Scope confirmed, not assumed
Confirmed every 12 months and after significant change; every 6 months for service providers.
What assessors look forDiagrams that match reality and a reason for every boundary.
Payment security · Core service
PCI DSS assessment that starts with the right scope.
A defensible cardholder data environment, every v4.0.1 gap closed and a Report on Compliance your acquirer accepts first time.
- PCI DSS v4.0.1
- ROC & SAQ
- Merchants & service providers
- Who it serves
- Merchants, processors, gateways, acquirers, issuers and SaaS platforms
- Standard
- PCI DSS v4.0.1, the only active version
- Our role
- Readiness, gap assessment, remediation and SAQ support from CISA- and CISM-certified practitioners
- You receive
- Scope rationale, gap assessment, roadmap, remediation support and an evidence index ready for your QSA
The business challenge
Compliance is no longer an annual event.
Assessors no longer ask whether a control was in place on the day. They ask whether it operated, at the frequency you chose, all year.
Since 31 March 2025 the future-dated requirements apply in full, and they are the hardest to evidence. A narrower, well-evidenced scope is the most effective way to cut both risk and cost.
- Principal requirements
- 12
- Future-dated controls in force since
- 2025
- Months between scope checks for service providers
- 6
- Payment-page script controls added
- 2
The most expensive mistakes in PCI DSS are scoping mistakes. Everything downstream inherits them.
What a well-run program gives you
01
A scope you can defend
Data flows, discovery results and segmentation evidence for every boundary.
02
No surprises at validation
Gaps found, fixed and retested months before fieldwork.
03
Evidence that runs itself
A calendar tied to your risk analyzes, so year two costs less.
04
Payment pages under control
Script inventory and tamper detection against e-skimming.
Requirements in focus
The v4.0.1 requirements that decide assessments.
The ones organizations underestimate, and what an assessor will ask to see.
Targeted risk analyzes
Where you choose a control’s frequency, a documented analysis must justify it.
What assessors look forA reasoned analysis for each requirement, never a template.
Payment-page scripts
Every script authorized, integrity-assured and inventoried with a justification.
What assessors look forA live inventory and the integrity mechanism in use.
Change and tamper detection
Unauthorised changes to payment pages and headers detected and alerted.
What assessors look forThe mechanism, alert routing and triaged alerts.
Authenticated scanning
Internal scans run with the privileges an attacker with a foothold would have.
What assessors look forCredentialed configuration and coverage reconciled to inventory.
MFA for all CDE access
Every non-console route into the CDE, including internal administrative access.
What assessors look forAuthentication flows for each path, including break-glass.
Choose the right validation route
Your acquirer or the card brands set the route. Your architecture decides SAQ eligibility.
| Route | Typically suits | What to watch |
|---|---|---|
| SAQ A | Fully outsourced e-commerce payment pages | New script-attack eligibility criterion |
| SAQ A-EP | Sites that affect payment-page security | 6.4.3 and 11.6.1 apply in full |
| SAQ B / C / P2PE | Terminals, payment applications, listed P2PE | Isolation, hardening and listings |
| SAQ D | Everyone else eligible to self-assess | Often a sign scope can be reduced |
| Report on Compliance | Higher-volume merchants and service providers | Issued by a QSA company |
A guide only. Each SAQ, and your acquirer or payment brand, defines eligibility.
Interactive demonstration
Walk through a PCI DSS assessment.
Turn segmentation off and watch the scope grow. Then advance the evidence cycle, open the findings and read the board summary.
Loading interactive demonstration…
Every asset, finding and score in this panel is synthetic and generated in your browser. Nothing is scanned, collected or sent.
Our methodology
Five phases, built around scope.
Every phase begins by asking whether the boundary still holds.
- Phase 01
Discover
Trace account data from capture to deletion; discover it where it should not be.
- Phase 02
Assess
Test every requirement against v4.0.1 procedures across the whole period.
- Phase 03
Remediate
Reduce scope first, then fix the controls hardest to evidence.
- Phase 04
Validate
Retest and index the evidence for formal validation.
- Phase 05
Sustain
Evidence calendar, quarterly scope checks and change reviews.
PCI DSS gap & readiness
A full rehearsal, before the verdict.
The right first step before a first v4.0.1 assessment, after an architecture change, or when you want to retire compensating controls.
Request a readiness assessment01
Scope and segmentation baseline
Data-flow mapping and card-data discovery, settled before testing.
02
Requirement-level gap assessment
Each sub-requirement rated in place, partial or not in place.
03
Risk analyzes and customized approach
The 12.3.1 analyzes your frequencies depend on.
04
Remediation roadmap
Owners, acceptance criteria and a date you can share with your acquirer.
Capabilities
Everything a PCI program needs, one methodology.
One team from scoping to attestation, so findings and fixes stay aligned.
Formal assessment readiness
Evidence prepared, indexed and rehearsed with your team before your QSA arrives.
SAQ selection and completion
The right SAQ, with evidence behind every “yes” and an AOC ready to sign.
Card-data discovery
Finding account data in logs, tickets and backups, then designing it out with tokenization or P2PE.
Penetration and segmentation testing
Requirement 11.4 testing, including segmentation from every out-of-scope network.
Penetration testingPayment-page script security
Inventories, integrity enforcement and tamper detection for 6.4.3 and 11.6.1.
Service provider obligations
Responsibility matrices, executive accountability and six-monthly reviews.
Deliverables
What you will hold at the end
Scope document and data flows
Every flow and boundary, with its rationale.
Gap assessment
Status and evidence gap per sub-requirement.
Targeted risk analyzes
Ready for annual review.
Remediation roadmap
Owners, criteria and retest dates.
Evidence index
Mapped to testing procedures.
Executive summary
Scope, readiness and decisions required.
Framework mapping
Where PCI work also serves other obligations.
Map once, and record every difference in scope and frequency.
| Control area | ISO/IEC 27001:2022 | SOC 2 | NIST CSF 2.0 | DORA |
|---|---|---|---|---|
| Segmentation & firewalls (Req. 1) | Directly addressed | Directly addressed | Directly addressed | Partially addressed |
| Stored account data (Req. 3) | Partially addressed | Partially addressed | Partially addressed | Partially addressed |
| Secure development & scripts (Req. 6) | Directly addressed | Partially addressed | Partially addressed | Not addressed– |
| MFA & access control (Req. 7–8) | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Logging & review (Req. 10) | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Scanning & penetration testing (Req. 11) | Directly addressed | Partially addressed | Directly addressed | Directly addressed |
Directly addressed Partially addressed or different evidence expectations , Not a primary objective. PCI DSS evidence is scoped to the CDE; other frameworks may require the control across a wider estate.
Industry considerations
Same standard. Different environments.
Terminals, web, apps and contact centers: each channel carries its own scope.
- Script control on checkout, including tag managers
- Terminal inventories and tamper inspection
- Retail & e-commerce
Your AOC is a sales document as much as a compliance one.
- Six-monthly scope and segmentation testing
- Responsibility matrices customers can rely on
- FinTech & payments
PCI DSS alongside PIN, card production and HSM estates.
- Legacy mainframe and batch flows
- Alignment with DORA and SWIFT CSCF
- Banking & financial services
Billing and booking platforms are often service providers without realizing it.
- Cloud-native CDEs and shared responsibility
- PCI DSS and SOC 2 in one evidence cycle
- Technology & SaaS
Technologies & risks
Where card data is attacked, and how scope shrinks.
E-skimming
Malicious JavaScript copies card data as it is typed. It is the reason 6.4.3 and 11.6.1 exist.
Tokenization
Keeps analytics, CRM and support tools out of scope when detokenisation is restricted.
Point-to-point encryption
A listed P2PE solution encrypts in the terminal and shrinks the merchant’s scope.
Cloud-native CDEs
Namespaces, meshes and serverless need their own segmentation evidence.
Engagement journey
From first call to Attestation.
A typical first year. Later years compress the early stages.
-
01
Scoping call
Channels, volumes and validation level.
OutputProposal
-
02
Discovery
Data-flow workshops and card-data discovery.
OutputScope document
-
03
Gap assessment
Testing against v4.0.1 procedures.
OutputWorkbook and roadmap
-
04
Remediation
Working sessions and retests.
OutputClosed findings
-
05
Validation
ROC or SAQ validation.
OutputAOC
Accreditation & scope
What you get from one firm
What MarkTillson delivers
- Readiness and remediation that carry you to a clean ROC with your QSA
- External scan readiness and dispute evidence
- Readiness, gap assessment and SAQ support
- Scoping, card-data discovery, penetration and segmentation testing
Across the wider PCI family
- P2PE, PIN, 3DS, SSF and card production readiness, prepared for the specialist assessment each standard requires
Every proposal sets out the deliverables, the team and the dates before work begins.
FAQs
Questions we are asked.
Do we need a Report on Compliance or can we self-assess?
Your acquirer (for merchants) or the payment brands (for service providers) decide, usually by volume and risk. Start with their written requirement, and we will confirm which SAQ, if any, you are eligible for.
Who signs our Report on Compliance?
Your ROC is signed by an independent QSA company. We take you from scoping to a fieldwork-ready evidence pack, so the assessment confirms what you already know.
What is the customized approach?
It lets you meet a requirement’s objective with a different control, backed by a controls matrix and a targeted risk analysis. It suits mature organizations. It is not a shortcut around a hard requirement.
How does segmentation reduce scope?
Tested segmentation shows out-of-scope networks cannot reach the CDE. Testing is required at least annually for merchants and every six months for service providers.
We use a provider’s hosted form. Do 6.4.3 and 11.6.1 apply?
For SAQ A they were replaced by an eligibility criterion in January 2025. For SAQ A-EP, SAQ D and ROCs they apply in full. Read our analysis.
Can the team that helps us remediate also assess us?
Yes. Readiness and assessment run as separate workstreams, so the advice you act on and the report you receive both stand up to scrutiny.
Related services and insights
Speak with a PCI expert
Bring us your scope. We’ll show you what we see.
Share your payment channels and validation requirement. A senior practitioner will reply with a first view of your scope, usually within one business day.