Map and reduce
Card data flows, systems in scope and the options for taking systems out of scope, agreed before any remediation starts.
// PCI DSS v4.0.1Get ready for PCI DSS
Get ready for PCI DSS
with less in scope.
For businesses that store, process or transmit card data: we shrink your cardholder data environment first, then close the gaps against PCI DSS v4.0.1, so your Qualified Security Assessor or Self-Assessment Questionnaire covers less and finds less.
PCI DSS v4.0.112 requirementsQSA or SAQ readyScope reduction first
12PCI DSS requirements
v4.0.1Current version, published June 2024
31 Mar 2025Newer requirements became mandatory
// WHERE PCI DSS EFFORT REALLY GOES
Scope decides the cost of everything after it.
PCI DSS applies to every system that stores, processes or transmits cardholder data, and to everything connected to those systems. That boundary, the cardholder data environment, decides how many of the 12 requirements you must evidence and on how many machines. Version 4.0.1, published in June 2024, is the current standard, and its newer requirements became mandatory on 31 March 2025. We start by reducing scope (tokenisation, hosted payment pages, network segmentation) and only then remediate what is left.
// DELIVERY STANDARD
Built for decisions, evidence and accountable execution.
Whether this is a commercial engagement or a government program, the work is structured so technical teams can act and leadership can verify progress.
Gap assessment
Your environment compared with each applicable v4.0.1 requirement, ranked by assessment impact and effort.
Close the gaps
Controls implemented, segmentation tested and policies written, with evidence collected as each item is closed.
Assessment support
SAQ completion, or preparation and fieldwork support for your Qualified Security Assessor’s Report on Compliance.
// PROJECT OUTPUTS
What your team can take into the next review.
- Cardholder data-flow diagram and scope statement
- Scope-reduction options with effort estimates
- PCI DSS v4.0.1 gap report and remediation plan
- Segmentation test and internal vulnerability scan results
- Completed SAQ or QSA evidence pack
// BUILT FOR
Designed around the people who own the outcome.
- E-commerce merchants and payment-taking SaaS products
- Fintechs, payment aggregators and service providers
- Teams asked for PCI evidence by their acquiring bank
- Companies moving to v4.0.1 from an older assessment
Scope and data-flow mapping
Every place card data enters, travels and rests, drawn as a data-flow diagram, with options to take systems out of scope through tokenisation, hosted payment pages or outsourcing.
Segmentation design and testing
Network segmentation that actually isolates the cardholder data environment, and the penetration testing PCI DSS requires to prove it, so out-of-scope systems stay out of scope.
Gap assessment against v4.0.1
Each applicable requirement compared with how you work today, including the requirements that became mandatory on 31 March 2025, such as payment-page script controls and wider multi-factor authentication.
Choosing the right SAQ
If you validate with a Self-Assessment Questionnaire, we help you pick the right one for how you take payments and complete it with evidence behind every answer.
Remediation with your team
Logging, vulnerability management, access control, encryption and secure software practices fixed in your environment, with the targeted risk analyses v4.0.1 now asks for.
Testing before the assessor
Internal vulnerability scans and penetration tests of the cardholder data environment before your QSA or Approved Scanning Vendor runs theirs.
// PRICING
Scoped to you, priced in writing.
Every engagement is scoped to your frameworks, your team and how much help you want — you get a written proposal before anything starts.
Scoping and gap assessment
Talk to us
Data-flow mapping, scope-reduction options and a written gap report.
Full readiness programme
Talk to us
Scoping to assessment support. A Report on Compliance comes from a Qualified Security Assessor, and quarterly external scans from an Approved Scanning Vendor, both billed separately.
PCI DSS work depends mostly on how large the cardholder data environment is. Talk to us and we'll send a written proposal after a scoping call.
Frequently Asked Questions
Are you a QSA or an ASV?
No. Bitkosh is not a PCI SSC Qualified Security Assessor or Approved Scanning Vendor, so we cannot sign a Report on Compliance or issue your quarterly external scan reports. We get you ready for both and help you complete a Self-Assessment Questionnaire where that is the right route.
Do we need a QSA or can we self-assess?
That depends on your merchant or service-provider level, which your acquiring bank or the card brands set based mainly on transaction volume. Larger organisations need a Report on Compliance from a QSA; smaller ones usually complete an SAQ. Ask your acquirer what they require, and we work to that.
What changed on 31 March 2025?
The requirements that PCI DSS v4.0 introduced as best practice became mandatory. They include controls on scripts running in payment pages, multi-factor authentication for all access into the cardholder data environment, and targeted risk analyses for how often some controls run.
We only use a payment gateway. Are we in scope?
Usually less than you would think, but not zero. If customers pay on a page hosted by your payment provider, your scope can be small; if your own pages load the payment form, the scripts on those pages are in scope. Mapping this correctly is the first thing we do.
Can PCI DSS work count towards ISO 27001 or SOC 2?
Partly. Access control, logging, vulnerability management and incident response overlap heavily, and the Bitkosh Readiness Platform maps the same evidence across frameworks. PCI DSS is more prescriptive about card data, so some controls stay PCI-specific.
Let's build together
Shrink your scope before you pay to assess it.
Book a free 30-minute consultation with our engineering team — no obligation, just a clear, practical plan.