PCI DSS Readiness

Overview

Walk into your PCI audit prepared.

PCI DSS readiness focuses on minimising your cardholder data environment and implementing the controls before the formal QSA assessment, so the audit is a validation rather than a discovery exercise.

We map your environment, drive scope reduction through segmentation and tokenisation, implement the required controls, and run a gap assessment so you’re ready for the Report on Compliance.

What’s covered

What we assess and prepare.

Cardholder data discovery

Finding where card data lives.

Scope reduction

Segmentation and tokenisation strategies.

Control implementation

Across the twelve PCI requirements.

Policy & evidence

Documentation for the assessment.

Pre-assessment gap review

Readiness for the QSA.

Who needs this

Is this the right fit?

The organisations that most often turn to this engagement.

New merchants in PCI scopeFirst-time compliance.

Companies before a QSA auditPre-assessment preparation.

Growing payment volumesMoving up PCI levels.

SaaS adding card paymentsNew cardholder data flows.

Service providersClient PCI requirements.

Any org entering PCI scopeReadiness for validation.

Regulatory drivers

Why this is required

Reaching PCI DSS compliance is rarely a single step; readiness closes the gap before a formal assessment so the QSA engagement runs smoothly. It applies to anyone storing, processing or transmitting cardholder data.

PCI DSS v4.0

The twelve requirements you are preparing to be assessed against.

Acquirer requirements

Your acquirer sets the validation level and timeline you must meet.

v4.0 future-dated requirements

Several requirements became mandatory in 2025 and must be built into your readiness.

How we work

Our consistent, repeatable process.

A controlled process that delivers an outcome you can defend.

Scoping & CDE definition

Defining the cardholder data environment in scope.

Gap assessment

Assessing current state against the twelve PCI DSS requirements.

Remediation planning

A prioritised plan to close the gaps found.

Control implementation support

Hands-on help to implement the required controls.

Evidence & internal validation

Collecting evidence and validating readiness internally.

QSA-assessment handoff

Preparing you for the formal QSA assessment.

What you receive

Documentation built for every audience.

CDE gap assessmentYour posture against the twelve PCI DSS requirements.
Remediation roadmapA prioritised plan to close gaps.
Policy & evidence templatesPCI documentation to build on.
Implementation trackerProgress tracked to readiness.
Pre-assessment sign-offConfirmation you are ready for the QSA.

Standards & frameworks

Aligned throughout to the standards and regulations that matter for you.

PCI DSS v4.0OWASPNISTCIS Benchmarks

FAQ

Common questions

Why focus on scope reduction?

The smaller your cardholder data environment, the fewer systems and processes fall within PCI scope — which cuts the number of requirements that apply, along with the cost, risk and effort of compliance. Techniques like segmentation, tokenisation and not storing card data where you don’t need to can dramatically shrink scope, so we tackle it early.

Will the same firm do the audit?

Readiness and the formal QSA assessment are kept appropriately separated to preserve independence, but we can support you across both stages. We prepare you fully during readiness, and where appropriate carry out the QSA-led assessment, so you have continuity without compromising the integrity of the result.

Which version do you prepare us for?

We prepare you for PCI DSS v4.0, the current version of the standard, including the requirements that became mandatory in 2025. If you are transitioning from an earlier version, we make sure your controls and evidence meet the v4.0 expectations.

How long does PCI DSS readiness take?

It depends on your environment and the size of your cardholder data environment, but most readiness engagements run from a few weeks to a couple of months — reducing scope early shortens it.

Do we self-assess with an SAQ, or need a QSA?

It depends on how you handle card data and your transaction volume. We confirm whether you qualify for a Self-Assessment Questionnaire (and which type) or require a QSA-led Report on Compliance, and prepare you for the right path.

What is new in PCI DSS v4.0?

v4.0 introduces a more outcome-focused “customised approach”, stronger authentication and scoping expectations, and several future-dated requirements that became mandatory in 2025. We build your readiness around them.