the guest Wi-Fi
- Restrict remote access
- Patch supported systems
- Inspect terminals for broken seals, changed cabling, or unfamiliar attachments
- Stop using any device you suspect was tampered with
5. Validate and Document
Complete the SAQ honestly and fix gaps. Keep an evidence folder with:
- Document owners and dates
- Policies and device records
- Access reviews and training records
- AOCs and scan results
- Incident-response tests
Choosing and Maintaining a PCI-Aware POS Environment
A POS system doesn't make you compliant. Security depends on the payment integration, terminal configuration, provider responsibilities, network, user access, software updates, and your own habits. PCI SSC says merchants retain responsibility even when all processing is outsourced.
Questions to Ask Before You Buy
- Does it avoid storing sensitive authentication data?
- Does it support tokenization or validated encryption?
- Are the payment application and devices currently supported?
- Can you restrict access, track changes, and update software?
- Does support use remote access, and how do you disable it when not in use?
- Will the provider supply an AOC for the actual services you buy, plus a responsibility breakdown?
A listing in PCI SSC's software or P2PE directories is version-specific and doesn't make you compliant.
Where AMS Retail Fits
AMS Retail Solutions is an authorized NCR Voyix Counterpoint provider, offering a single-source POS for one store or many, built for specialty retailers. Its Counterpoint offering also includes offline POS capability when the network is down.
Offline processing carries its own risk. It must be configured and approved within your payment provider's rules, and it may affect scope. Processors document the tradeoffs: Square, for example, notes the merchant is responsible for expired, declined, or disputed offline payments.
Verify the specific payment integration and compliance responsibilities with AMS Retail, your processor, and your acquiring bank.
Keep Vendor Records Current
Keep these records current and easy to retrieve:
- Payment-provider AOCs and responsibility matrices
- Device inventories and support procedures
- Software-version records
- Instructions for reporting a compromised terminal
Frequently Asked Questions
What are PCI 4.0 requirements?
PCI DSS 4.0.1 has 12 high-level requirements covering network protection, account-data protection, secure systems, access control, monitoring, testing, and security policies. Which ones apply depends on your environment and SAQ.
What does PCI level mean?
A merchant level is a payment-program classification influenced mainly by transaction volume and other risk factors. It changes your validation expectations, not your need for security controls.
How serious is PCI compliance?
Noncompliance raises your exposure to breaches, contractual consequences, remediation costs, lost customer trust, and possible restrictions from your acquirer or a card brand. Penalties are set by brand and acquirer programs.
Does PCI Level 4 mean my business is exempt?
No. Confirm any formal exemption with your acquirer or card brand, and keep following the controls and validation steps that fit your environment.
Do Level 4 merchants need quarterly PCI scans?
It depends on the brand program, your internet-facing systems, SAQ eligibility, and acquirer instructions. Get the requirement in writing instead of assuming either way.
