PCI DSS v4.0.1
Mandatory if you store, process or transmit card data. We shrink scope to the minimum and prepare the SAQ or QSA audit.
PCI Security Standards Council
- What is at stake
- Mandatory if you process card payments
Who it applies to
- Online and in-store merchants
- Payment gateways and providers
- Call centres taking phone payments
Typical timeline
3 to 6 months
PCI Security Standards Council
In detail
If you touch card data, you must comply.
PCI DSS is the security standard created by Visa, Mastercard, American Express, Discover and JCB. It applies to any entity that stores, processes or transmits cardholder data, from an online shop to a payment processor.
The current version, 4.0.1, has 12 requirements grouped into six objectives. Since 31 March 2025, requirements that were previously best practice became mandatory, such as MFA for all access to the cardholder data environment and protection of scripts on payment pages.
The validation level depends on transaction volume: large merchants need a report from a QSA, while small ones can use a Self-Assessment Questionnaire (SAQ).
Real scenarios
Where we usually help.
Reducing scope
Tokenising or outsourcing payment to a gateway can cut compliance from hundreds of controls to a few dozen.
Web skimming
Requirements 6.4.3 and 11.6.1 require inventorying and monitoring payment page scripts to prevent Magecart-style attacks.
Choosing the right SAQ
There are nine questionnaire types. Picking the wrong one is one of the most common and costly mistakes.
What you get
What you will have at the end.
- Scope definition and reduction
- Gap analysis against PCI DSS 4.0.1
- Verified network segmentation
- Internal and external pentest of the environment
- Quarterly ASV scans
- SAQ or support for the QSA ROC
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
PCI DSS
What we focus on
- 01
Scope reduction and segmentation
- 02
Quarterly ASV scans
- 03
Annual and post-change pentests
- 04
New version 4.0 requirements
PCI DSS v4.0.1
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for PCI DSS v4.0.1 cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
I use Stripe, do I still need to comply?
Yes, but far less. If payment happens on the provider’s hosted page or iframe, SAQ A is usually enough and has few requirements.
What if I don’t comply?
Your acquiring bank can apply penalties, raise fees or withdraw card acceptance, and after a breach you will bear the costs.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.