PCI Compliance Trends

Findings From SecurityMetrics' PCI Compliance Customers

Merchants often have a difficult time attaining (or maintaining) PCI compliance for a variety of reasons. Many smaller merchants believe it’s too technical or costly, while others simply don’t believe it’s effective and refuse to comply.

With the help of SecurityMetrics, simplify your PCI compliance and provide your business with enhanced data security.

2025 PCI Compliance Trends

See infographic here:
https://www.securitymetrics.com/download/2025-pci-compliance-trends-infographic

How Does Your Organization Rank?

2024 SecurityMetrics Customer Trends

• 73.4% of SecurityMetrics customers that started their SAQ have achieved a passing status
• 19.5 days: Average time to reach PCI DSS compliance
• 1.03 times: Average number of support incidents before customers became compliant
• 75.8% percent of SecurityMetrics customers that passed their first scan
• 7.8 days: Average time from finished first scan to first passing scan
• 1.3 scans: Average number of times scanned until merchants pass their PCI scan

Top 10 Failing SAQ Sections

We reviewed our merchant database in search of the top 10 areas where organizations struggle to become compliant. Starting with the least adopted requirement, these are the results:

1. Requirement 12.1.1
   Security Policy
   Establish, publish, maintain, and disseminate a security policy. 
2. Requirement 12.8.4
   Monitor Providers
   Monitor third-party service providers’ (TPSP) PCI DSS compliance status at least once every 12 months. 
3. Service Provider
   Requirement 12.8.5
   Maintain information about which PCI DSS requirements are managed by each service provider, and which are managed by the entity. 
4. Requirement 12.8.2
   Written Agreement
   Written agreements with all TPSPs are maintained with which account data is shared or that could affect the security of the CDE.
5. Requirement 12.8.3
   Due Diligence
   An established process is implemented for engaging TPSPs, including proper due diligence prior to engagement. 
6. Requirement 12.8.1
   Provider List
   A list of all TPSPs with which account data is shared or that could affect the security of account data is maintained, including a description for each of the services provided. 
7. Requirement 12.10.1
   Incident Response
   An incident response plan exists and is ready to be activated in the event of a suspected or confirmed security incident.
8. Requirement 12.10.2
   Response Testing
   The security incident response plan is reviewed, updated, and tested at least annually. 
9. Requirement 12.10.3
   Incident Personnel
   Specific personnel are designated to be available on a 24/7 basis to respond to suspected or confirmed security incidents. 
10. Requirement 12.10.6
    Evolving Response
    The security incident response plan is modified and evolved according to lessons learned and to incorporate industry developments.

TOP 5 FAILED VULNERABILITIES 

1. TLS Version 1.0 Protocol Detection
   Exists if the remote service accepts connections using TLS 1.0 encryption
2. SSL Self-Signed Certificate
   Occurs when organizations use an identity certificate that they create, sign, and certify rather than a trusted certificate authority (CA)
3. TLS Version 1.1 Protocol Detection
   Exists if the remote service accepts connections using TLS 1.1 encryption
4. SSL 64-BIT Block Size Cipher Suites Supported (SWEET32)
   Exists if a remote host supports the use of a block cipher with 64-bit blocks in one or more cipher suites
5. TLS Version 1.1 Protocol Deprecated
   Exists if the remote service accepts connections using TLS 1.1 encryption, which should be deprecated
   
   

2023 PCI COMPLIANCE TRENDS

HOW DOES YOUR ORGANIZATION RANK?

2022 SECURITYMETRICS CUSTOMER TRENDS

• 90.4% of SecurityMetrics customers that started their SAQ have achieved a passing status
• 21 days: Average time to reach PCI DSS compliance
• 0.98 times: Average number of support incidents before customers became compliant
• 79.19% percent of SecurityMetrics customers that passed their first scan
• 10.6 days: Average time from finished first scan to first passing scan
• 1.4 scans: Average number of times scanned until merchants pass their PCI scan

TOP 10 FAILING SAQ SECTIONS

We reviewed our merchant database in search of the top 10 areas where organizations struggle to become compliant. Starting with the least adopted requirement, these are the results:

1. Requirement 12.1: Establish, publish, maintain, and disseminate a security policy.
2. Requirement 12.10.1: Create an incident response plan to be implemented in the event of a system breach.
3. Requirement 12.1.1: Review the security policy at least annually and update the policy when the environment changes.
4. Requirement 12.8.5: Maintain information about which PCI DSS requirements are managed by each service provider, and which are managed by the entity.
5. Requirement 12.5.3: Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations.
6. Requirement 12.6.a: Implement a formal security awareness program to make all personnel aware of the cardholder data security policy and procedures.
7. Requirement 12.8.4: Maintain a program to monitor service providers’ PCI DSS compliance status at least annually.
8. Requirement 12.4: Ensure that the security policy and procedures clearly define information security responsibilities for all personnel.
9. Requirement 12.8.2: Maintain a written agreement that includes an acknowledgement that the service providers are responsible for the security of cardholder data that they possess or impact the security of the cardholder data environment. 
10. Requirement 12.8.3: Verify that the usage policies define all critical devices and personnel authorized to use the devices.

TOP 5 FAILED VULNERABILITIES 

1. TLS VERSION 1.1 PROTOCOL DETECTION
   Exists if the remote service accepts connections using TLS 1.1 encryption
2. TLS VERSION 1.0 PROTOCOL DETECTION
   Exists if the remote service accepts connections using TLS 1.0 encryption
3. SSL SELF-SIGNED CERTIFICATE
   Occurs when organizations use an identity certificate that they create, sign, and certify rather than a trusted certificate authority (CA)
4. TLS VERSION 1.1 PROTOCOL DEPRECATED
5. SSL 64-BIT BLOCK SIZE CIPHER SUITES SUPPORTED (SWEET32)
   Exists if a remote host supports the use of a block cipher with 64-bit blocks in one or more cipher suites

‍

2022 PCI Compliance Trends

https://www.securitymetrics.com/download/2022-pci-compliance-trends-infographic

HOW DOES YOUR ORGANIZATION RANK?

2021 SECURITYMETRICS CUSTOMER TRENDS

• 93.6% of SecurityMetrics customers that started their SAQ have achieved a passing status
• 20.33 days: Average time to reach PCI DSS compliance
• 0.98 times: Average number of support incidents before customers became compliant
• 77.67% percent of SecurityMetrics customers that passed their first scan
• 8.5 days: Average time from finished first scan to first passing scan
• 1.57 scans: Average number of times scanned until merchants pass their PCI scan
  

TOP 10 FAILING SAQ SECTIONS

We reviewed our merchant database in search of the top 10 areas where organizations struggle to become compliant. Starting with the least adopted requirement, these are the results:

1. Requirement 12.1: Establish, publish, maintain, and disseminate a security policy.
2. Requirement 12.5.3: Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations.
3. Requirement 12.6.a: Implement a formal security awareness program to make all personnel aware of the cardholder data security policy and procedures.
4. Requirement 12.1.1: Review the security policy at least annually and update the policy when the environment changes.
5. Requirement 12.4: Ensure that the security policy and procedures clearly define information security responsibilities for all personnel.
6. Requirement 12.10.1: Create an incident response plan to be implemented in the event of system breach.
7. Requirement 12.8.5: Maintain information about which PCI DSS requirements are managed by each service provider, and which are managed by the entity.
8. Requirement 9.9.2: Periodically inspect device surfaces to detect tampering (e.g., addition of card skimmers to devices), or substitution (e.g., by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device).
9. Requirement 12.3.1: Verify that the usage policies include processes for explicit approval from authorized parties to use the technologies.
10. Requirement 12.3.3: Verify that the usage policies define all critical devices and personnel authorized to use the devices.

TOP 5 FAILED VULNERABILITIES

1. TLS VERSION 1.0 PROTOCOL DETECTION
2. Exists if the remote service accepts connections using TLS 1.0 encryption

2. SSL SELF-SIGNED CERTIFICATE
3. Occurs when organizations use an identity certificate that they create, sign, and certify rather than a trusted certificate authority (CA)

3. SSL CERTIFICATE WITH WRONG HOSTNAME
4. Happens when an SSL certificate for the tested service is for a different host

4. SSL 64-BIT BLOCK SIZE CIPHER SUITES SUPPORTED (SWEET32)
5. Exists if a remote host supports the use of a block cipher with 64-bit blocks in one or more cipher suites
   
   
6. SSL MEDIUM STRENGTH CIPHER SUITES SUPPORTED (SWEET32)
   
   Occurs when a remote host supports the use of SSL ciphers that offer medium strength encryption

2021 PCI Compliance Trends

https://www.securitymetrics.com/download/2021-pci-compliance-trends-infographic

2021 PCI COMPLIANCE TRENDS

HOW DOES YOUR ORGANIZATION RANK?

2020 SECURITYMETRICS CUSTOMER PCI TRENDS

• 94% of SecurityMetrics customers that started their SAQ have achieved a passing status
• 25.75 days: Average time to reach PCI DSS compliance
• 1.4 time: Average number of support incidents before customers became compliant
• 71% percent of SecurityMetrics customers that passed their first scan
• 5.2 days: Average time from finished first scan to first passing scan
• 1.75 scans: Average number of times scanned until merchants pass their PCI scan
  

TOP 10 FAILING SAQ SECTIONS

We reviewed our merchant database in search of the top 10 areas where organizations struggle to become compliant. Starting with the least adopted requirement, these are the results:

1. Requirement 12.1: Establish, publish, maintain, and disseminate a security policy.
2. Requirement 12.5.3: Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations.
3. Requirement 12.6.a: Implement a formal security awareness program to make all personnel aware of the cardholder data security policy and procedures.
4. Requirement 12.1.1: Review the security policy at least annually and update the policy when the environment changes.
5. Requirement 12.4: Ensure that the security policy and procedures clearly define information security responsibilities for all personnel.
6. Requirement 12.10.1: Create an incident response plan to be implemented in the event of system breach.
7. Requirement 12.8.5: Maintain information about which PCI DSS requirements are managed by each service provider, and which are managed by the entity.
8. Requirement 9.9.2: Periodically inspect device surfaces to detect tampering (e.g., addition of card skimmers to devices), or substitution (e.g., by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device).
9. Requirement 12.3.1: Verify that the usage policies include processes for explicit approval from authorized parties to use the technologies.
10. Requirement 12.3.3: Verify that the usage policies define all critical devices and personnel authorized to use the devices.
    

TOP 5 FAILED VULNERABILITIES

1. TLS VERSION 1.0 PROTOCOL DETECTION: Exists if the remote service accepts connections using TLS 1.0 encryption
2. SSL CERTIFICATE WITH WRONG HOSTNAME: Happens when an SSL certificate for the tested service is for a different host
3. SSL CERTIFICATE CANNOT BE TRUSTED: Happens if the SSL certificate service cannot be trusted
4. SSL 64-BIT BLOCK SIZE CIPHER SUITES SUPPORTED (SWEET32): Exists if a remote host supports the use of a block cipher with 64-bit blocks in one or more cipher suites
5. SSL SELF-SIGNED CERTIFICATE: Occurs when organizations use an identity certificate that they create, sign, and certify rather than a trusted certificate authority (CA)
   

2020 PCI Compliance Trends

info.securitymetrics.com/2020-pci-compliance-trends

2020 PCI Compliance Trends

HOW DOES YOUR ORGANIZATION RANK?

2019 SECURITYMETRICS CUSTOMER TRENDS

• 94% of SecurityMetrics customers that started their SAQ have achieved a passing status
• 17 days: Average time to reach PCI DSS compliance
• 0.9 times: Average number of support incidents before customers became compliant
• Percentage of SecurityMetrics customers that passed their first scan: 74%
• Average time from finished first scan to first passing scan: 5.5 days
• Average number of times scanned until merchants pass their PCI scan: 1.57 scans
  

TOP 10 FAILING SAQ SECTIONS

We reviewed our merchant database in search of the top 10 areas where organizations struggle to become compliant. Starting with the least adopted requirement, these are the results:

1. Requirement 12.1: Establish, publish, maintain, and disseminate a security policy.
2. Requirement 12.10.1: Create an incident response plan to be implemented in the event of system breach.
3. Requirement 12.1.1: Review the security policy at least annually and update the policy when the environment changes.
4. Requirement 12.6.a: Implement a formal security awareness program to make all personnel aware of the cardholder data security policy and procedures.
5. Requirement 12.5.3: Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations.
6. Requirement 12.4: Ensure that the security policy and procedures clearly define information security responsibilities for all personnel.
7. Requirement 12.8.5: Maintain information about which PCI DSS requirements are managed by each service provider, and which are managed by the entity.
8. Requirement 12.8.4: Maintain a program to monitor service providers’ PCI DSS compliance status at least annually.
9. Requirement 12.3.1: Verify that the usage policies include processes for explicit approval from authorized parties to use the technologies.
10. Requirement 12.3.3: Verify that the usage policies define all critical devices and personnel authorized to use the devices.

TOP 5 FAILED VULNERABILITIES

1. TLS VERSION 1.0 PROTOCOL DETECTION: Exists if the remote service accepts connections using TLS 1.0 encryption

2. SSL 64-BIT BLOCK SIZE CIPHER SUITES SUPPORTED (SWEET32): Exists if a remote host supports the use of a block cipher with 64-bit blocks in one or more cipher suites

3. SSL CERTIFICATE WITH WRONG HOSTNAME: Happens when an SSL certificate for the tested service is for a different host

4. SSL SELF-SIGNED CERTIFICATE: Occurs when organizations use an identity certificate that they create, sign, and certify rather than a trusted certificate authority (CA)

5. SSL RC4 CIPHER SUITES SUPPORTED (BAR MITZVAH): Exists when the RC4 encryption algorithm is used in SSL/TLS transmission
   

2019 PCI Compliance Trends

https://info.securitymetrics.com/infographic-2019-pci-compliance-trends

2019 PCI COMPLIANCE TRENDS

HOW DOES YOUR ORGANIZATION RANK?

2018 SECURITYMETRICS CUSTOMER TRENDS

• 72% Percentage of SecurityMetrics customers that passed their first scan
• 11 days: Average time from finished first scan to first passing scan
• 1.61 scans: Average number of times scanned until merchants pass their PCI scan
• 32 days: Average time to reach PCI DSS compliance
• 1.28 times: Average number of support incidents before customers became compliant
• 85% of SecurityMetrics customers that started their SAQ have achieved a passing status
  

TOP 10 FAILING SAQ SECTIONS

We reviewed our merchant database in search of the top 10 areas where organizations struggle to become compliant. Starting with the least adopted requirement, these are the results:

1. Requirement 12.1: Establish, publish, maintain, and disseminate a security policy.
2. Requirement 12.6.1: Educate personnel upon hire and at least annually.
3. Requirement 12.5.3: Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations.
4. Requirement 12.10.1: Create an incident response plan to be implemented in the event of system breach.
5. Requirement 12.1.1: Review the security policy at least annually and update the policy when the environment changes.
6. Requirement 12.4: Ensure that the security policy and procedures clearly define information security responsibilities for all personnel.
7. Requirement 12.8.5: Maintain information about which PCI DSS requirements are managed by each service provider, and which are managed by the entity.
8. Requirement 9.9.2: Periodically inspect device surfaces to detect tampering (e.g., addition of card skimmers to devices), or substitution (e.g., by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device).
9. Requirement 12.3.5: [Verify that the usage policies define] acceptable uses of the technology.
10. Requirement 12.8.4: Maintain a program to monitor service providers’ PCI DSS compliance status at least annually.

TOP 5 FAILED VULNERABILITIES

1. TLS version 1.0 protocol detection: Exists if the remote service accepts connections using TLS 1.0 encryption
2. SSL 64-bit block size cipher suites suppoerted (SWEET32): Exists if a remote host supports the use of a block cipher with 64-bit blocks in one or more cipher suites
3. SSL certification with wrong hostname: Happens when an SSL certificate for the tested service is for a different host
4. SSL medium strength cipher suites supported: Occurs when a remote host supports the use of SSL ciphers that offer medium strength encryption
5. SSL self-signed certificate: Occurs when organizations use an identity certificate that they create, sign, and certify rather than a trusted certificate authority (CA)

2018 PCI Compliance Trends

https://info.securitymetrics.com/2018-pci-compliance-trends

2017 PCI Compliance Trends

https://info.securitymetrics.com/2017-pci-trends-infographic

2016 PCI Compliance Trends

http://www.securitymetrics.com/download/2016-securitymetrics-guide-to-pci-dss-compliance

‍