Overview
Card data breaches cost
more than compliance does.
Payment Card Industry Data Security Standard compliance is mandatory for any organisation that stores, processes, or transmits cardholder data. Non-compliant merchants face fines from Rs.5 lakh to Rs.1 crore per month from acquiring banks, and card brands can terminate processing rights. Following a breach, non-compliant organisations face forensic assessment costs on top of the breach costs.
Our assessment maps all 12 PCI-DSS v4.0 requirement groups against your current environment, determines your correct Self-Assessment Questionnaire type, identifies compensating controls where full compliance is not feasible, and produces your compliance roadmap.
Why This Matters
PCI-DSS v4.0 introduced 64 new requirements effective March 2025. Many merchants who were compliant under v3.2.1 have gaps under v4.0. Our assessment specifically checks v4.0 delta requirements including customised approach controls and enhanced authentication requirements.
What We Audit
🌐
Network Security
Firewalls, network segmentation, and cardholder data environment boundary controls reviewed (Req 1-2).
🔒
Cardholder Data Protection
Data discovery, storage minimisation, encryption at rest and in transit reviewed (Req 3-4).
🛡
Vulnerability Management
Antimalware, patching cadence, and web application security reviewed (Req 5-6).
👤
Access Control
Least privilege, MFA, physical access, and user account management reviewed (Req 7-9).
📊
Monitoring and Testing
Audit logs, IDS/IPS, penetration testing programme, and change detection reviewed (Req 10-11).
📋
Information Security Policy
Security policy, risk assessment programme, and third-party management reviewed (Req 12).
What You Receive
PCI-DSS Gap Report - All 12 requirement groups assessed with compliance status per sub-requirement.
SAQ Type Determination - Correct SAQ type identified (A, A-EP, B, B-IP, C, C-VT, D, P2PE) for your environment.
Scope Reduction Recommendations - Network segmentation and tokenisation opportunities identified to reduce PCI scope.
v4.0 Delta Assessment - New v4.0 requirements specifically assessed if upgrading from v3.2.1.
Compensating Controls - Where full compliance is not feasible, documented compensating controls framework.
30-Day Support - QSA selection guidance and SAQ completion advisory at no additional charge.