PCI DSS 4.0.1 Readiness
179 questions across Requirements 1 to 12 of PCI DSS 4.0.1, answered before an assessor is engaged.
179 controls · 12 pillars · 44 categories · evidence can be collected automatically
179 questions across Requirements 1 to 12 of PCI DSS 4.0.1, answered before an assessor is engaged.
179 controls · 12 pillars · 44 categories · evidence can be collected automatically
PCI DSS is contractual rather than statutory: your acquirer and the card brands require validation, and the consequences of missing it are commercial and immediate. Version 4.0.1 moved several expectations from recommended to required and opened a targeted risk analysis route for others, so an organisation that validated comfortably two years ago can be short now. This review finds out where you stand before an assessor arrives on a clock you are paying for.
179 questions across all 12 requirements and 44 categories, with Requirement 12 the largest at 22 questions because scope, third-party providers and the programme around them all live there. Read-only collector scripts supply the cloud and repository evidence; the rest is worked through with your network, platform and payments owners, and nothing is deployed into the cardholder data environment to do it. Every answer is tied to the requirement it addresses, so the result drops into the evidence pack a self-assessment questionnaire or a Report on Compliance will need.
The questions go at what actually fails an assessment: whether a network security control sits at every boundary into the cardholder data environment, including the boundaries cloud services quietly create; whether a written hardening standard exists for every type of component in scope, cloud platform services included; and whether you know every place account data has come to rest, counting logs, backups, support tickets and cloud storage. Requirement 3 is scored on retention, on how data is rendered unreadable and on key management; Requirement 4 on strong cryptography in transit and on certificate trust; Requirement 10 on log coverage, content, protection, review, time sources and retention; Requirement 11 on scanning and penetration-test cadence, change detection and payment page integrity. Evidence is read-only collector output against cloud control planes and repository settings, plus rule-set exports, hardening standards and key-management records you show the assessor.
179 controls across 12 pillars and 44 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
Read-only collector scripts run in your own tenancy against AWS, Azure, GCP, GitHub and Azure DevOps supply the configuration evidence, and each signal is mapped to the questions it evidences as a suggested score the assessor accepts or overrides.
It cannot stand in for evidence only an approved party can produce, such as an external scan from an Approved Scanning Vendor or a Report on Compliance from a Qualified Security Assessor.
Card data is the business, so a validation slip is a commercial event with an acquirer rather than an internal security finding.
A public body taking card payments for services puts the whole environment behind that one payment page in scope, which is rarely how it was designed.
Health and education providers take card payments beside systems holding far more sensitive data, and the two environments are seldom segmented as cleanly as the diagram claims.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is standard at 179 controls.
£3,500
Per engagement, excluding VAT.
£9,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.