PCI DSS readiness assessment
Most of the cost of PCI DSS comes from scope. We trace where card data actually goes, check that segmentation keeps everything else out of scope, and assess the requirements against evidence before a QSA, or your self-assessment questionnaire, does.
Who it is for
- Merchants and service providers facing their first PCI DSS assessment, or their first against version 4.
- Organizations whose scope has grown with new payment channels, sites or providers.
- Teams completing a self-assessment questionnaire who want an independent check first.
What we assess
- Card data flows, the cardholder data environment and the systems connected to it.
- Segmentation: whether the boundary that keeps the rest of the network out of scope actually holds.
- All 12 requirements, including those that became mandatory on 31 March 2025, such as multi-factor authentication for all access into the cardholder data environment and the management of payment page scripts.
- Requirement 9 physical controls, tested on site. See PCI DSS Requirement 9.
What you receive
- A validated scope and data flow diagram.
- A requirement-by-requirement register with evidence and gaps.
- Scope reduction options, each with a price range.
- A recommended validation path (the right SAQ, or preparation for a Report on Compliance).
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically two to four weeks for one cardholder data environment.
Common questions
Are you a QSA?
No. We do not issue a Report on Compliance or sign an Attestation of Compliance. We prepare you for the QSA, or help you complete a self-assessment questionnaire accurately.
SAQ or Report on Compliance?
That depends on your merchant or service provider level and how you accept cards, and it is set by your acquiring bank or the card brands. We help you confirm which applies and prepare for it.
What is the difference between v4.0 and v4.0.1?
Version 4.0.1, published in June 2024, is a limited revision that clarifies v4.0. The larger change was v4.0 itself, whose future-dated requirements became mandatory on 31 March 2025.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
PCI DSS readiness
We reply within one business day.
Nothing you send is shared outside Calibre.