Practice

PCI DSS

The card brand requirement for anyone who stores, processes, or transmits cardholder data.

At a glance

Typical buyer: Fintech and payments companies validating as service providers
Price range: $40,000–$90,000 (Build)
Assessed by: QSA (higher levels) or self-assessment
Related frameworks: SOC 2 · NIST CSF

What it is

PCI DSS v4.0 sets twelve requirement groups covering network security, cardholder data protection, vulnerability management, access control, monitoring, and policy. Validation depends on merchant or service provider level: a self-assessment questionnaire for lower volumes, a Report on Compliance from a Qualified Security Assessor for higher ones. Scope is defined by the cardholder data environment, and reducing that scope is usually the highest-value work in the program.

Who typically needs it

Fintech and payments companies validating as service providers
Merchants whose acquirer has escalated them to a higher validation level
Platforms whose customers inherit compliance obligations from them
Companies whose card data footprint grew faster than their segmentation
Organizations facing the v4.0 future-dated requirements

What the engagement looks like

Baseline

We define the cardholder data environment, map data flows, and assess against the applicable SAQ or Report on Compliance requirements. Scope reduction analysis comes first, because every requirement applies to everything in scope.

Build

We work through segmentation, key management, logging and monitoring, and the access control requirements, and author the policy and procedure set. Where tokenization or a hosted payment page can remove systems from scope, we design that path. The v4.0 customized approach allows alternative implementations with documented risk analysis. We use it where it genuinely fits and avoid it where it adds assessor scrutiny without benefit.

Audit Sprint

We mock the QSA assessment, complete segmentation and penetration testing readiness, and manage the assessor relationship through fieldwork and the Report on Compliance.

Steady State

PCI is a continuous requirement with quarterly scanning, annual testing, and ongoing evidence obligations. We run the calendar so the annual validation is a formality.

Common failure modes

Scope defined by system inventory rather than by data flow, which understates the environment
Segmentation asserted but never tested, which fails at the assessor stage
Quarterly scans run but failing scans not remediated and rescanned within the window
Treating v4.0 future-dated requirements as optional past their effective date

Price range

Programs typically run between $40,000 and $90,000 for the Build phase, varying considerably by merchant or service provider level.

Talk to us about your PCI DSS.

Thirty minutes on the calendar, an honest read on where you stand, and a plain answer on what your next framework actually takes.

Book a consultation