PCI DSS 4.0 Readiness
That Holds Up
on Assessment Day
PCI DSS 4.0 compliance
Get Assessment-Ready for PCI DSS 4.0, with Testing That Proves Your Controls Work
iSpyCyber helps merchants and service providers scope their cardholder data environment, close gaps against PCI DSS 4.0 and produce the technical evidence a Qualified Security Assessor expects to see. We combine GRC expertise with hands-on segmentation testing, vulnerability scanning support and penetration testing aligned to Requirement 11.4.
Why organisations choose iSpyCyber
Scope reduced, not guessed
We trace every cardholder data flow and connected system, then help you shrink the CDE through segmentation, tokenisation and outsourcing decisions.
Segmentation proven by testing
Segmentation controls are tested from every out-of-scope network, so the scope you present to your QSA is backed by evidence.
Requirement 11.4 penetration testing
Internal, external and application-layer penetration tests follow a documented methodology that meets the Requirement 11.4 criteria.
Future-dated requirements covered
Targeted risk analyses, authenticated scanning, payment page script controls and the other requirements that became mandatory in March 2025.
Evidence your QSA can use
Policies, procedures and evidence are organised requirement by requirement, cutting back-and-forth during the formal assessment.
Compliance that lasts all year
Quarterly scan support, periodic testing and iefyx, our AI-native VAPT platform, keep controls working between annual assessments.
Coverage
PCI DSS 4.0 Control Areas We Assess and Test
Our readiness work covers all twelve principal requirements, with technical testing where your QSA will look hardest.
Scoping and data flows
Cardholder data discovery, data flow diagrams, connected-to and security-impacting systems, and annual scope confirmation under Requirement 12.5.2.
Network security controls
Firewall and cloud security group rules, CDE segmentation and segmentation testing under Requirements 1 and 11.4.5 to 11.4.6.
Secure configuration
System hardening standards, default credentials, unnecessary services and configuration baselines under Requirement 2.
Protecting account data
Storage minimisation, PAN masking and truncation, encryption, key management and transmission security under Requirements 3 and 4.
Malware and patching
Anti-malware controls, phishing protection, patch timelines and vulnerability ranking under Requirements 5 and 6.3.
Secure software and payment pages
Secure development, public-facing web application protection and payment page script management under Requirements 6.4.2 and 6.4.3.
Access control and MFA
Least privilege, account reviews, password rules and MFA for all access into the CDE under Requirements 7 and 8.
Logging and monitoring
Audit log generation, automated log review, time synchronisation and failure detection of critical controls under Requirement 10.
Testing, policy and risk
Internal and ASV scanning, penetration testing, targeted risk analyses, awareness training and incident response under Requirements 11 and 12.
Methodology
A Six-Phase Path from Readiness to QSA Assessment
Built around the PCI DSS 4.0.1 requirements and testing procedures, so every control is prepared the way an assessor will validate it.
- PCI DSS 4.0.1
- PCI DSS Scoping Guidance
- PCI Penetration Testing Guidance
- NIST SP 800-115
- CVSS 3.1
8–16
weeks for a typical readiness programme
6
lifecycle phases
12
principal requirements covered
01
- Weeks 1–2
Scope and discover
Cardholder data flows, systems and third parties mapped to establish an accurate and defensible CDE.
Key activities
- Identify all locations of account data
- Build data flow and network diagrams
- Classify CDE, connected and out-of-scope systems
- Output: Validated scope and data flow diagrams
02
- Weeks 2–4
Gap assessment
Every applicable requirement assessed against current controls, documentation and evidence.
Key activities
- Interview control owners and review documents
- Sample configurations and records
- Rate each gap by effort and risk
- Output: Requirement-by-requirement gap report
03
- Weeks 3–6
Technical testing
Segmentation testing, internal vulnerability scanning and penetration testing that meet Requirement 11 criteria.
Key activities
- Segmentation testing from out-of-scope networks
- Internal and pre-ASV external scans
- Internal, external and application penetration tests
- Output: Test reports mapped to Requirement 11
04
- Weeks 5–12
Remediate and implement
Policies, procedures and technical controls implemented with guidance from our specialists.
Key activities
- Draft policies, standards and targeted risk analyses
- Guide technical fixes and configuration changes
- Retest remediated vulnerabilities
- Output: Closed gaps and updated documentation
05
- Weeks 10–14
Evidence and pre-assessment
Evidence organised by requirement and a mock assessment run to confirm you are ready.
Key activities
- Compile evidence packs per requirement
- Run a mock walkthrough with control owners
- Confirm SAQ type or ROC readiness
- Output: Assessment-ready evidence pack
06
- During QSA assessment
Assessment support
Support during the formal QSA assessment and help sustaining compliance through the year.
Key activities
- Coordinate evidence requests with your QSA
- Help respond to assessor queries
- Plan quarterly and annual recurring activities
- Output: Business-as-usual compliance calendar
Effort distribution
Where the programme time goes
Most of a readiness programme is spent on technical testing and closing gaps, not on paperwork. Percentages are indicative for a first-time Report on Compliance.
Quality built into every phase
Scope challenged early
Scope is tested before controls are built around it.
Segmentation evidenced
Out-of-scope claims are backed by test results.
Mapped to testing procedures
Evidence follows how assessors validate each requirement.
Honest readiness verdict
We tell you plainly if you are not yet ready.
Engagement options
Choose the PCI DSS Support That Fits Your Stage
Whether you need a quick view of where you stand or a partner through your first Report on Compliance, the methodology is the same.
Gap assessment
A focused review of scope and all applicable requirements, with segmentation observations and a prioritised remediation plan. Best for organisations planning their first assessment or moving from PCI DSS 3.2.1.
Full readiness programme
Scoping, gap assessment, technical testing, policy development, remediation support and a mock assessment. Best for organisations preparing for a QSA-led Report on Compliance or a complex SAQ.
Ongoing compliance support
Quarterly scan support, annual and change-driven penetration and segmentation testing, and periodic control reviews. Best for keeping compliance continuous between annual assessments.
Not sure which option you need?
Our specialists will recommend an approach based on your merchant or service provider level, payment channels and current controls.
Deliverables
Everything You Need Before the QSA Arrives
Clear direction for leadership, practical actions for engineering and organised evidence for your assessor.
Gap report
Status of every applicable requirement, with gaps rated by risk and effort and an executive summary for leadership.
Policies and procedures
Information security policy, standards, procedures and targeted risk analyses aligned to PCI DSS 4.0.1.
Evidence packs and test reports
Evidence organised by requirement, plus segmentation, scanning and penetration test reports for Requirement 11.
Remediation roadmap
A sequenced plan with owners and dates, focused on closing the gaps that would fail an assessment first.
Aligned with the frameworks your payments programme depends on
- PCI DSS 4.0.1
- PCI PIN Security
- PCI 3DS
- RBI payment guidelines
- ISO/IEC 27001
- SOC 2
- DPDP Act 2023
- GDPR
- NIST SP 800-115
- OWASP Top 10
iSpyCyber provides readiness, gap assessment, technical testing and audit support. Reports on Compliance and Attestations of Compliance are issued by a PCI SSC Qualified Security Assessor, and external quarterly scans must be performed by an Approved Scanning Vendor.
PCI DSS readiness for every industry that handles cards
The basics
Does iSpyCyber issue PCI DSS certificates or Reports on Compliance?
No. A Report on Compliance and the related Attestation of Compliance can only be issued by a PCI SSC Qualified Security Assessor, or completed through a Self-Assessment Questionnaire where your acquirer allows it. iSpyCyber prepares you for that assessment through scoping, gap assessment, remediation support, technical testing and evidence preparation, and supports you while the QSA carries it out.
What changed in PCI DSS 4.0?
PCI DSS 4.0, now updated as 4.0.1, introduced a customised approach, targeted risk analyses, broader MFA into the cardholder data environment, authenticated internal scanning, payment page script controls and more frequent scope confirmation. Requirements that were future-dated became mandatory on 31 March 2025.
How can we reduce our PCI DSS scope?
Common approaches include network segmentation, tokenisation, point-to-point encryption and outsourcing payment pages to a compliant provider. We model the options against your architecture and prove segmentation through testing.
Which SAQ or assessment type applies to us?
It depends on your merchant or service provider level, set by your acquirer or the card brands, and on how you accept payments. We help you confirm the right validation route with your acquirer during scoping.
Working with us
Do you perform ASV scans?
External quarterly scans for Requirement 11.3.2 must be performed by a PCI SSC Approved Scanning Vendor. We run internal scans for Requirement 11.3.1 and pre-ASV external scans, help you remediate findings before your ASV scan, and help you manage disputes and rescans with your ASV.
What penetration testing does PCI DSS require?
Requirement 11.4 calls for internal and external penetration testing at least every twelve months and after significant changes, based on a documented methodology that covers the network and application layers. Segmentation controls must also be tested, annually for merchants and every six months for service providers.
How long does PCI DSS readiness take?
A gap assessment usually takes two to four weeks. A full readiness programme typically runs eight to sixteen weeks, depending on scope, the number of gaps and how quickly remediation can be delivered.
Get started
Pass Your PCI DSS Assessment.
Stay Compliant All Year.
Talk to our PCI DSS specialists about a scoped readiness review for your cardholder data environment.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries