PCI DSS Compliance Services: Scoping, v4.0.1 Gap Assessment, and QSA-Ready Evidence
PCI DSS compliance services for merchants, payment platforms, and service providers. We define and shrink your cardholder data environment, assess it against all 12 requirements of PCI DSS v4.0.1, and help you close the gaps. Your SAQ or QSA assessment then starts from clean, organized evidence.
What Is PCI DSS Compliance?
PCI DSS compliance means meeting the Payment Card Industry Data Security Standard, set by the PCI Security Standards Council (PCI SSC). It applies to every organization that stores, processes, or transmits cardholder data, or can affect its security. The current version is PCI DSS v4.0.1.
PCI DSS is not a law. Card brands such as Visa and Mastercard require it through their contracts with acquirers, and acquirers pass it on to merchants. Service providers are asked for it by the merchants and platforms they serve. Either way, failing to comply can mean fines, higher fees, or losing the ability to take cards.
Accredify Global's PCI DSS compliance services cover the work before validation. We scope your environment, assess gaps, support remediation, and organize evidence. We are not a QSA or an ASV. Where a QSA assessment or ASV scan is needed, we coordinate that path with qualified firms.
PCI DSS v4.0.1 in 2026: Every Requirement Is Now in Force
The transition to PCI DSS v4 is complete. Version 3.2.1 was retired on 31 March 2024. PCI DSS v4.0.1, a limited revision with clarifications, was published in June 2024. Of the 64 new requirements in version 4.0, 51 were future-dated. All of them became mandatory on 31 March 2025.
Those requirements include multi-factor authentication for all access to the cardholder data environment and controls on payment page scripts. They also add targeted risk analyses and authenticated internal vulnerability scans. In January 2025, the PCI SSC also changed SAQ A for e-commerce merchants. Three requirements were removed, replaced by a new eligibility check on script attacks.
Sources: PCI SSC: future-dated requirements · PCI SSC: v4.0.1 published · PCI SSC: SAQ A updates
Who Needs PCI DSS Compliance, and at Which Level?
Anyone who accepts, processes, or can affect card payments. Your level decides how you validate. Card brands set the levels, and your acquirer confirms yours.
| Merchant level (Visa) | Annual Visa transactions | Usual validation |
|---|---|---|
| Level 1 | Over 6 million, or escalated by Visa, for example after a breach | On-site assessment and Report on Compliance by a QSA, plus quarterly ASV scans |
| Level 2 | 1 to 6 million | SAQ, or a Report on Compliance if your acquirer requires it |
| Level 3 | 20,000 to 1 million e-commerce | SAQ and quarterly ASV scans where applicable |
| Level 4 | Under 20,000 e-commerce, or up to 1 million in total | SAQ, as set by your acquirer |
| Service providers | Level 1 over 300,000 transactions; Level 2 below | Level 1 needs a QSA Report on Compliance; Level 2 can use SAQ D |
Online stores using hosted or embedded payment pages, where script controls and SAQ choice matter most.
Software with payment features, and platforms acting as service providers. See our IT industry certification pathway.
Payment facilitators and processors, often also under central bank rules. See BACEN cybersecurity readiness and DORA readiness.
Property systems, booking engines, and front desks handling cards. See hotel and restaurant certification.
Card data taken by phone, where call recording and screen capture pull systems into scope.
Cloud, data centre, and managed security providers that customers name in their own PCI DSS assessment.
PCI DSS Compliance Requirements: The 12 Requirements, and What We Assess
Six goals and 12 requirements, tested against the evidence a QSA will ask for.
| Goal | Requirement | What we assess |
|---|---|---|
| Secure network and systems | 1. Network security controls | Firewall and cloud security group rules, and segmentation of the CDE |
| 2. Secure configurations | Hardening standards, default accounts, and configuration drift | |
| Protect account data | 3. Protect stored account data | Data retention, truncation, tokenization, and key management |
| 4. Strong cryptography in transit | TLS versions, certificate inventory, and open network paths | |
| Vulnerability management | 5. Protect against malware | Anti-malware coverage, phishing controls, and removable media |
| 6. Secure systems and software | Patching, secure development, and payment page script controls (6.4.3) | |
| Access control | 7. Restrict access by need to know | Role design and periodic access reviews |
| 8. Identify and authenticate users | MFA for all CDE access, password rules, and service accounts | |
| 9. Restrict physical access | Facility controls, media handling, and POS device inspections | |
| Monitoring and testing | 10. Log and monitor access | Log coverage, automated review, and retention |
| 11. Test security regularly | ASV scans, penetration tests, segmentation tests, and change detection on payment pages (11.6.1) | |
| Security policy | 12. Information security program | Policies, targeted risk analyses, third-party management, and incident response |
Security testing is where many programs stall. Our vulnerability assessment and penetration testing (VAPT) service covers the Requirement 11 penetration and segmentation tests.
PCI DSS Scope and Validation: CDE, SAQ Types, ROC, and AOC
Get scope and validation type right first. Every other part of PCI DSS compliance follows from them.
Common SAQ types
| SAQ A | E-commerce fully outsourced to a compliant provider, such as a redirect or iframe |
|---|---|
| SAQ A-EP | E-commerce where your site affects the payment page |
| SAQ B / B-IP | Standalone terminals, dial-out or IP-connected |
| SAQ C / C-VT | Payment applications or virtual terminals on internet-connected systems |
| SAQ P2PE | Validated point-to-point encryption solutions only |
| SAQ D | Everything else, and eligible service providers |
How scope gets smaller
- Segment the cardholder data environment from the rest of the network
- Replace stored card numbers with tokens
- Use a validated P2PE solution for card-present payments
- Move to a hosted payment page or iframe from a compliant provider
- Keep card data out of call recordings, tickets, and email
- Retire systems and data you no longer need
Validation produces a Report on Compliance (ROC) or SAQ, plus an Attestation of Compliance (AOC) you share with your acquirer or customers.
PCI DSS Compliance Checklist: Ten Questions to Answer First
If you cannot answer one of these with evidence, it belongs on your roadmap.
Scope and governance
- Do you know your merchant or service provider level?
- Has your acquirer confirmed your validation method?
- Is your cardholder data environment documented with data flow diagrams?
- Do you know which third parties can affect card data security?
- Have you completed the targeted risk analyses v4 requires?
Controls and evidence
- Is multi-factor authentication in place for all CDE access?
- Do you inventory and authorize every script on payment pages?
- Have you passed four quarterly ASV scans in the last year?
- Was your last penetration test within 12 months, including segmentation?
- Are logs reviewed with automated tools, and kept for a year?
How Our PCI DSS Compliance Services Work
Six stages from scoping call to a validation-ready environment.
Not sure which SAQ applies, or whether you need a QSA? A free scoping review answers that first.
Book a free scoping reviewWhat Our PCI DSS Consulting Improves
The outcomes security, payments, and finance teams care about most.
A smaller cardholder data environment means fewer systems, fewer requirements, and a cheaper assessment.
Gaps found and fixed before a QSA sees them, with evidence already mapped to each requirement.
The correct SAQ, or a clear case for a Report on Compliance, agreed with your acquirer.
Evidence shared with SOC 2, ISO 27001 certification, and the NIST Cybersecurity Framework.
Cost of PCI DSS Compliance Services, and Timeline
There is no list price for PCI DSS compliance services. The cost follows your level, payment channels, and the size of your cardholder data environment. A free scoping review gives you a tailored proposal.
What moves the cost
- Level and validation — an SAQ, or a QSA Report on Compliance
- Payment channels — e-commerce, card-present, phone, or all three
- CDE size — systems, locations, and cloud accounts in scope
- Third parties — processors, hosting, and service providers to review
- Reuse — SOC 2, ISO 27001, or earlier PCI DSS evidence
QSA fees, ASV scans, and penetration tests are separate costs. We scope them with you at the start.
How long it takes
| Scoping and gap assessment | First, and sets the rest of the plan |
|---|---|
| Remediation | Driven by your findings and team capacity |
| Validation | Yearly SAQ or ROC, plus quarterly ASV scans |
Your proposal sets dates for each stage, working back from your acquirer's or customer's deadline.
PCI DSS vs SOC 2, ISO 27001, and NIST CSF
These frameworks overlap, but PCI DSS is the only one card brands and acquirers accept for card data.
| Framework | What it is | How it relates to PCI DSS |
|---|---|---|
| SOC 2 | A CPA attestation for service organizations | Shares many controls. Service provider customers may ask for both. |
| ISO 27001 | A certifiable information security standard | Broad risk-based program. PCI DSS adds prescriptive controls for the CDE. |
| NIST CSF 2.0 | A US voluntary cybersecurity framework | A useful structure; it does not validate PCI DSS compliance. |
| GDPR and LGPD | Data protection laws | Card data is personal data, so a breach can trigger both. |
How to Choose PCI Compliance Consultants
The questions worth asking before you sign, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Are you a QSA? | No. We prepare you for validation and coordinate with qualified QSA firms. |
| Can you run our ASV scans? | No. ASV scans must come from an Approved Scanning Vendor. We coordinate them. |
| Do you work to PCI DSS v4.0.1? | Yes, including every requirement in force since 31 March 2025. |
| Will you help reduce our scope? | Yes. Scope reduction is the first thing we look at. |
| Can you do penetration testing? | Yes, through our VAPT service, covering Requirement 11. |
| How is it priced? | A tailored proposal after a free scoping review. |
What You Receive From PCI DSS Compliance Services
Your CDE, connected systems, and card data flows.
Choices compared by effort and requirements removed.
Where you stand on each of the 12 requirements.
Actions in priority order, with owners and dates.
Organized by requirement, ready for your SAQ or QSA.
QSA, ASV, and penetration testing lined up.
Frequently Asked Questions About PCI DSS Compliance
Straight answers on requirements, levels, SAQs, QSAs, v4.0.1, cost, and timeline.
What is PCI DSS compliance?
PCI DSS compliance means meeting the Payment Card Industry Data Security Standard, set by the PCI Security Standards Council. It applies to any organization that stores, processes, or transmits cardholder data, or can affect its security. The current version is PCI DSS v4.0.1.
Who needs PCI DSS compliance?
Any merchant that accepts card payments, and any service provider that handles card data or can affect its security. That includes payment processors, hosting and cloud providers, call centres, and software companies with payment features. Your acquirer or the card brands decide how you must validate.
What are the 12 PCI DSS requirements?
The 12 requirements sit under six goals. They cover network security controls, secure configurations, protecting stored data, and encrypting transmission. They also cover malware protection, secure software, access control, authentication, physical security, logging, security testing, and a security policy program.
What changed in PCI DSS v4.0.1?
PCI DSS v4.0.1, published in June 2024, is a limited revision of v4.0 with clarifications. The bigger change came from v4.0 itself. Its 51 future-dated requirements became mandatory on 31 March 2025, including stronger authentication and payment page script controls.
What are the PCI compliance levels?
Card brands set merchant levels by annual transaction volume. Under Visa's scheme, Level 1 is over 6 million transactions a year, and Level 4 is the smallest merchants. Level 1 merchants usually need an on-site assessment by a QSA; smaller merchants usually complete a Self-Assessment Questionnaire.
What is a Self-Assessment Questionnaire (SAQ)?
An SAQ is the self-validation form for merchants and service providers that are not required to have an on-site assessment. There are several types, such as SAQ A, A-EP, B, C, P2PE, and D. The right one depends on how you accept and handle card payments.
What changed for SAQ A in 2025?
In January 2025, the PCI SSC removed requirements 6.4.3, 11.6.1, and 12.3.1 from SAQ A. In their place, merchants must confirm their site is not susceptible to script attacks that could affect their e-commerce systems. The change took effect on 31 March 2025.
What is the difference between a QSA and a PCI compliance consultant?
A Qualified Security Assessor (QSA) is certified by the PCI SSC to assess compliance and sign a Report on Compliance. A PCI compliance consultant helps you scope, close gaps, and prepare evidence before that assessment. Accredify Global works on the preparation side.
Is Accredify Global a QSA?
No. Accredify Global is not a QSA or an ASV. We scope your environment, assess gaps against PCI DSS v4.0.1, support remediation, and prepare evidence. Where a QSA assessment or ASV scan is required, we coordinate that path with qualified firms.
Is there a PCI DSS certification?
Not in the sense of a certificate from the PCI SSC. Compliance is validated with a Report on Compliance (ROC) or an SAQ, plus an Attestation of Compliance (AOC). People often call the AOC a PCI certificate.
What is an Attestation of Compliance (AOC)?
An AOC is the signed declaration of your PCI DSS compliance status. It accompanies a Report on Compliance or an SAQ. Merchants give it to their acquirer, and service providers give it to their customers.
How do you reduce PCI DSS scope?
Scope shrinks when fewer systems can touch card data. Common methods are network segmentation, tokenization, point-to-point encryption (P2PE), and hosted payment pages from a compliant provider. A smaller cardholder data environment means fewer requirements to meet and evidence.
How much does PCI DSS compliance cost?
The cost depends on your merchant or service provider level, how you accept payments, and the size of your cardholder data environment. The number of gaps to close also matters. Accredify Global reviews your scope for free and sends a tailored proposal.
How long does PCI DSS compliance take?
It depends on your validation type and your gaps. A scoping and gap assessment comes first. Remediation time depends on your findings, and QSA or SAQ validation follows. Accredify Global sets the timeline in your proposal.
What happens if you are not PCI compliant?
PCI DSS is enforced through contracts, not law. Card brands can fine acquirers, which usually pass fines on to merchants. Non-compliant merchants may also face higher fees, liability for fraud losses after a breach, or loss of card acceptance.
Does PCI DSS require penetration testing?
Yes. Requirement 11 includes internal and external penetration testing at least every 12 months and after significant changes. It also requires segmentation testing and quarterly external vulnerability scans by an Approved Scanning Vendor.
How does PCI DSS relate to ISO 27001 and SOC 2?
They overlap in areas such as access control, logging, and risk management. PCI DSS is more prescriptive and applies only to the cardholder data environment. ISO 27001 and SOC 2 evidence can be reused, but they do not replace PCI DSS validation.
Get PCI DSS Compliance Services That Shrink Your Scope Before Your QSA Arrives
Tell us how you take card payments, your level, and your deadline. We'll confirm your validation path, recommend a plan, and send a tailored proposal.
Book your free scoping review →