PCI DSS Compliance
Shrink the cardholder environment, then meet the 12 requirements.
Compliance Gauge scopes and segments your payment environment, completes the right SAQ or supports a QSA-led ROC, and keeps scans and reviews on schedule.
What it is
PCI DSS is the card brands' standard for any organization that stores, processes or transmits cardholder data. Version 4.0 introduced new requirements around authentication, scripting on payment pages and targeted risk analysis. Most of the cost of PCI comes from an environment that is bigger than it needs to be, so scope reduction is where every engagement begins.
Who needs it
- Retail, restaurants and hospitality
- E-commerce and subscription businesses
- Auto dealers, rental operators and service businesses taking cards by phone
- Any merchant whose acquirer or processor is asking for an attestation
What we do
- Cardholder data environment discovery and segmentation
- SAQ type selection and completion, or QSA coordination for a Report on Compliance
- Quarterly ASV vulnerability scans and annual penetration testing
- Requirement 12 policy set, training and incident response
- Payment-page script monitoring and change control
- Ongoing quarterly reviews to stay compliant between attestations
The same four steps, every framework.
Scoped gap assessment
Inventory, data-flow mapping and a scored findings list with a cost to close.
Remediation plan
Every gap gets an owner, a fix and a date on the plan of action.
Implementation and evidence
Our engineers close the gaps; evidence is captured control by control.
Mock audit, then the real one
We run it the way the assessor will, then sit beside you for the real thing.
Frequently asked questions
Which SAQ applies to us?
It depends on how you accept cards: e-commerce with a fully outsourced payment page is SAQ A; card-present with standalone terminals is SAQ B or B-IP; anything that stores or processes card data on your own systems is SAQ D. Scoping decides this before any work starts.
What changed in PCI DSS 4.0?
Version 4.0 added requirements for MFA on all access into the cardholder environment, monitoring of scripts on payment pages, targeted risk analyses and stronger authentication rules. Many of these became mandatory in 2025.
Do we need a QSA?
Merchants processing over six million transactions a year, and service providers over 300,000, need a Report on Compliance by a Qualified Security Assessor. Smaller merchants self-attest with an SAQ, which we complete with you.
How often are vulnerability scans required?
External scans by an Approved Scanning Vendor are required quarterly and after significant changes; internal scans are also quarterly. Penetration testing is annual.
Can you reduce our PCI scope?
Usually significantly. Tokenization, hosted payment pages and network segmentation take systems out of scope so fewer requirements apply.
Find out where you stand on PCI DSS.
A scoped gap assessment gives you a compliance score, a findings list and a cost to close — before you commit to anything.