PAYMENTS · CONSULTING SERVICES
Shrink the scope before you harden it
Most of the cost of PCI DSS is decided by how much of your estate ends up inside the cardholder data environment. This maps the card data flows you actually have, argues the scope down where it legitimately can be, closes the gaps against all twelve requirements of v4.0.1, and prepares the evidence package for the attestation or the Report on Compliance.
ENGAGEMENT AT A GLANCE
StandardPCI DSS v4.0.1
ScopeCardholder data environment
OutputGap register + evidence package
YOU RECEIVE
Cardholder data flow map and written scope definition
Gap register against all 12 requirements
Network segmentation validation with scope-reduction options
Remediation support with owners and dates
Evidence package for the attestation or ROC
WHAT'S COVERED
Scope of the engagement
01
Cardholder data flow mapping
Where card data actually is and how it moves — including the copies in logs, backups, call recordings and mailboxes that nobody meant to keep.
02
Scope definition
Which systems are in the cardholder data environment, which are connected-to, and which can be taken out of scope entirely.
03
Segmentation validation
Whether the controls keeping the rest of your estate out of scope genuinely do — validated, rather than asserted in a diagram.
04
Gap assessment — all 12 requirements
Every requirement of v4.0.1 assessed against your environment, with the evidence status recorded for each one.
05
Remediation support
The technical and procedural work to close the gaps, sequenced so dependencies land in the right order and owned by named people.
06
Attestation & ROC support
The evidence package prepared and indexed in advance, and support through the self-assessment or the assessor’s fieldwork.
COMMON QUESTIONS
Before you ask
Do you issue the certificate?
No. A Report on Compliance is signed by a Qualified Security Assessor, and an Attestation of Compliance is signed by you. We prepare the environment and the evidence and support the assessment — we do not assess our own work.
Which SAQ applies to us?
It depends on how you accept payments and how much of the process you have outsourced. Establishing it is part of scoping, and it is worth getting right: the wrong SAQ is a compliance failure however well you followed it.
Can we reduce scope instead of hardening everything?
Usually, and it is the cheapest thing available to you. Tokenisation, hosted payment pages or redirects, and genuine network segmentation can take whole networks out of the assessment — which is why the data flow mapping comes first.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the work is worth buying.
REPORT CONTENTS
Cardholder data flow map and written scope definition
Requirement-by-requirement gap register with evidence status
Segmentation validation results and scope-reduction options
Prioritised remediation plan with owners and dates
Evidence package indexed against the 12 requirements
WHAT WE NEED FROM YOU
How you accept and process payments, end to end
Network diagrams and access to the in-scope environment
Existing SAQ, ROC or prior assessment findings
A named owner for payments and one for infrastructure
FRAMEWORKS THIS EVIDENCES
PCI DSS v4.0.1PCI SSC self-assessment questionnairesISO/IEC 27001:2022 Annex A
Findings are mapped to control references so the report can be handed to an auditor without translation.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.