Scope
Map payment flows, account data, connected systems, people, locations, service providers, segmentation, and validation obligations.
← Services
PCI DSS consultancy practice
Build payment security that can be operated, evidenced, and validated.
Practical PCI DSS v4.0.1 support across scope, assessment, architecture, implementation, evidence, remediation, validation preparation, and continuous compliance.
Discuss a PCI DSS programme ↗PCI DSS / FIT
Who we support
- Merchants preparing an SAQ or assessor-led validation
- Service providers preparing for a ROC or customer assurance review
- Payment, fintech, e-commerce, and platform teams changing architecture or scope
- Organisations with recurring PCI findings, unclear ownership, or weak evidence
- Teams that need to make PCI controls part of normal security operations
End-to-end support
From payment flow to continuous control operation.
The programme can begin at any stage. We establish the validation route and current state first, then connect technical remediation, operating evidence, and assessor expectations.
Assess
Evaluate each applicable requirement, control design, implementation state, evidence quality, dependencies, and material gaps.
Engineer
Turn gaps into architecture decisions, technical controls, procedures, ownership, acceptance criteria, and implementation work.
Evidence
Build an evidence model that traces each requirement to owners, operating records, samples, testing, exceptions, and review cadence.
Validate
Prepare SAQ or ROC evidence, coordinate QSA and ASV dependencies, resolve questions, manage findings, and verify closure.
Operate
Maintain recurring controls, targeted risk analyses, scans, tests, training, supplier evidence, metrics, and management decisions.
Complete requirement coverage
Support across all 12 PCI DSS requirements.
The work is organised around real payment services and control ownership, not a detached checklist. Each domain connects policy, technical implementation, operation, evidence, and validation.
01-02Requirements 1 and 2
Networks and secure configuration
Network security controls, segmentation, system configuration, inventories, hardening, and change control.
03-04Requirements 3 and 4
Account data protection
Data discovery, retention, masking, encryption, key management, transmission security, and deletion.
05-06Requirements 5 and 6
Secure systems and software
Malware protection, vulnerability management, patching, secure development, change security, and public-facing applications.
07-09Requirements 7, 8, and 9
Access and physical protection
Need-to-know access, identity lifecycle, strong authentication, privileged access, visitor controls, and media protection.
10-11Requirements 10 and 11
Monitoring and testing
Audit logs, time synchronization, alerting, reviews, scans, penetration testing, change detection, and control validation.
12Requirement 12
Security programme governance
Policies, roles, risk analyses, awareness, incident response, third parties, annual scope confirmation, and programme oversight.
Typical PCI DSS programme outputs
01Validated scope and payment-data flow map
02Requirement and control gap matrix
03Prioritised remediation and ownership plan
04Control and evidence register
05SAQ or ROC preparation pack
06Continuous compliance operating calendar
Last reviewed 31 August 2026
Official PCI SSC references
The practice is maintained against PCI SSC source material. Scope, validation method, reporting form, and assessor involvement are confirmed for each entity before work begins.
- PCI DSS v4.0.1 and supporting documentsPCI Security Standards Council Document Library
- PCI DSS v4.x Resource HubPCI Security Standards Council
- PCI Qualified Professionals listings and rolesPCI Security Standards Council
- SAQs for PCI DSS v4.0.1 bulletinPCI Security Standards Council
Start with the payment flow, validation route, current gap, and deadline.
Share the entity type, payment channels, service-provider relationships, current scope, validation method, previous findings, assessor status, and target date.
Discuss a PCI DSS programme ↗