PCI DSS compliance, scoped down to what matters.
If you take, process or influence card payments, your bank and card brands expect you to meet PCI DSS. We work out exactly what is in scope, shrink it where we can, and get you to a defensible result with the least effort.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day
Usually, one of these is true.
We are not a Qualified Security Assessor. We do the scoping, readiness and remediation work, and a QSA firm performs any formal Report on Compliance.
- Your acquiring bank or payment processor has asked for an attestation of compliance or a self-assessment questionnaire.
- You take card payments on a website, in a clinic or office, or through a platform, and are not sure which questionnaire applies.
- You are a service provider, SaaS or billing company and your customers are asking for your PCI evidence.
- You have moved to PCI DSS v4.0.1 requirements and want a clear plan rather than a spreadsheet of unknowns.
PCI DSS at a glance
| Topic | What to know |
|---|---|
| The standard | PCI DSS v4.0.1, built around twelve principal requirements covering network security, data protection, access control, monitoring and testing, and policy. |
| Who sets the rules | The PCI Security Standards Council writes the standard. Your acquiring bank and the card brands decide what you must validate and how. |
| How you validate | Most smaller merchants complete a self-assessment questionnaire (SAQ). Larger merchants and many service providers need a Report on Compliance from a Qualified Security Assessor. |
| Biggest lever | Scope. Using a hosted or redirected payment page, and keeping card data out of your systems, can shrink the work dramatically. |
From scoping to your attestation.
Scope and data-flow review
Find every place card data is stored, processed or transmitted, and every system that can affect it.
Reduce scope
Remove or outsource card handling where practical, for example with a hosted payment page, tokenisation or network segmentation.
Choose and complete the right SAQ
Pick the questionnaire that matches how you actually take payments, and complete it with evidence rather than guesses.
Gap assessment and remediation
Test against the requirements, rank the gaps and fix them, including the requirements that became mandatory in v4.0.1.
Attestation and ongoing upkeep
Prepare your attestation, coordinate with your assessor or acquirer where one is required, and set up the quarterly and annual tasks the standard expects.
Deliverables you can hand to an auditor.
Scoped on the free call and agreed as a fixed fee. Start with an Assess project, then Build and Manage as you need them.
- Cardholder data-flow diagram and scope statement
- Scope-reduction options with a recommendation
- SAQ selection and completion support
- Gap assessment against PCI DSS v4.0.1
- Remediation plan with owners and dates
- Evidence calendar for scans, reviews and policy updates
Questions about PCI DSS.
Which questionnaire do we need?
It depends on how you take payments. A business that sends customers to a processor’s hosted page usually has far less to do than one that handles card numbers on its own systems. The scoping step settles this before you spend anything.
Do we need a QSA?
Some larger merchants and many service providers do, and your acquiring bank will say so. Many smaller merchants complete a self-assessment instead. We tell you which applies and help you prepare either way.
What if we only use Stripe or another processor?
That can reduce your scope considerably, but it does not remove it. You still have to validate your own compliance and keep your site and staff secure. We confirm the right questionnaire for your set-up.
Can this reuse our SOC 2 or ISO 27001 work?
Largely. Many controls overlap, so one control set can be mapped to PCI DSS, SOC 2 and ISO 27001 instead of starting again.
Related: SOC 2 readiness · Vulnerability management
Start with a free conversation about PCI DSS.
A free 30-minute conversation to agree what matters most and what to do first. If you would like to prepare, answer the short questionnaire beforehand.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day