The short answer
PCI DSS is a prescriptive standard for protecting payment card data, validated every year with an SAQ or a Report on Compliance. ISO 27001 is a risk-based standard for an information security management system, certified by an independent certification body on a three-year cycle. Neither replaces the other, but one well-planned control set can serve both.
On this page
- PCI DSS vs ISO 27001: what are the main differences?
- Which is harder, PCI DSS or ISO 27001?
- Is ISO 27001 enough for PCI DSS?
- How do PCI DSS requirements map to ISO 27001 Annex A?
- Can you combine PCI DSS and ISO 27001 audits?
- When do customers ask for each?
- What drives the cost of each?
- Why Sovereign Secure
- Planning PCI DSS, ISO 27001 or both?
Comparing PCI DSS vs ISO 27001 means comparing two different kinds of standard. PCI DSS v4.0.1 is a prescriptive set of 12 requirements for protecting payment card data, validated every year with a Self-Assessment Questionnaire (SAQ) or a Report on Compliance (ROC). ISO/IEC 27001:2022 is a risk-based standard for an information security management system (ISMS) covering whatever scope you define, certified by an independent certification body on a three-year cycle.
Neither replaces the other. An ISO 27001 certificate does not satisfy your acquirer, and a PCI DSS Attestation of Compliance (AOC) is not an ISO 27001 certificate. PCI DSS is a contractual obligation for anyone handling card payments; ISO 27001 is voluntary and usually driven by customers and tenders. Firms that need both can plan one control set to serve each. If either standard is new to you, start with our explainers on what PCI DSS is and what ISO 27001 is.
PCI DSS vs ISO 27001: what are the main differences?
| Aspect | PCI DSS v4.0.1 | ISO/IEC 27001:2022 |
|---|---|---|
| Purpose | Protect payment card account data | Manage information security risk across the organisation |
| Published by | PCI Security Standards Council | ISO and IEC |
| Style | Prescriptive: detailed requirements, many with fixed frequencies and settings | Risk-based: mandatory management system clauses, controls chosen by risk |
| Who needs it | Anyone who stores, processes or transmits card data, or can affect its security | Voluntary; organisations whose customers, tenders or regulators expect it |
| Scope | The cardholder data environment (CDE) and connected systems, set by where card data flows | The ISMS scope you define and justify (clause 4.3) |
| Controls | 12 principal requirements with detailed sub-requirements and testing procedures | Clauses 4 to 10, plus 93 Annex A controls in 4 themes, selected in a Statement of Applicability |
| Validation | Annual SAQ or ROC, both with an AOC; quarterly ASV scans where required | Stage 1 and Stage 2 certification audit, surveillance audits between, recertification every three years |
| Who assesses | Your organisation (SAQ), or a Qualified Security Assessor (QSA) or Internal Security Assessor (ISA) | An independent certification body |
| What you get | An AOC; there is no PCI SSC certificate | A certificate issued by the certification body |
| If you fall short | Non-compliance fees from your acquirer and, after a breach, card-brand costs passed on through your acquirer | Nonconformities to correct; a certificate can be suspended or withdrawn |
The standards are available from the PCI SSC document library (free) and from ISO (paid).
Which is harder, PCI DSS or ISO 27001?
They are hard in different ways. PCI DSS covers a narrower scope but leaves less room for judgement. ISO 27001 is wider and lets you choose controls by risk, but you must prove a whole management system works over time, from risk assessment and the Statement of Applicability to internal audit and management review. The difference is clearest where PCI DSS sets the number and ISO 27001 leaves it to you:
| Topic | PCI DSS v4.0.1 | ISO 27001:2022 Annex A |
|---|---|---|
| Passwords | At least 12 characters, or 8 where a system cannot support 12 (8.3.6) | Set by your own policy and risk assessment (5.17, 8.5) |
| Multi-factor authentication | All non-console access into the CDE (8.4.2) | Where your risk assessment calls for it (8.5) |
| Critical security patches | Installed within one month of release (6.3.3) | Timescales you define (8.8) |
| Log review | At least daily for security events and critical systems (10.4.1) | Logging and monitoring you define (8.15, 8.16) |
| Vulnerability scans | Internal and external every three months, external by an Approved Scanning Vendor (11.3.1, 11.3.2) | Frequency you set (8.8) |
| Penetration testing | Internal and external at least every 12 months and after significant change (11.4.2, 11.4.3) | Not required by name; often used to meet 8.8 and 8.29 |
| Scope review | Confirmed at least every 12 months, every 6 months for service providers (12.5.2, 12.5.2.1) | Scope defined and kept current (4.3); no fixed review interval |
Version 4.0 narrowed the gap a little: each of the 12 requirements now opens with documented policies, procedures and roles (for example 1.1.1 and 1.1.2), and targeted risk analyses (12.3.1) let you set some frequencies yourself.
Is ISO 27001 enough for PCI DSS?
No. Acquirers and card brands require PCI DSS validation, and an ISO 27001 certificate is not accepted instead of an SAQ or ROC. The ISMS scope may also leave out the systems that handle card data, and ISO 27001 lets you decide by risk on controls that PCI DSS makes mandatory. Nor does a PCI DSS AOC show that ISO 27001’s management system clauses, such as internal audit and management review, are met.
What does carry across is evidence. Policies, risk assessment, asset inventories, supplier management, incident response, training records and vulnerability management can be designed once and used for both. If you already hold ISO 27001, our PCI DSS assessment can draw on that evidence where it meets the PCI DSS testing procedures.
How do PCI DSS requirements map to ISO 27001 Annex A?
Every PCI DSS requirement has related ISO 27001:2022 Annex A controls. The mapping shows where to look, not equivalence: PCI DSS is usually more specific, so a control that satisfies ISO 27001 may need tightening for PCI DSS.
Mapping ISO 27001 controls to PCI DSS
| PCI DSS v4.0.1 requirement | Related ISO 27001:2022 Annex A controls |
|---|---|
| 1. Network security controls | 8.20 Networks security, 8.21 Security of network services, 8.22 Segregation of networks |
| 2. Secure configurations | 8.9 Configuration management |
| 3. Protect stored account data | 8.24 Use of cryptography, 8.10 Information deletion, 8.11 Data masking |
| 4. Strong cryptography in transmission | 8.24 Use of cryptography, 5.14 Information transfer |
| 5. Protection from malicious software | 8.7 Protection against malware, 8.23 Web filtering |
| 6. Secure systems and software | 8.8 Management of technical vulnerabilities, 8.25 to 8.29 (secure development and testing), 8.32 Change management |
| 7. Restrict access by need to know | 5.15 Access control, 5.18 Access rights, 8.3 Information access restriction |
| 8. Identify users and authenticate access | 5.16 Identity management, 5.17 Authentication information, 8.2 Privileged access rights, 8.5 Secure authentication |
| 9. Restrict physical access | 7.1 to 7.4 (perimeters, entry, securing offices, rooms and facilities, and monitoring), 7.10 Storage media, 7.14 Secure disposal or re-use of equipment |
| 10. Log and monitor all access | 8.15 Logging, 8.16 Monitoring activities, 8.17 Clock synchronisation |
| 11. Test security regularly | 8.8 Management of technical vulnerabilities, 8.29 Security testing in development and acceptance |
| 12. Policies and programmes | 5.1 Policies for information security, 5.2 Roles and responsibilities, 5.19 to 5.22 (suppliers), 5.24 to 5.28 (incidents), 6.3 Information security awareness, education and training |
Our guide to the ISO 27001 Annex A controls explains all 93 controls and the four themes they sit in.
Can you combine PCI DSS and ISO 27001 audits?
Not into a single assessment. A PCI DSS assessment is carried out by a QSA under PCI SSC programme rules and ends in a ROC and AOC. An ISO 27001 certification audit is carried out by a certification body under ISO/IEC 17021-1 and ends in a certification decision that only that body can make.
What you can combine is the work behind them: one risk process, one policy set, one evidence library and one internal audit programme, with the CDE inside the ISMS scope. A shared calendar keeps the recurring tasks in step:
| How often | PCI DSS v4.0.1 | ISO 27001:2022 | How to share the work |
|---|---|---|---|
| Daily to weekly | Log reviews (10.4.1); payment page change detection where it applies (11.6.1) | Logging and monitoring as you define them (8.15, 8.16) | One monitoring process and one set of records |
| Every three months | Internal and external vulnerability scans (11.3.1, 11.3.2) | Technical vulnerability management on your schedule (8.8) | One vulnerability register for both |
| Every 6 months | Segmentation testing and scope confirmation for service providers (11.4.6, 12.5.2.1) | No fixed equivalent | Feed results into the ISMS risk assessment |
| Every 12 months | Scope confirmation (12.5.2), penetration tests (11.4.2, 11.4.3), policy review (12.1.2), training (12.6.3), targeted risk analysis reviews, then SAQ or ROC and AOC | Internal audit and management review at planned intervals (9.2, 9.3); surveillance audit at least once a calendar year between recertifications | Run the ISO internal audit and management review a few months before the PCI DSS assessment |
| Every three years | No equivalent | Recertification audit | Plan it away from your PCI DSS assessment month |
When do customers ask for each?
PCI DSS is driven by card payments; ISO 27001 by buyers who want proof of wider security governance.
| Your situation | What is usually asked for |
|---|---|
| You take card payments as a merchant | PCI DSS validation for your acquirer, every year |
| You process, host or can affect card data for other businesses | A PCI DSS AOC for your customers, who must monitor their providers’ compliance status every 12 months (12.8.4), and often ISO 27001 as well |
| You sell software or services to larger enterprises, with no card data | ISO 27001, or another assurance report the buyer names |
| You bid for UK public-sector contracts | Cyber Essentials for many central government contracts, sometimes with ISO 27001 as well |
For the wider UK picture, see our guide to cyber security certifications in the UK. If data protection is the question rather than certification, our comparison of GDPR and PCI compliance shows which PCI DSS controls support UK GDPR.
What drives the cost of each?
Scope drives both, which is why we quote each engagement rather than publish prices:
| Cost driver | PCI DSS | ISO 27001 |
|---|---|---|
| Scope | Size of the CDE, number of payment channels and locations, and how well it is segmented | Number of people, sites, processes and technology in the ISMS scope |
| Assessment | SAQ completed in-house, or a QSA-led ROC | Certification body audit days at Stage 1, Stage 2, surveillance and recertification |
| Testing | ASV scans, internal scans, penetration and segmentation testing | Whatever testing your risk assessment and Statement of Applicability require |
| Preparation | Gap analysis and remediation, such as MFA and logging | Building the ISMS: risk assessment, policies, internal audit, management review |
Our guides to PCI compliance cost and ISO 27001 certification cost explain each driver in more detail.
Why Sovereign Secure
Sovereign Secure Ltd is a UK company (Companies House 08334453), founded in 2012 and headquartered in Accrington, Lancashire. The PCI Security Standards Council has approved us as a Qualified Security Assessor (QSA) company, a Qualified PIN Assessor (QPA) and a Card Production Security Assessor (CPSA), and we are a member of its Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
We are also ISO 27001 certified and an IASME-licensed Cyber Essentials certification body. Our ISO 27001 consultancy helps organisations build and run their ISMS. Certification audits are carried out by our partner, MQA International, an independent certification body that makes its own certification decisions; we do not issue ISO 27001 certificates.
Planning PCI DSS, ISO 27001 or both?
Tell us how you handle card data and what your customers are asking for. We will explain which standard you need first, how to scope the work so evidence carries across, and send a fixed quote for the PCI DSS assessment or ISO 27001 consultancy. Contact our team or call +44 161 523 5276.
Your next step
- PCI compliance checkAnswer 22 questions for a readiness score, your likely SAQ and a fix list.Start the free check
- PCI DSS document indexThe policies, procedures and records each PCI DSS requirement needs, as a free spreadsheet.Get the document index
- Get a PCI quoteTell us how you take card payments and we will confirm your validation route and scope.Get a PCI quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
