Guide
PCI DSS background checks: who to screen and how
PCI DSS background checks are covered by Requirement 12.7. It asks you to screen people before they gain access to the card environment, within the limits of local law. So the rule is about access, not job title.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What Requirement 12.7 says
Potential personnel who will have access to the card environment are screened before hire, to reduce the risk of attacks from inside. Also, local laws limit what screening is allowed. The text is in the PCI SSC document library.
Who needs PCI DSS background checks
Focus on access. Therefore list roles that reach card data or the systems around it.
- Administrators of systems in the card environment
- Developers with production access
- Support staff who can view card data
- Finance staff handling payment records
PCI DSS background checks review
Tick what is in place.
Your result appears here as you tick, so you can see what is still open.
Local law shapes PCI DSS background checks
What you may check differs by country and state. For example, criminal record checks are restricted in some places. So design the screening with legal advice, and document why it fits.
| Topic | Typical approach |
|---|---|
| Scope of check | Set by role and local law. |
| Timing | Before access is granted. |
| Records | Proof that screening happened, stored securely. |
PCI DSS background checks for contractors
People working for vendors may also reach your card environment. Therefore require screening in contracts, or confirm the vendor's own process.
The vendor's assessment or contract terms can serve as evidence, as long as they cover the people who actually access your systems.
Our role
We help define which roles need screening and what evidence to keep. However, legal decisions stay with your counsel, and we are not a QSA.
Also repeat the review when roles change. For example, someone moving into a role with production access may need screening at that point, even if they joined years earlier in a different job.
PCI DSS background checks questions
Do PCI DSS background checks apply to all staff?
No. They apply to people who will access the card environment.
What if local law forbids a check?
The requirement allows for local law, so document the limits.
Do contractors need PCI DSS background checks?
If they access the card environment, yes, through contracts or vendor processes.
What evidence does an assessor want?
Proof that screening happened before access, not the screening details.
Related guides
Close the people-side gaps
Tell us which roles reach card data. We reply with a written readiness estimate.
Get my written estimate