TodayTools

SOC 2 and PCI DSS flashcards

The trust report US buyers ask for, and the card data security standard.

Donate
Beginner friendly, starts from zero
Section
How to study
0
SOC 2 and PCI DSSStart from zero · 1 of 12

What are SOC 2 and PCI DSS, in one plain sentence?

They are two well-known sets of security checks that companies go through to prove they keep customer data safe. SOC 2 is for services that hold customer data; PCI DSS is for anyone handling payment cards.

SOC 2 = proof you are careful. PCI DSS = rules for card numbers.
Show again
12 left
Got it

Tap to turn over. Swipe right if you know it, left to see it again.

All topics

What you will learn

  1. Start from zero

    • What SOC 2 and PCI DSS are and why they exist4 cards
    • Controls, evidence and audits3 cards
    • How a card payment works2 cards
    • Compliance words and your path3 cards

  2. Core basics

    • SOC 2 reports, types and the audit journey6 cards
    • PCI DSS basics3 cards
    • Card data and scope4 cards
    • Validation: SAQs, levels and assessors3 cards

  3. Next steps

    • SOC 2 criteria and the report3 cards
    • SOC 2 evidence and testing4 cards
    • PCI DSS goals and the 12 requirements3 cards
    • Protecting stored card data2 cards
    • Access and authentication2 cards
    • Testing, logging and monitoring3 cards
    • v4 changes, risk analysis and third parties3 cards

  4. Go deeper

    • Choosing the right SAQ5 cards
    • Scope reduction, segmentation and tokenisation4 cards
    • Assessment paths and attestation3 cards
    • Key management and incident response2 cards
    • Reading a SOC 2 report like an auditor3 cards
    • Running a combined programme2 cards

Final test and certificate

10 questions drawn fresh from the whole topic, about 15 minutes. Sign in, score 80% or more and get a free certificate with your name and a public check link anyone can open, such as an employer or a teacher. Not signed in? Try a practice test from the cards.

Take the final test

About these cards

  • Reviewed 26 October 2026
  • CoversPCI DSS v4.0.1 (June 2024; all future-dated requirements mandatory since 31 March 2025)SAQ A as revised January 2025AICPA 2017 Trust Services Criteria with 2022 revised points of focusRBI Card-on-File Tokenisation rules (in force 1 October 2022)
How these cards are made

SOC 2 and PCI DSS at a glance

SOC 2 and PCI DSS are independent security checks that prove a company keeps customer and card data safe.

SOC 2 is a restaurant hygiene report by an outside inspector; PCI DSS is the strict rule book for a bank vault.

Words you will meet

Control
A rule or tool that protects data, like a lock or a backup
Evidence
Proof that a control really works
Attestation
An auditor's written opinion, not a certificate
CPA firm
A licensed US accounting company allowed to sign SOC reports
Merchant
A shop or business that takes card payments
Acquiring bank
The shop's bank that receives card payments
PAN
The long card number on the front of a card
Scope
Which systems the rules cover

The steps

  1. 1. Start from zero (12 cards): What these security checks are, who asks for them, and the plain words auditors and banks use.
  2. 2. Core basics (16 cards): What each one is, who needs it and the core terms.
  3. 3. Next steps (20 cards): Running SOC 2 and the 12 PCI DSS requirements.
  4. 4. Go deeper (19 cards): SAQ choice, scope reduction and running both programmes.
All 12 cards in Start from zero
What are SOC 2 and PCI DSS, in one plain sentence?
They are two well-known sets of security checks that companies go through to prove they keep customer data safe. SOC 2 is for services that hold customer data; PCI DSS is for anyone handling payment cards.
What problem do they solve?
A big customer cannot visit every supplier to inspect its security. One independent check gives a trusted answer, instead of hundreds of long questionnaires from every customer.
Where do you already meet them in daily life?
When you pay by card online, PCI DSS rules are why the shop never keeps your full card number in plain sight. When your office picks a new software tool, someone usually asks the seller for its SOC 2 report.
What everyday thing are they like?
SOC 2 is like a restaurant's hygiene report written by an outside inspector who watched the kitchen for months. PCI DSS is like the strict rule book for running a bank vault.
What are a control and evidence?
A control is a rule or tool that protects data, like a lock, a password rule or a daily backup. Evidence is proof the control really works, such as records, logs and screenshots.
What are an audit, an auditor and an attestation?
An audit is an outside expert, the auditor, checking your controls and evidence. An attestation is the auditor's written opinion in a report, which is different from a certificate.
What are a CPA firm and the AICPA?
A CPA is a licensed accountant in the United States, and a CPA firm is a company of them. The AICPA is their professional body, and it writes the rules for SOC reports.
Who is who in a card payment?
The merchant is the shop taking the card, and the card brands are networks like Visa and Mastercard. The acquiring bank is the shop's bank that receives card payments, and service providers are companies that handle cards for others.
What are the card number (PAN), CVV, PIN and authorisation?
The PAN is the long number on the front of the card, the CVV is the short code on the back, and the PIN is your secret number. Authorisation is the moment the bank says yes to a payment.
What do compliance, a standard, scope and an assessment mean?
A standard is a written set of rules, and compliance means meeting it. Scope is which systems the rules cover, and an assessment is the check that you meet them.
What do you need before you start?
Nothing to install and no coding. It helps to know that a server is a computer that runs an online service and a database is where it keeps records.
What will you be able to do after this topic?
Explain what a SOC 2 report and PCI DSS are, pick the right report type, know which card data you may never keep, and talk with auditors and banks in their words.
SOC 2 and PCI DSS cheatsheet

SOC 2 basics

  • Security (CC) Always in scope
  • A, PI, C, P Availability, Processing Integrity, Confidentiality, Privacy
  • Type I Design at a date
  • Type II Operating over 3 to 12 months
  • SOC 1 / SOC 3 Financial controls / public summary
  • Bridge letter Covers gap since last period
  • CUEC Controls customers must run

PCI DSS 12 requirements

  • 1, 2 Network controls, secure configs
  • 3, 4 Protect stored data, encrypt in transit
  • 5, 6 Anti-malware, secure software
  • 7, 8 Need to know, authentication and MFA
  • 9, 10 Physical access, logging
  • 11, 12 Testing, policies and programme

SAQ types

  • A Fully outsourced e-commerce or mail/phone
  • A-EP Site affects payment page
  • B / B-IP Dial-out / IP standalone terminals
  • C-VT Web virtual terminal
  • C Payment app on internet
  • P2PE Validated P2PE solution
  • D Everyone else, all service providers

PCI clocks

  • Quarterly Internal scans and ASV external scans
  • 12 months Pen test, scope confirmation
  • 6 months Segmentation test, service providers
  • 31 Mar 2025 v4 future dated reqs mandatory
  • 31 Dec 2024 v4.0 retired; v4.0.1 current

Never store

  • CVV2 / CVC2 After authorisation
  • Full track data After authorisation
  • PIN / PIN block After authorisation
  • PAN in clear Mask, hash, truncate, tokenise or encrypt
Donate