Guides
Straight answers to audit questions.
Each guide takes one question about a standard and answers it first. The rest of the page shows the working: the requirement numbers, what an assessor asks to see, and the sources.
- The answer
- In the first two sentences
- Applies to
- The version of the standard it was written against
- Last checked
- The date the sources were last read
- Sources
- Numbered, from the body that publishes the standard
PCI DSS
PCI DSS questions, answered.
- PCI DSS for UK e-money and payment institutionsChecked 13 Oct 2026
PCI DSS applies to a UK e-money or payment institution that handles card data or can affect its security. It is enforced by contract, not by the FCA.
- PCI DSS ROC or SAQ: which do you need?Checked 13 Oct 2026
A Report on Compliance (ROC) is an assessor's report. A self-assessment questionnaire (SAQ) is your own. Your acquirer or the card schemes decide which.
- Scripts on payment pages: PCI DSS 6.4.3 and 11.6.1Checked 13 Oct 2026
PCI DSS 6.4.3 and 11.6.1 cover scripts on payment pages. Authorise and list every script; detect changes to scripts and headers. Both apply since 31 March 2025.
- Your cloud is PCI DSS compliant. Are you?Checked 13 Oct 2026
A cloud provider's PCI DSS attestation covers its own services, not what you build on them. What stays with you, and the evidence your assessor asks for.
Cyber Essentials
Cyber Essentials questions, answered.
- Cyber Essentials and PCI DSS: do you need both?Checked 13 Oct 2026
They are separate. Customers and government buyers ask for Cyber Essentials; PCI DSS applies if you handle payment card data. Some firms need both.
See it on your own case.
Ask for a walkthrough and we will show you the platform against a scope like yours.
The button opens an email to info@normatiq.io.