Live Threats
[CVE-2026-1234]Windows CLFS Driver zero-day — privilege escalation to SYSTEM, CISA KEV confirmed, patch immediately|
[CVE-2026-0891]Fortinet FortiOS authentication bypass — unauthenticated admin access, active exploitation in the wild|
[CVE-2026-2201]Palo Alto PAN-OS command injection — remote code execution on firewall management plane, CISA KEV listed|
[PATCH]Microsoft April 2026 Patch Tuesday — 147 CVEs addressed including 3 zero-days, deploy immediately|
[BREACH]Healthcare sector breach — 2.3M patient records exposed, PHI including SSNs and medical histories compromised|
[CVE-2026-1887]Chrome V8 type confusion RCE — remote code execution via malicious web page, update Chrome immediately|
[COMPLIANCE]PCI DSS 4.0.1 MFA deadline — mandatory multi-factor authentication enforcement now in effect for all merchants|
[CVE-2026-3310]Cisco IOS XE privilege escalation — authenticated users gain root on affected switches and routers, patch now|
[RANSOMWARE]LockBit 4.0 SMB campaign — RDP brute-force targeting small businesses, double-extortion, 72-hour ransom window|
[ADVISORY]Adobe Acrobat PDF phishing wave — malicious PDFs bypassing email filters, credential harvesting at scale|
[CVE-2026-1234]Windows CLFS Driver zero-day — privilege escalation to SYSTEM, CISA KEV confirmed, patch immediately|
[CVE-2026-0891]Fortinet FortiOS authentication bypass — unauthenticated admin access, active exploitation in the wild|
[CVE-2026-2201]Palo Alto PAN-OS command injection — remote code execution on firewall management plane, CISA KEV listed|
[PATCH]Microsoft April 2026 Patch Tuesday — 147 CVEs addressed including 3 zero-days, deploy immediately|
[BREACH]Healthcare sector breach — 2.3M patient records exposed, PHI including SSNs and medical histories compromised|
[CVE-2026-1887]Chrome V8 type confusion RCE — remote code execution via malicious web page, update Chrome immediately|
[COMPLIANCE]PCI DSS 4.0.1 MFA deadline — mandatory multi-factor authentication enforcement now in effect for all merchants|
[CVE-2026-3310]Cisco IOS XE privilege escalation — authenticated users gain root on affected switches and routers, patch now|
[RANSOMWARE]LockBit 4.0 SMB campaign — RDP brute-force targeting small businesses, double-extortion, 72-hour ransom window|
[ADVISORY]Adobe Acrobat PDF phishing wave — malicious PDFs bypassing email filters, credential harvesting at scale|
View All
Payment Security

PCI-DSS
Compliance Services

Protect cardholder data and keep your ability to accept card payments. Expert PCI-DSS gap assessments, SAQ completion, network scanning, and ongoing compliance management for Texas businesses.

12
Core Requirements
4
Merchant Levels
$100K
Max Monthly Fine
SAQ
Self-Assessment
Compliance Tiers

PCI-DSS Merchant Levels

Your PCI-DSS validation requirements depend on your annual transaction volume. Most small businesses fall into Level 4.

Level 1

6M+ transactions/year

Annual on-site QSA assessment + quarterly network scans

Level 2

1M–6M transactions/year

Annual SAQ + quarterly network scans

Level 3

20K–1M e-commerce transactions/year

Annual SAQ + quarterly network scans

Level 4

Under 20K e-commerce or under 1M other

Annual SAQ recommended + quarterly network scans

Transaction volumes are per card brand (Visa, Mastercard, etc.) per year. Requirements may vary by payment brand.

The Framework

12 PCI-DSS Requirements

PCI-DSS v4.0 organizes cardholder data protection into 12 core requirements. Segler.Net assesses and implements all of them.

Req. 1

Install & Maintain Network Security Controls

Firewalls and network security controls to protect cardholder data environment from untrusted networks.

Req. 2

Apply Secure Configurations

Secure configurations for all system components — no vendor-supplied defaults for passwords or security parameters.

Req. 3

Protect Stored Account Data

Protect stored cardholder data using encryption, truncation, masking, and hashing.

Req. 4

Protect Data in Transit

Encrypt transmission of cardholder data across open, public networks using strong cryptography.

Req. 5

Protect Against Malicious Software

Deploy anti-malware solutions on all systems commonly affected by malicious software.

Req. 6

Develop Secure Systems & Software

Protect all systems and networks from known vulnerabilities through security patches and secure development.

Req. 7

Restrict Access to System Components

Limit access to system components and cardholder data to only those individuals whose job requires it.

Req. 8

Identify Users & Authenticate Access

Identify all users with access to system components and authenticate access with unique credentials.

Req. 9

Restrict Physical Access

Restrict physical access to cardholder data and system components to authorized personnel only.

Req. 10

Log & Monitor All Access

Log and monitor all access to system components and cardholder data to detect and investigate anomalies.

Req. 11

Test Security Regularly

Test security of systems and networks regularly through vulnerability scans and penetration testing.

Req. 12

Support Information Security

Support information security with organizational policies and programs that address security for all personnel.

Validation Methods

Self-Assessment Questionnaire Types

The right SAQ type depends on how your business accepts card payments. Segler.Net identifies your correct SAQ and helps you complete it accurately.

SAQ A22 requirements

Card-Not-Present Merchants

E-commerce merchants who outsource all cardholder data functions. Simplest questionnaire — 22 requirements.

Common examples:

Online stores using hosted payment pages (Stripe, Square, PayPal)

SAQ B41 requirements

Imprint/Standalone Terminals

Merchants using only imprint machines or standalone dial-out terminals. No electronic cardholder data storage.

Common examples:

Retail stores with standalone payment terminals not connected to internet

SAQ B-IP83 requirements

IP-Connected Terminals

Merchants using standalone IP-connected PTS-approved payment terminals. No electronic storage.

Common examples:

Restaurants and retail with internet-connected payment terminals

SAQ C160 requirements

Payment Application Systems

Merchants with payment application systems connected to the internet. No electronic cardholder data storage.

Common examples:

Businesses using POS systems connected to the internet

SAQ D329 requirements

All Other Merchants

Merchants who do not qualify for any other SAQ type. Full PCI-DSS assessment required.

Common examples:

Merchants storing cardholder data or with complex environments

ROCFull assessment

Level 1 Merchants

Merchants processing over 6 million transactions annually. Requires on-site assessment by a Qualified Security Assessor (QSA).

Common examples:

Large retailers, e-commerce platforms, payment processors

How We Work

Our PCI-DSS Compliance Process

A proven, systematic approach to achieving and maintaining PCI-DSS compliance for Texas businesses.

01

Scope & Gap Assessment

Define your cardholder data environment, identify all in-scope systems, and assess gaps against all 12 requirements.

02

Network Segmentation

Design and implement network segmentation to minimize your CDE scope and reduce compliance burden.

03

Remediation

Implement technical controls, policies, and procedures to close all identified gaps across the 12 requirements.

04

SAQ Completion

Complete the appropriate Self-Assessment Questionnaire accurately with supporting evidence documentation.

05

Ongoing Compliance

Quarterly network scans, annual SAQ renewal, and continuous monitoring to maintain PCI-DSS compliance.

Texas Bonus

PCI-DSS Compliance May Qualify You for Texas SB 2610 Safe Harbor

Texas SB 2610, effective September 1, 2025, provides a legal safe harbor from punitive damages in data breach lawsuits for Texas businesses that implement a recognized cybersecurity framework — including PCI-DSS.

If your business is already PCI-DSS compliant, you may automatically qualify for SB 2610 safe harbor protection — shielding you from punitive damages in the event of a breach lawsuit involving cardholder data.

Learn About SB 2610 Safe Harbor

Recognized Framework

PCI-DSS is explicitly recognized as a qualifying cybersecurity framework under Texas SB 2610.

Punitive Damage Protection

Safe harbor shields your business from punitive damages in breach-related lawsuits — on top of PCI-DSS liability protection.

Applies to Most Texas Businesses

SB 2610 applies to Texas businesses with fewer than 250 employees — most small merchants qualify.

Documentation Is Key

Your completed SAQ and compliance documentation serve as evidence of your cybersecurity program for SB 2610 purposes.

Common Questions

PCI-DSS FAQ

Straight answers to what Texas businesses ask most about PCI-DSS compliance and card payment security.

Have a PCI-DSS question specific to your business?

Our San Antonio compliance experts work with Texas businesses of all sizes — no obligation to ask.

Ask an Expert

Ready to Achieve PCI-DSS Compliance?

Start with a free gap assessment. We'll scope your cardholder data environment and give you a clear path to compliance.

Talk with Us