Skip to main content
Contact Us

PCI DSS compliance · EU & US

PCI DSS compliance, from scoping to signed report

We scope your cardholder data environment, close the gaps and prepare the evidence. Then our QSA partner assesses you.

Request a scoping call Find your level
PCI DSS v4.0.112 requirements

Every requirement your assessor will test

  1. 1Network security controls
  2. 2Secure configurations
  3. 3Protect stored data
  4. 4Encrypt transmission
  5. 5Anti-malware
  6. 6Secure software
  7. 7Need-to-know access
  8. 8Identity & MFA
  9. 9Physical access
  10. 10Logging & monitoring
  11. 11Security testing
  12. 12Policies & programme
Each requirement mapped to evidenceQSA-ready
01 · Your level

Which level are you, and what do you file?

Your level decides whether you complete a self-assessment or need a QSA on site.

Based on Visa and Mastercard levels. Your acquirer has the final say.

1 · You are a
2 · Card transactions a year
Your level

Pick both answers

You’ll see your likely level and what you need to file.

Confirm your level on a call
02 · The PCI DSS year

Your PCI DSS year, quarter by quarter

The recurring tests your assessor will ask to see, across a 12-month cycle.

Q1Q2Q3Q4Cadence
External vulnerability scansBy an Approved Scanning Vendor (ASV), 11.3.2Quarterly
Internal vulnerability scansRequirement 11.3.1Quarterly
Penetration testsInternal and external, 11.4Every 12 months
Segmentation tests11.4.5, and 11.4.6 for service providers12 months (6 for providers)
Compliance validationROC or SAQ, plus Attestation of ComplianceEvery 12 months

Also: keep audit logs for 12 months, with the last three months immediately available (Requirement 10.5.1). Significant changes trigger extra scans and tests.

Plan your testing year
03 · The 12 requirements

Six goals behind the 12 requirements

What we put in place for each goal.

Req. 1–2

Secure network and systems

Firewall rules, segmentation including FortiGate, hardened builds

Req. 3–4

Protect account data

Encryption, tokenisation and key management, at rest and in transit

Req. 5–6

Vulnerability management

Endpoint protection, patching and secure development

Req. 7–9

Strong access control

Need-to-know access, MFA and physical controls

Req. 10–11

Monitor and test

Central logging, 24/7 review, penetration and segmentation tests

Req. 12

Security policy

Policies, risk analyses and an incident response plan

Six goals, 12 requirements. Our PCI DSS compliance checklist lists the evidence for each one.

Request a scoping call
04 · How we work

From scoping call to validated report

01Scope

Scope and gap assessment

A clear scope before any work starts.

  • Cardholder data environment mapped
  • Which SAQ or ROC applies
  • Gaps against v4.0.1, prioritised
  • You get: a gap report and roadmap
02Remediate

Controls and hardening

Our engineers implement the fixes.

  • Segmentation, encryption, access
  • Logging and monitoring for the CDE
  • Penetration and segmentation testing
  • You get: documented controls
03Validate

Assessment and upkeep

Stay compliant between assessments.

  • Evidence pack prepared for your QSA
  • Findings handled during the assessment
  • Ongoing monitoring and yearly cycle
  • You get: a validated ROC or SAQ
Mölnir, Q-SEC QSA partner

Independent QSA assessment, delivered with Mölnir

We get your cardholder data environment ready. Our QSA partner Mölnir performs the independent assessment and signs off your ROC or SAQ.

PCI DSS QSAISO 27001SOC 2GDPR
Visit Mölnir →
Talk to a PCI DSS expert
05 · Questions

PCI DSS compliance FAQ

Request a scoping call
Who needs to comply with PCI DSS?
Any business that stores, processes or transmits cardholder data, or can affect its security. That covers merchants of every size and the service providers that handle card data for them.
What are the PCI DSS merchant levels?
Card brands set levels by annual transaction volume. With Visa and Mastercard, Level 1 is over 6 million transactions, Level 2 is 1 to 6 million, Level 3 is 20,000 to 1 million e-commerce transactions, and Level 4 is everything below. Your acquirer confirms your level.
What's the difference between a ROC and an SAQ?
A Qualified Security Assessor writes a Report on Compliance (ROC) after an on-site assessment, and Level 1 entities need one. You complete a Self-Assessment Questionnaire (SAQ) yourself, and the right SAQ type depends on how you take payments.
Which PCI DSS version applies now?
PCI DSS v4.0.1. The PCI Security Standards Council retired version 4.0 at the end of 2024, and its future-dated requirements became mandatory on 31 March 2025.
How often does PCI DSS require penetration testing?
At least every 12 months and after significant changes, internal and external, plus segmentation testing. Service providers test segmentation every six months. See penetration testing.
Does Q-SEC perform the QSA assessment?
We get your cardholder data environment ready. Our QSA partner Mölnir performs the independent assessment and signs off your ROC or SAQ.
Scoping call

Scope your cardholder data environment

Your payment channels, card volumes and assessment date.

“We brought Q-Sec in when scaling started causing more problems than progress. They cleaned up our setup, added segmentation, and gave us real visibility again.”
Kirill MarchenkoKirill MarchenkoCEO, Colobridge GmbH
Teams we work with
MiloanColobridgeFinXFlypayYuria-PharmCashpointFinmeAmigo
Request a PCI DSS scoping call

We reply within 1 business day.

Pixel icons by Streamline, CC BY 4.0. PCI DSS is a standard of the PCI Security Standards Council. This page is not legal advice.