Beyond SOC 2
How do fintech companies handle SOC 2 plus PCI DSS evidence?
October 20, 20252 min read
SOC 2 + PCI DSS: The Overlap
About 40-50% of controls overlap between SOC 2 and PCI DSS. Both require access controls, encryption, change management, and logging. But PCI DSS has more prescriptive requirements, specific encryption algorithms, network segmentation rules, and vulnerability scanning frequencies.
Shared Controls
| Control Area | SOC 2 | PCI DSS | Shared Evidence |
|---|---|---|---|
| Access control | CC6.1 | Req. 7, 8 | User access reviews, MFA, RBAC |
| Encryption | CC6.7 | Req. 3, 4 | Encryption at rest and in transit |
| Change management | CC8.1 | Req. 6 | PR reviews, deployment controls |
| Logging | CC7.1-7.2 | Req. 10 | Audit trails, log monitoring |
| Vulnerability management | CC7.1 | Req. 5, 6, 11 | Scanning, patching |
| Incident response | CC7.3-7.5 | Req. 12 | IRP, incident documentation |
PCI DSS-Specific Requirements
| PCI Requirement | What It Adds Beyond SOC 2 |
|---|---|
| Cardholder Data Environment (CDE) scoping | Define exactly where card data flows |
| Network segmentation | Isolate systems handling card data |
| Specific encryption standards | TLS 1.2+, AES-256 for card data specifically |
| Quarterly ASV scans | External vulnerability scans by approved vendor |
| Annual penetration test | Required (not just recommended) |
| PAN masking/tokenization | Display only last 4 digits, or tokenize card numbers |
| Key management | Formal cryptographic key management procedures |
The Fintech Strategy
If You Use Stripe or Similar
If you use Stripe, Braintree, or another PCI-compliant payment processor, your PCI scope is minimal:
- You never touch cardholder data directly
- Stripe's SAQ-A or SAQ-A-EP applies (simplified self-assessment)
- Focus SOC 2 on your application security and customer data protection
- PCI effort: 1-2 days for the SAQ
If You Handle Card Data Directly
If your application processes, stores, or transmits cardholder data:
- Full PCI DSS assessment required
- Scope your CDE carefully to minimize the assessment boundary
- Network segmentation is critical for reducing scope
- Consider tokenization to remove card data from your environment
Evidence Organization
Use a unified evidence library tagged for both frameworks. A single access review screenshot satisfies SOC 2 CC6.1 and PCI DSS Requirement 7.1, don't collect it twice.