PCI DSS Readiness
01
Prepare your payment environment for PCI DSS v4.0.1 validation with a defined readiness plan. We map your cardholder data, identify defensible ways to reduce scope, assess all 12 requirements for applicability and coordinate the evidence needed for your scans, penetration tests and SAQ or ROC. We start with your existing payment architecture and focus changes on the gaps that matter, helping you avoid unnecessary disruption to checkout and payment operations.
Your acquirer’s request and validation deadline shape the plan. Temi leads every engagement personally. You receive a fixed-price proposal within 24 hours of your free strategy call, with clear deliverables and responsibilities before work begins.
02
Move forward with a clear, complete PCI DSS readiness report, backed by 30 days of follow-up access and complimentary refinements to the agreed deliverables.
100+ Assessments Led Across Frameworks · 20+ Years of Experience · 12 PCI DSS Requirements Reviewed for Applicability · 30 Days of Follow-Up Access
03
Temi brings over two decades of experience across technology, financial services, healthcare and media, including consulting engagements with Fortune 100 companies such as Amazon, Walgreens and Humana. Temi has led over 100 assessments across security and compliance frameworks.
You work directly with Temi on payment scope, control gaps and evidence preparation, with Temi participating in your engagement calls and coordinating the agreed assessment preparation.
04
Readiness connects the requirement from your bank or customer to the work your team needs to complete. We map payment data, evaluate scope-reduction options, check your proposed validation route and review evidence against applicable PCI DSS requirements. Your gap register and remediation roadmap identify priorities, owners and the records needed to demonstrate progress.
We help organize the assessment handoff and applicable scanning and testing dependencies. Your implementation owners make the required operational changes; your validation program determines the reporting route and authorized assessors and signatories. This gives each participant a clear role as you work toward an SAQ or ROC and the corresponding AOC.
05
The Payment Card Industry Data Security Standard is maintained by the PCI Security Standards Council. It applies to entities that store, process or transmit cardholder data or sensitive authentication data, and to entities that can affect the security of the cardholder data environment. Payment brands and acquiring banks administer their compliance programs and validation requirements.
PCI DSS v4.0.1 is the current standard. Its 12 requirements sit under six security goals. Getting scope right is essential: connected systems and systems that can affect payment security may matter even when they do not store card numbers. We evaluate segmentation, tokenization, validated point-to-point encryption and outsourced payment flows against your actual architecture and eligibility.
06
PCI DSS v4.0.1 groups its 12 requirements under six security goals. We review each requirement against your payment environment, identify what applies and examine the controls and evidence already in place. Your roadmap explains the gaps, the changes needed and how your team will demonstrate that the controls work.
Requirements 1 and 2. Network security controls define which connections can reach your payment environment, while secure configurations protect the systems inside it. We review firewall rules, network boundaries, hardening standards and vendor-default settings. Where segmentation supports a smaller scope, the boundary must be effective and supported by evidence, rather than simply shown on a diagram.
Requirements 3 and 4. Retain only the account data your business needs and protect what remains, including stored card numbers and the cryptographic keys used to secure them. Cardholder data sent across open or public networks requires strong cryptography. We examine storage, retention, deletion and transmission paths, including opportunities to remove unnecessary card data and reduce the systems your team must protect.
Requirements 5 and 6. Malware protection, timely remediation and secure software practices work together to reduce exploitable weaknesses. We review applicable malware defenses, patching, software development and change-control evidence, including payment-page protections where required. The roadmap connects weaknesses to owners and corrective actions so the review leads to changes your team can demonstrate.
Requirements 7 through 9. Access should reflect business need, with identifiable users, appropriate authentication and physical protection for payment systems and media. We examine role permissions, account management, applicable multi-factor authentication, physical access records and device safeguards. The aim is to show who can reach account data, why that access is necessary and how unauthorized access is prevented.
Requirements 10 and 11. Logs and monitoring help your team detect suspicious activity; security testing checks whether protections remain effective. We review logging coverage, review practices and required testing evidence. Where applicable, the plan includes quarterly ASV scans, annual penetration tests, significant-change testing and segmentation testing, with findings, remediation and retesting tracked through closure.
Requirement 12. Technical controls need an operating security program behind them. We review policies, assigned responsibilities, risk analyses, security awareness, incident response and service-provider oversight. Evidence should show how these activities are maintained and who is accountable, so payment security continues between assessments and when your environment changes.
We review checkout pages, payment APIs, physical terminals, call-center flows, storage, backups and third-party services. Each proposed exclusion needs evidence. Segmentation or an outsourced payment page may reduce the assessment boundary, but using fewer systems does not automatically remove a requirement.
For e-commerce merchants using SAQ A, PCI SSC confirms that merchant webpages redirecting to a payment provider or embedding its iframe remain subject to the applicable ASV external-scan requirements. A compliant processor does not establish the compliance of your integration or remove your provider-management responsibilities.
07
Your annual transaction volume, payment channels and merchant or service-provider classification help determine how you validate. Selecting the correct level and an SAQ for which you are genuinely eligible can avoid unnecessary assessment work. We review the complete payment flow, document the proposed route and identify what your acquirer or payment partner must confirm.
| Decision | SAQ | ROC |
|---|---|---|
| Purpose | Self-assessment using the questionnaire for which the entity is eligible. | Detailed report of assessment against applicable PCI DSS requirements. |
| Typical route | Eligible merchants and eligible service providers under their validation program. | Entities whose payment-brand or acquirer program requires a formal report. |
| Who assesses | The entity completes its self-assessment, with qualified help where needed. | A QSA or other assessor permitted by the applicable program. |
| Attestation | The appropriate AOC accompanies the completed SAQ. | The appropriate AOC accompanies the ROC. |
Merchant levels are used across payment-brand compliance programs. The table below is an indicative four-level model, not a universal classification rule. Thresholds, boundary values, transaction aggregation, regional rules and validation requirements vary by payment brand and acquirer. Count transactions under the applicable program rather than assuming all card brands are combined. Your acquirer confirms the level; a compromise or risk designation can trigger higher validation requirements. Service providers have separate classifications.
| Merchant level | Indicative annual volume | Validation route to confirm |
|---|---|---|
| Level 1 | Above 6 million transactions under the applicable program, or designated high-risk/global status. | Usually an annual ROC and corresponding AOC; assessor rules depend on the program. |
| Level 2 | Approximately 1 million to 6 million transactions under the applicable program. | Annual SAQ or ROC according to program rules and eligibility. |
| Level 3 | Approximately 20,000 to 1 million e-commerce transactions under the applicable program. | Usually an annual eligible SAQ and corresponding AOC. |
| Level 4 | Lower-volume merchants outside the higher levels; often below 20,000 e-commerce transactions or up to 1 million other transactions. | Acquirer-defined validation, commonly an eligible SAQ and corresponding AOC. |
Apply the validation and scanning obligations required by your program and SAQ eligibility, including the appropriate AOC. Where external ASV scanning is applicable, passing scans are required at least every three months. Confirm exact thresholds and reporting requirements with your acquirer before relying on this guide.
SAQ selection requires the full eligibility criteria. Hosted checkout, embedded forms, virtual terminals, physical terminals and direct processing can lead to different questionnaires. We review the complete payment flow before proposing SAQ A, A-EP, D or another applicable route.
08
Five stages connect your first scope discussion to remediation, testing and preparation of the SAQ or ROC and corresponding AOC. Scope reduction and remediation planning are central: we identify unnecessary exposure early, then work with your team to turn findings into assigned actions and reviewable evidence. The plan makes implementation and assessor responsibilities clear as you move toward validation.
We trace where payment data enters, travels and is retained, including checkout, APIs, call centers, backups and service providers. We review connected systems and security dependencies, then identify scope-reduction options and the evidence needed to support the boundary.
We review your payment channels, transaction profile and the request from your acquirer or customer. Your scope memo records the proposed merchant or service-provider classification, eligible SAQ or ROC route, and confirmations needed from the receiving party.
We assess applicable PCI DSS v4.0.1 requirements through control walkthroughs, evidence review and discussions with your engineering and operations teams. You receive a gap register showing findings, evidence gaps and priorities, with a remediation roadmap tied to your validation goal.
We turn findings into actions covering relevant segmentation, encryption, access, logging, patching and configuration controls. Each action has an implementation owner and expected closure evidence. Your team carries out the changes, while the agreed readiness support helps resolve questions and prepare evidence for review.
We help align applicable ASV scans, penetration tests and assessment preparation with the remediation plan. Findings and retest dependencies remain visible until the responsible providers and owners address them. The evidence handoff supports your SAQ or authorized assessment and the corresponding AOC.
09
A 12-week plan gives merchants and service providers a defined sequence from payment-data mapping through remediation, testing and validation preparation. Phases overlap so your team can address early findings while the assessment continues.
The schedule below shows the full-scope delivery plan. At kickoff, we confirm access, evidence availability, implementation owners and testing-provider dates. Your proposal records those dependencies and the agreed readiness deliverables.
| Phase | Timing from kickoff | Planned outcome |
|---|---|---|
| Scoping and cardholder data-flow mapping | Week 1 | Map where payment data is captured, processed, transmitted and retained; document systems, providers and scope-reduction opportunities. |
| Determine level and SAQ type | Week 1 | Document merchant or service-provider classification and the eligible SAQ or ROC route for confirmation with the receiving party. |
| Gap assessment | Weeks 1–3 | Assess all 12 requirements for applicability; deliver prioritized findings, evidence gaps and a remediation roadmap. |
| Remediation | Weeks 2–9 | Implementation owners address applicable segmentation, encryption, MFA, logging, patching and configuration gaps; track closure evidence with agreed readiness support. |
| ASV scan and penetration test | Weeks 8–11 | Coordinate applicable scans and penetration testing; review findings with responsible owners and plan remediation and retests needed for acceptable results. |
| SAQ or ROC and AOC preparation | Weeks 10–12 | Organize final evidence and support SAQ completion or the authorized ROC assessment and corresponding AOC. Resolve open readiness items and document any remaining validation dependencies. |
Week 12 is the readiness delivery target. A completed SAQ or ROC and signed AOC depend on controls meeting the requirements, successful applicable testing and the authorized assessment and sign-off process. We track those dependencies against your acquirer’s deadline rather than guaranteeing an assessment result. Compliance continues after validation, including applicable quarterly ASV scans and annual revalidation.
10
Receive a fixed-price, scope-defined proposal within 24 hours of your free strategy call. Your payment environment, validation route and required support determine the investment. The proposal confirms deliverables, readiness milestones, payment terms and responsibilities before work begins.
Approved pricing. The full-program timeline covers readiness work; formal validation depends on the applicable assessment and sign-off process.
| Scoping and Gap Assessment | Most Popular Full PCI DSS Readiness Program |
|---|---|
| From $4,000 | From $12,000 |
| Payment-data mapping; scope-reduction review; merchant or service-provider classification and SAQ or ROC route review. Review all 12 requirements for applicability; assess controls and evidence; deliver prioritized findings and a remediation roadmap. Evidence guidance and a readiness readout. Testing needs identified in the roadmap. |
Everything in Scoping and Gap Assessment, with a coordinated readiness plan through assessment preparation. Gap assessment plus remediation guidance, progress review, and segmentation and encryption guidance. Evidence preparation; SAQ or ROC and corresponding AOC preparation support; assessment handoff planning. Penetration testing coordination. |
| Confirmed in your proposal | 12 weeks |
| 30 days of follow-up access and complimentary refinements to the agreed readiness report. | 30 days of follow-up access and complimentary refinements to the agreed readiness report. |
Your engagement includes 30 days of follow-up access and complimentary refinements to the agreed readiness deliverables, so your team can act on a clear, complete report.
11
If a payment requirement, failed review or changed environment is putting a deadline on your next step, we help turn it into a defined readiness plan.
E-commerce and retail merchants accepting credit or debit cards.
SaaS platforms and service providers handling payment data for customers or providing services that affect payment security.
Businesses whose acquiring bank, payment partner or customer requests an SAQ, ROC or current AOC.
Organizations responding to a failed ASV scan or a card-brand compliance review.
Marketplaces, fintech companies and subscription platforms introducing or expanding embedded payments.
Merchants whose validation requirements have changed following a breach or a merchant-level designation.
Businesses integrating an acquisition, migrating payment systems to the cloud or retiring compensating controls.
12
Temi leads every engagement, with 20+ years of experience and over 100 assessments across frameworks.
Payment scope comes first, so your plan follows actual data flows and security dependencies.
PCI DSS v4.0.1 requirements are assessed against your environment and supported by a traceable gap register.
A fixed-price proposal defines the deliverables and milestones before work begins.
Remediation owners, evidence expectations and provider dependencies are brought into one plan.
Existing SOC 2, ISO 27001 or other relevant evidence is reused where scope, control purpose and timing match.
30 days of follow-up access and complimentary refinements support the agreed readiness report.
| What buyers need to resolve | Our approach |
|---|---|
| Will I work with the senior person I meet | Temi leads your engagement and participates in the engagement calls. |
| Can we plan against a defined deadline | A 12-week full-scope readiness plan with defined phases, owners and delivery dependencies. |
| Will costs keep expanding | A fixed-price proposal within 24 hours, with deliverables and scope agreed upfront. |
| Are we assessing more systems than necessary | Payment-flow mapping and evidence-backed scope-reduction options before control work is planned. |
| Who helps us move beyond the findings | A remediation roadmap with owners, priorities, closure evidence and agreed follow-up support. |
| Will we have to coordinate assessment dependencies alone | Scanning, testing and assessment preparation are connected to the readiness plan. |
| Are recommendations driven by our needs | Evaluate tools against your payment architecture, control requirements and retained responsibilities; clarify provider commercial relationships before selection. |
13
Speak with Temi about your payment environment, the requirement from your acquirer or customer, and your deadline. Leave with clarity on the next step and receive a fixed-price proposal within 24 hours of your free strategy call.
Your written proposal confirms the scope, fee, delivery schedule, payment milestones and follow-up before work begins.
14
15
Payment-adjacent SaaS businesses often face both payment-security requirements and enterprise customer assurance requests. Access management, logging, change control and supplier oversight can support more than one framework. We map the requirements against your environment and reuse evidence where it fits, while keeping framework-specific obligations visible.
For a smaller payment-scope question or focused advisory project, discuss the requirement with Temi and agree the deliverables and fee before work begins.
16
A readiness consultant helps define the payment boundary, assess applicable requirements and organize remediation and evidence. We connect that work to your validation request and coordinate the agreed preparation with your team and relevant providers.
The starting price is $4,000. Your payment channels, complexity, validation route and support needs determine the agreed scope. You receive a fixed-price proposal within 24 hours of your free strategy call.
The full-scope readiness plan runs over 12 weeks, with overlapping phases for scoping, assessment, remediation, testing and validation preparation. Completing formal validation depends on the gaps found, your implementation resources, required test results and assessor availability. Your roadmap shows those dependencies against your acquirer’s deadline.
Merchant levels classify validation requirements using factors such as transaction volume, payment channel and risk designation. The four-level guide above illustrates commonly used volume bands, but thresholds and validation rules vary by payment brand, region and acquirer. Confirm your classification with your acquirer, especially after a compromise or change in volume. Service providers follow separate requirements.
Eligibility follows how you accept payments and the responsibilities your systems retain. SAQ A, A-EP, D and other questionnaires each have specific conditions. We examine the complete payment flow and document the proposed route for confirmation with your acquirer or payment partner.
A merchant accepts payment cards for its own goods or services. A service provider may handle payment data for others or provide services that can affect the security of their cardholder data environments. The services you provide, including access and shared responsibilities, determine the scope.
Yes. Outsourcing payment processing can change your assessment scope, but your integration, applicable controls and provider oversight still need review. A processor’s name alone does not establish SAQ eligibility. Merchant webpages using redirects or embedded iframes remain subject to the applicable SAQ A ASV-scan requirements.
A Qualified Security Assessor company is qualified by PCI SSC to perform PCI DSS assessments. An Approved Scanning Vendor performs applicable external vulnerability scans. A Report on Compliance records detailed assessment results. An Attestation of Compliance is the official form attesting to the results documented in an SAQ or ROC.
The 12 requirements address network controls, secure configurations, stored account data, transmission security, malicious software, secure development, access restrictions, authentication, physical security, logging, security testing and the organizational security program. The six detailed goals above explain what those requirements mean for your environment and readiness work.
Payment brands set their own enforcement programs; PCI SSC does not publish a universal fine schedule. Your acquirer can explain the consequences under your agreement, including any impact on payment acceptance. Confirm the actual request and deadline before estimating exposure.
Where applicable, PCI DSS requires internal and external penetration testing at least annually and after significant changes. Segmentation testing has additional requirements where segmentation is used to isolate the cardholder data environment. Testing is distinct from vulnerability scanning; the plan must address both applicable obligations and retesting after findings are resolved.
Where PCI DSS Requirement 11.3.2 applies, external vulnerability scans must be performed by an ASV at least once every three months, with passing results and rescans as needed. Significant changes trigger additional applicable scanning requirements. We help organize the provider, scope and timing dependencies in your readiness plan.
Yes. We map shared controls and evidence against both requirements so your team can reduce duplicate preparation where the scope and timing align. PCI-specific payment requirements and SOC-specific reporting requirements remain part of the plan.
PCI DSS v4.0.1 is the current version, and the requirements that were future-dated to 31 March 2025 are now effective. We review the requirements applicable to your environment, including authentication, payment-page security and targeted risk analyses, rather than assuming last year’s evidence is sufficient.
They may, along with effective segmentation and validated point-to-point encryption. The benefit depends on your design, eligibility and retained responsibilities. We document the boundary and evidence for each proposed exclusion before relying on it.
A QSA employee must not assess requirements affected by controls they recommended, designed or implemented. The assessment arrangement must preserve the required independence, including an independent assessor employee where applicable. We establish the readiness and assessment responsibilities before work starts.
Yes. We review the agreed cloud environment, payment flows, connected systems and shared responsibilities against applicable requirements. Cloud-provider evidence supports the review, alongside evidence for the controls your organization owns.
Your written proposal specifies payment milestones and report review points before the engagement begins.
Keep controls operating, retain evidence and complete the recurring activities required by your program. Review scope when payment systems, architecture or service providers change. We provide 30 days of follow-up access after your engagement. Continuing security leadership and preparation for the next validation can be discussed through our Virtual CISO service.
Bring the question, payment environment and deadline. We can discuss an appropriately defined advisory engagement and confirm the deliverables and fee in writing.