PCI compliance deadlines for the next 12 months

What the calendar tells you

A small merchant's PCI year runs on two clocks. The slow one is validation: you complete your Self-Assessment Questionnaire, sign the Attestation of Compliance (AOC) and send it to your acquirer. The Council does not set that date; the card brands and acquirers do, and where American Express requires the SAQ AOC, it wants it “at least once per year.” The fast one is the external vulnerability scan: Requirement 11.3.2 asks for a passing scan by an Approved Scanning Vendor “at least once every three months.”

The calendar puts both clocks on one year and adds the jobs that repeat every 12 months: the policy review under Requirement 12.1.2, security awareness training under Requirement 12.6 on SAQ A-EP, C-VT, C and D, and, on SAQ D, penetration tests. Each date names the requirement it comes from, so you can find the matching question in your SAQ form. For every job that repeats, scans and reviews alike, open the PCI compliance checklist for your SAQ and switch it to “Recurring”.

How to use it

1. Pick your SAQ type. It decides which dates appear. Not sure which is yours? The SAQ type finder works it out from how you take cards.
2. Enter the date on your last signed AOC. It is on the attestation page of your SAQ. No AOC yet? Leave it empty and the calendar counts from today.
3. Say whether scans apply, then enter your last passing scan. Use the date on the passing report, not the first failed attempt. The ASV scan guide explains the report.
4. Add any date your acquirer or processor gave you. Some processors start their own clock the day the account opens; the Stax vs Square comparison shows one. The calendar keeps that date beside the yearly ones.
5. Download the .ics file, copy the list or print it. The download puts each date in your own calendar as an all-day event, with the reminder you picked.

Worked example: an online shop on SAQ A

A shop sells online and sends shoppers to its processor's hosted payment page, so it validates with SAQ A, and SAQ A's scan requirement applies. It signed its last AOC on 31 Aug 2026 and its ASV issued a passing report on 30 Nov 2026. Checked on 1 Dec 2026, the calendar gives 6 dates:

Look at the scan dates. Three months after 30 November is the end of February, so the first scan falls on 28 February. The next is counted from 30 November again, not from 28 February, so it lands on 30 May instead of drifting to the 28th for the rest of the year. Leap years work the same way: an AOC signed on 29 Feb 2028 is due again by 28 Feb 2029.

What the dates mean

A date is the last day the job can be done and still keep the clock. A missed date stays on the calendar in red, and the dates after it are counted from today, as if you did the job today. Do it, then enter the new date and the calendar rebuilds around it.

A scan date means a passing report by then, not a first attempt. In the ASV Program Guide's words, “Scan customers only submit passing scan reports (which may be comprised of multiple failed scans to demonstrate all vulnerabilities reported in the initial scan for that scan period were addressed).” Leave room to fix and rescan. Pick an ASV from the Council's list of approved scanning vendors, or see how they differ in the ASV comparison.

Three calendar months can run to 92 days. If your acquirer or card brand counts in days, switch the quarter to 90 days: American Express's Data Security Operating Policy asks for the ASV scan summary “at least once every 90 days” where the SAQ requires scans. Where the passing report goes is the brand's call: “Scan customers should contact their acquiring bank or each Participating Payment Brand to determine to whom results should be submitted.”

Where each date comes from

• SAQ + AOC. The Council does not set this date. In its words, “Compliance validation requirements are set by brands, acquirers, payment facilitators, etc.” The calendar uses 12 months after your last AOC, in line with American Express's “at least once per year”; your acquirer's date wins. What the AOC is and who signs it: the PCI attestation of compliance.
• Req. 11.3.2. External scans “At least once every three months” and “By a PCI SSC Approved Scanning Vendor (ASV).” SAQ A for v4.x includes Requirements 11.3.2 and 11.3.2.1 (external vulnerability scans) for merchants whose pages redirect to, or embed, a processor's payment page (more in PCI SAQ A). SAQ D covers every requirement. For SAQ A-EP: SAQ A-EP carries 139 requirements; check the scan questions in your SAQ A-EP form or ask your acquirer. For every other SAQ, check the scan questions in your form or ask your acquirer.
• Req. 11.4.2, 11.4.3. Internal and external penetration tests run “At least once every 12 months” and after any significant infrastructure or application change, by a qualified, independent tester (not required to be a QSA or ASV).
• Req. 12.6.3. Staff are trained “Upon hire and at least once every 12 months,” and acknowledge the security policy at least once every 12 months. What the training covers: PCI security awareness training.
• Req. 12.1.2. The information security policy is “Reviewed at least once every 12 months” and “Updated as needed to reflect changes to business objectives or risks to the environment.” Start from the PCI policy template if you have none.