Free Checklist Templates for Pci Dss

Pci Dss

OR

E-commerce Fraud Prevention Checklist

Customer & Account Verification

Audit email verification on new signups

Review phone verification on high-value orders

Confirm staff 2FA on admin tools

Flag duplicate accounts by contact data

Escalate flagged accounts for manual review

Validate shipping addresses against AVS

Transaction Monitoring & Review

Clear the Stripe Radar / Shop Pay risk queue

Investigate orders above the AOV threshold

Check velocity patterns and bot orders

Tune fraud rules in Signifyd or NoFraud

Log fraud orders blocked this period

Payment Security & PCI Compliance

Confirm current SAQ attestation on file

Verify tokenization through the processor

Enable 3DS for EU and UK SCA transactions

Patch checkout and theme dependencies

Reconcile chargebacks and file representments

Account Security Controls

Enforce password and rotation policy

Audit admin permissions across platforms

Rotate stale API keys and webhooks

Test lockout after failed login attempts

Block bot logins via Cloudflare or hCaptcha

Trigger account-takeover incident response

Data Protection & Audit

Confirm PII encryption at rest

Review subprocessor list for material changes

Test customer-data backup restoration

Run vulnerability scan on the storefront

Brief CX team on phishing and gift-card scams

View Workflow Use Workflow

E-commerce IT Security Checklist

Storefront & Admin Access Control

Enforce MFA on storefront admin logins

Audit staff permissions across the admin

Rotate API keys for connected apps

Disable accounts for offboarded staff

Restrict admin access by IP allowlist

Customer & Payment Data Protection

Confirm the current PCI DSS SAQ scope

Verify TLS on checkout and customer accounts

Audit cookie consent and GPC handling

Review the subprocessor and DPA inventory

Run a backup restore drill

Storefront Network & Infrastructure

Run a vulnerability scan on production

Review WAF and bot-management rules

Verify SPF, DKIM, and DMARC on sending domains

Patch self-hosted commerce platforms

Lock down staging and dev environments

Incident Response & Breach Readiness

Refresh the incident response runbook

Run a breach tabletop exercise

Remediate gaps from the tabletop

Update the emergency contact tree

Confirm state breach-notification timing

App, Theme & Integration Security

Audit installed apps for unused permissions

Scan theme code for skimmer injection

Escalate confirmed skimmer to processor and forensics

Review custom checkout extensions

Tighten Content Security Policy on storefront

View Workflow Use Workflow

Payment Gateway Integration Checklist

Pre-Integration Preparation

Select the payment gateway provider

Open the merchant account and verify business identity

Determine the PCI DSS SAQ scope

Choose the checkout hosting model

Provision sandbox credentials

Technical Integration

Install the gateway SDK or app

Configure API keys in the secrets manager

Build the charge, capture, and refund handlers

Configure webhook endpoints with signature verification

Run sandbox transactions across card brands

Debug failing sandbox cases with gateway support

Checkout Experience

Build the checkout page with tokenized inputs

Verify mobile checkout on iOS and Android

Write decline and 3DS challenge messaging

Add Apple Pay, Google Pay, and Shop Pay options

Implement the post-payment redirect and confirmation

Security and Compliance

Enable fraud rules and 3D Secure 2

Confirm TLS 1.2+ across the checkout domain

Tokenize stored payment methods

Schedule the quarterly ASV scan

Document the PCI SAQ for the acquirer

Engage a QSA for the SAQ D assessment

Launch, Reconciliation, and Monitoring

Run a full end-to-end live transaction

Configure alerts for failures and disputes

Reconcile gateway settlement to the bank deposit

Review the chargeback workflow with CX

Sign off on go-live

View Workflow Use Workflow

Payment Processing Checklist

Checkout Security & PCI Scope

Verify TLS certificate on the checkout domain

Confirm SAQ type matches current integration

Engage QSA to confirm scope

Review third-party scripts on checkout

Daily Transaction Reconciliation

Pull Stripe and Shopify Payments payouts

Investigate authorization decline rate

Tune Radar fraud rules

Reconcile marketplace payouts

Disputes & Chargebacks

Triage new chargebacks by reason code

Compile evidence package for contested disputes

Submit evidence before the deadline

Check chargeback ratio against thresholds

Enroll in chargeback alerts program

Subscription Billing Recovery

Pull failed-payment dunning report

Confirm card updater is enabled

Review smart retry schedule

Audit the cancellation flow for compliance

View Workflow Use Workflow

PCI DSS Compliance Checklist

Build and Maintain Secure Networks

Audit security group rules at the CDE boundary

Rotate vendor-default credentials

Validate configuration baselines against CIS benchmarks

Protect Cardholder Data

Inventory all PAN storage locations

Verify encryption-at-rest on all CDE data stores

Confirm TLS 1.2+ on customer-facing endpoints

Vulnerability Management

Run the quarterly ASV external scan

Triage Snyk and Dependabot findings

Open a SEV-2 incident for the critical backlog

Patch critical CVEs within the 30-day SLA

Access Control

Run the quarterly CDE access review

Revoke access for departed and over-scoped users

Verify MFA on all CDE administrative access

Reconcile badge logs to current roster

Monitor and Test Networks

Confirm log aggregation covers every CDE component

Schedule the annual external penetration test

Review file integrity monitoring alerts from the quarter

Information Security Policy and Attestation

Publish the updated information security policy

Run security awareness training for all personnel

Tabletop the incident response runbook

Sign off on the quarterly PCI attestation

View Workflow Use Workflow

PCI DSS Compliance Checklist

Scope and SAQ Determination

Map cardholder data flows across the storefront

Identify the correct SAQ type

Engage a QSA for SAQ D or large merchants

Document the merchant level and acquirer requirements

Network and System Hardening

Review firewall and WAF rules at the storefront edge

Rotate vendor-default passwords on all admin accounts

Confirm cardholder data is not stored locally

Verify TLS 1.2 or higher across all payment paths

Apply security patches to storefront and connected apps

Access Control and Authentication

Audit Shopify and tool admin user list

Enforce MFA on all admin and remote access

Confirm unique IDs for every person with access

Restrict physical access to POS and back-office gear

Monitoring and Testing

Enable audit logging across CDE systems

Run an ASV external vulnerability scan

Commission an annual penetration test

Review logs for anomalies and suspicious activity

Test the e-skimming script-integrity controls

Policy, Training, and Attestation

Update the information security policy

Conduct the annual risk assessment

Deliver security awareness training to all staff

Refresh the third-party service provider inventory

Sign and submit the SAQ and AOC to the acquirer

View Workflow Use Workflow

Restaurant Security Checklist

Physical Security Walk

Inspect entry doors, windows, and patio gates

Test deadbolts, panic bars, and walk-in latches

Review DVR footage and camera coverage

File a service ticket for camera or DVR issues

Verify alarm panel and contact list

POS and Data Security

Audit POS user accounts and PINs

Deactivate former-employee POS access

Review comp, void, and discount reports

Investigate flagged servers with the AGM

Confirm PCI compliance and software patching

Verify back-office data backup completed

Staff Security Practices

Review opening and closing key-holder list

Run a staff briefing on robbery and tamper response

Confirm background checks for new hires

Lock personal belongings in employee lockers

Cash and Financial Controls

Reconcile drawer cash-out variances by server

Verify safe drop log and deposit slips

Confirm separation of duties for deposits and AP

Review credit-card chargebacks and skim alerts

Sign off on the weekly security review

View Workflow Use Workflow

Website Security Checklist

Authentication and Access Review

Audit storefront admin staff accounts

Enforce MFA on admin and integration logins

Review marketing and CX tool user access

Disable accounts for departed staff and contractors

Rotate API keys and private app tokens

Customer Data and Encryption

Verify TLS 1.2+ on storefront and checkout

Confirm SSL certificate auto-renewal

Audit subprocessor list against the privacy policy

Review cookie consent and GPC handling

Check encryption on customer PII exports

Storefront and Application Security

Scan the storefront for XSS and injection flaws

Review installed apps and remove unused ones

Patch theme code and app dependencies

Verify WAF rules and rate limits

Smoke-test checkout on mobile

File remediation tickets for scan findings

Payment and PCI Compliance

Confirm PCI DSS SAQ scope is current

Verify payment tokenization is in use

Review Signifyd or Kount fraud rule performance

Audit the chargeback dispute response workflow

Reconcile gateway settlements against the ledger

Escalate chargeback trend to finance

Backups and Incident Readiness

Verify nightly storefront and database backups

Test restore of theme and product catalog

Review the incident response runbook

Confirm breach notification contacts

Sign off on quarterly audit findings

View Workflow Use Workflow

Ready to take control of your recurring tasks?

Start Free 14-Day Trial

Use Slack? Sign up with one click

With Slack

Company

About
Product Roadmap
API Reference
Privacy Policy
Terms
Contact Us
Blog

Resources

Help
Getting Started Guides
Video Center
Demos
Your Account
Use Cases
Pricing

©Manifestly 2026

When you visit or interact with our sites, services or tools, we or our authorised service providers may use cookies for storing information to help provide you with a better, faster and safer experience and for marketing purposes.