Just Inherited PCI Compliance?

You've Just Been Made Responsible for PCI.
Here's Your First Step.

A plain-English starting point for the security, IT, compliance, or risk professional who got handed PCI DSS — and still has a full-time job to do the rest of the week.

Find out which SAQ applies to you → Or get the free guide: The First 30 Days When You Own PCI

You're Not the First

Nobody Asked to Own PCI

It usually arrives the same way: a reorg, a new role, a departing colleague, or a single sentence in a meeting — "You've got PCI now." Suddenly you're responsible for a standard written for specialists, with hundreds of requirements, its own vocabulary, and an assessor somewhere in your future.

And underneath the to-do list is the part nobody says out loud: the quiet worry that you'll get something wrong without realizing it. That you'll pick the wrong questionnaire, miss something that was in scope all along, or walk into an assessment unprepared.

That feeling is normal, and it's not a reflection of your ability. You weren't hired to be a PCI specialist. You just need a map.

The Good News

PCI Only Feels Infinite

The reason PCI feels bottomless is that you're looking at the whole standard — every requirement, every SAQ, every validation path — when only a fraction of it actually applies to your environment. Drawn as a path, it's short and finite:

1

Scope

Figure out what's actually in scope. This is where most of the real risk hides.

2

SAQ

Determine which Self-Assessment Questionnaire fits your situation.

3

Requirements

See which requirements you actually have to meet — not all of them.

4

Documentation

Know what you'd need to show an assessor before you're in the room.

Once someone draws that map, PCI stops being a wall of documents and becomes a sequence of answerable questions. That's the entire job of PCI Clarity.

Where to Start

Get Oriented in Minutes, Not Weeks

Describe your payment setup in plain language and PCI Clarity tells you what's likely in scope, which SAQ fits, which requirements apply, and what to do next — checked against current PCI DSS, not a blog post from years ago. It's built on a knowledge base assembled by practicing QSAs and PCI professionals, so the answers reflect how PCI actually works in the field.

Start with the free SAQ Finder — a few plain-language questions, no sign-up, a clear preliminary answer. When you're ready to go deeper, the full tool works through your specific scope and requirements with you.

Try the free SAQ Finder →

What This Is — and Isn't

It Won't Replace Your Assessor.
It Makes Sure You Walk in Ready.

PCI Clarity is orientation, not a determination. It doesn't pretend to sign off on your compliance or replace your QSA or acquirer — that was never the goal. What it does is make sure that when you talk to an assessor, hire a consultant, or report up to leadership, you already understand your scope, your likely SAQ, and the questions that matter. You walk in knowing where you stand instead of finding out the hard way.

No magic compliance button. No overpromising. Just a clear, current starting point from people who've answered these questions hundreds of times.

Honest Answers

The Questions You're Actually Asking

Where do I even start?

With scope and your SAQ — in that order. Everything else in PCI depends on those two answers, which is why the SAQ Finder is the first thing on this page. Get oriented there, then work outward.

Am I in trouble if I get something wrong?

Most PCI mistakes happen in the dark — people don't know what applies, so they guess. Getting an accurate, current picture of your obligations is the single biggest thing you can do to lower that risk. That's exactly what the tool is for.

Do I have to read the entire standard?

No. The standard is a reference, not an onboarding document. You need the part that applies to your environment — typically a small slice of the whole — and that's what PCI Clarity isolates for you.

Do I need to hire a QSA?

Maybe, eventually — and if you do, you'll get far more value from that engagement by walking in already oriented. Plenty of situations can be self-assessed; the tool helps you understand which camp you're likely in before you spend on outside help.

You Were Handed PCI.
Let's Hand You the Map.

Start with a few plain-language questions and get a clear preliminary read on your SAQ and scope — free, no sign-up, no expensive consultant required to get going.

Find your SAQ — free → Or go deeper in PCI Clarity →