Compliance / PCI DSS
Meet PCI DSS 4.0.1 without letting scope get out of hand.
Any organization that stores, processes or transmits payment card data has to comply with the Payment Card Industry Data Security Standard. Version 4.0.1 is current, and the requirements that were future-dated in version 4.0 became mandatory on March 31, 2025.
We help merchants and service providers shrink their cardholder data environment, close gaps against the standard and complete the testing it requires.
At a glance
- Set by
- PCI Security Standards Council
- Current version
- PCI DSS v4.0.1
- Validation
- Self-Assessment Questionnaire or Report on Compliance, depending on volume and card brand rules
- Testing
- Annual penetration testing and quarterly external scans by an Approved Scanning Vendor
PCI DSS
Scope is the biggest lever
The fewer systems that touch card data, the fewer controls you have to apply and prove. Tokenization, hosted payment pages and proper network segmentation can shrink the cardholder data environment considerably.
Version 4.0 also added requirements that catch many organizations off guard, such as managing and monitoring the scripts that run on payment pages (Requirements 6.4.3 and 11.6.1) and documenting targeted risk analyses to justify how often certain controls run.
How we help
Scoping and segmentation
Keep the cardholder data environment as small as possible.
- Cardholder data flow mapping
- Scope reduction strategy
- Segmentation design and segmentation testing
- Tokenization and third-party payment review
Gap assessment and remediation
Find and close gaps against version 4.0.1.
- Gap assessment against PCI DSS 4.0.1
- Targeted risk analyses
- Payment page script management
- Policy and procedure updates
- Remediation support
Required testing
The technical testing the standard calls for.
- Internal and external penetration testing (Requirement 11.4)
- Segmentation testing
- Application penetration testing
- Wireless testing
- Retesting after remediation
Validation support
Get the paperwork right the first time.
- Help choosing and completing the right SAQ
- Preparation for a QSA assessment
- Evidence preparation
- Responsibility matrices for service providers
Who completes the Report on Compliance
A Report on Compliance is completed by a Qualified Security Assessor (QSA) company. Our role is readiness and the technical testing the standard requires, working alongside the QSA you select.
Services that support this work
- Penetration Testing & Offensive SecurityPenetration testing, red teaming and adversary simulation that show what an attacker could actually reach.
- Cloud, Application & Infrastructure SecuritySecure architecture and hands-on engineering for cloud platforms, applications, networks and endpoints.
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
FAQ
Frequently asked questions
Which Self-Assessment Questionnaire do we need?
It depends on how you accept payments. A merchant that sends every card transaction to a fully outsourced payment page completes a much shorter SAQ than one that handles card data on its own servers. Your acquiring bank decides whether you can self-assess at all, so confirm with them.
How often do we need a penetration test for PCI DSS?
At least once every 12 months and after any significant change, for both internal and external testing. Service providers that rely on segmentation also have to test it every six months.
Find out where you stand on PCI DSS.
A readiness review shows what an assessor would find today and what it will take to close the gaps.