Scoping and segmentation
Map account data flows, the CDE, connected-to and security-impacting systems, and validate segmentation. A tight scope is the fastest way to cut the cost of compliance.
- Home
- PCI DSS
PCI DSS assessment, led by a QSA.
Thirty PCI DSS engagements across five countries, from SAQ guidance for merchants to full Reports on Compliance for service providers. I help you scope tightly, fix what matters and reach a clean assessment under PCI DSS v4.0.1.
- PCI DSS engagements
- 30
- Countries
- 5
- Standard assessed
- v4.0.1
What I do
End-to-end PCI DSS support.
v4.0.1 gap assessment
Requirement-by-requirement review against PCI DSS v4.0.1, including the requirements that became effective on 31 March 2025, such as payment page script management and targeted risk analyses.
Remediation roadmap
Every gap turned into a fix with an owner and a date, prioritised by risk and by assessment impact, with the policies and evidence the standard expects.
SAQ selection and completion
The right Self-Assessment Questionnaire for how you actually accept payments, completed with evidence that stands up to your acquirer.
ROC and AOC
Onsite assessment, testing and interviews leading to the Report on Compliance and Attestation of Compliance for Level 1 merchants and service providers.
Business-as-usual compliance
Periodic activities, targeted risk analysis reviews and evidence discipline, so next year's assessment is not a scramble.
How it runs
From workshop to attestation.
A predictable path, with no surprises at assessment time.
Scoping workshop
Walk through payment channels, account data flows, systems and third parties to agree the scope and the validation route: SAQ or ROC.
Gap assessment
Review each applicable requirement against current controls and evidence, recording what is in place, partial or missing.
Remediation
Agree a prioritised plan with technical and business owners, then review fixes and build the evidence pack as controls go live.
Validation
Validate controls and complete the SAQ, or the ROC and AOC for your acquirer and the payment brands.
Where
PCI DSS work across five countries.
- United Arab Emirates12
- South Africa8
- United States6
- India2
- Vietnam2
PCI DSS client engagements per country. Client names stay confidential.
Next step
Planning a PCI DSS assessment?
Tell me how you accept payments and when your assessment is due. I'll tell you honestly what it takes.