PCI DSS v4.0.1 Compliance, Gap Assessment & QSA Audit
PCI DSS v4.0.1 turned 64 future-dated requirements into mandatory ones. Vyapari Solutions reduces your cardholder data environment first, then proves compliance — so you pay for the smallest defensible scope, not the largest.
4.9/5 average client rating · 500+ engagements delivered
What PCI DSS v4.0.1 changes
PCI DSS is the security standard mandated by Visa, Mastercard, American Express, Discover and JCB for every organisation touching cardholder data. Version 4.0.1 is the current standard, and the transition period for its future-dated requirements has closed — they are now assessed as mandatory.
The most significant shift is the customised approach: instead of only prescriptive controls, you may meet a security objective with your own control design, provided you document a targeted risk analysis and the assessor validates it. That flexibility is powerful, but it demands far better documentation than v3.2.1 ever did.
- Multi-factor authentication for all access into the cardholder data environment, not just administrative and remote access
- Automated log review, and detection of changes to payment-page scripts and HTTP headers (requirements 11.6.1 and 6.4.3)
- Targeted risk analyses for every control with a customer-defined frequency
- Stronger password rules (12 characters), phishing-resistant controls and expanded encryption of stored data
- Formal roles and responsibilities documented for all twelve requirements
Key facts
| Current version | PCI DSS v4.0.1 (v3.2.1 retired 31 March 2024) |
|---|---|
| Validation route | Report on Compliance (Level 1) or Self-Assessment Questionnaire A / A-EP / B / C / D |
| Requirement groups | 12 requirements across 6 control objectives, 250+ sub-requirements |
| Typical project | 10–16 weeks including remediation |
| Applies to | Any entity that stores, processes or transmits cardholder data, plus entities that can affect its security |
Where the work actually happens
Most of the cost in PCI DSS is scope. Before we assess anything, we work to shrink the cardholder data environment through segmentation, tokenisation and redirect-based payment flows.
CDE scoping & segmentation
Data-flow mapping across every channel, then network segmentation with segmentation penetration testing to prove isolation.
Tokenisation & P2PE strategy
Remove PAN storage entirely where possible; move e-commerce to SAQ A eligibility by redesigning the payment flow.
Requirements 1–6 · Build & maintain
Firewall and router rulebase review, secure configuration baselines, encryption in transit and at rest, secure SDLC and vulnerability management.
Requirements 7–9 · Access
Least-privilege access model, unique IDs, MFA everywhere in the CDE and physical security for media and devices.
Requirements 10–11 · Monitor & test
Centralised logging with automated review, file integrity monitoring, quarterly ASV scans and annual internal/external penetration testing.
Requirement 12 · Governance
Information security policy, targeted risk analyses, security awareness, incident response and third-party service provider due diligence.
Who must comply
Merchant levels are set by annual transaction volume, and service providers by the volume they process on behalf of others. Your acquiring bank confirms your level, and it determines whether you need a QSA-signed Report on Compliance or a self-assessment.
- E-commerce merchants and marketplaces, including those using hosted or iframe payment pages
- Payment aggregators, payment gateways, PA-DSS/SSF software vendors and switch operators
- Banks, NBFCs, wallets and card issuers processing or storing PAN data
- BPOs and call centres capturing card data over voice or chat
- Cloud and hosting providers whose infrastructure supports a client cardholder data environment
Smaller scope, lower cost
Scope reduction typically removes 40–70% of systems from assessment before the first control is tested.
Fewer card-data breaches
Segmentation and tokenisation remove the asset attackers want, rather than adding another layer around it.
Acquirer-ready evidence
Attestation of Compliance and supporting evidence packaged the way banks and schemes expect to receive it.
No last-minute surprises
Quarterly ASV scan and penetration test calendars are set at kickoff so validation never stalls on a missing scan.
How the engagement runs
Discovery & PAN data hunt
Automated discovery finds unencrypted card data in databases, file shares, logs and call recordings you did not know existed.
Scope reduction design
We redesign flows and network zones to shrink the CDE, then validate isolation with segmentation testing.
Gap assessment against v4.0.1
All 12 requirements assessed control-by-control, with each gap costed and assigned an owner and due date.
Remediation & targeted risk analyses
We implement controls with your teams and document every TRA the customised approach requires.
Validation
QSA-led RoC and AoC, or SAQ completion with evidence review, plus ASV scan management and acquirer submission.
What you receive
- Cardholder data flow diagrams and network segmentation architecture
- PAN discovery report across structured and unstructured data stores
- PCI DSS v4.0.1 gap assessment with prioritised remediation roadmap
- Policy and procedure set covering all 12 requirements
- Targeted risk analyses for customised and periodic controls
- ASV scan and penetration test coordination with retest to clean
- Report on Compliance / SAQ and Attestation of Compliance support
PCI DSS — frequently asked questions
It depends on your level. Level 1 merchants (over 6 million card transactions a year) and most service providers need a QSA-signed Report on Compliance. Levels 2–4 usually self-assess with an SAQ, though many acquirers now require QSA involvement anyway. We confirm your obligation with your acquirer before quoting.
Not entirely. Even fully redirected e-commerce falls under SAQ A, and v4.0.1 added requirements 6.4.3 and 11.6.1 covering payment-page scripts and header integrity, which apply to your own website. The scope is small, but it is not zero.
Indian regulators reference PCI DSS in card storage, tokenisation and payment aggregator guidelines. A PCI DSS programme covers most of what an RBI system audit or PA/PG authorisation review will look for, and we map the overlap so you do not run two parallel projects.
A failed control becomes a remediation item, not a permanent verdict. We agree a remediation window with the QSA, fix and retest. The reason we run a full internal readiness assessment first is to make sure the formal assessment is never the moment you discover a gap.
Yes — validation is annual, but several requirements run continuously: quarterly ASV scans, quarterly internal scans, periodic access reviews, daily log review and annual penetration testing. We provide a compliance calendar so nothing lapses between assessments.
That is one of our most common engagements. Redesigning the checkout to a hosted field or full redirect, plus removing legacy PAN storage, can move a merchant from 250+ applicable controls to roughly 30. The redesign usually pays for itself in the first assessment cycle.
Still not sure what applies to you?
Ask an assessor directly — we answer scoping questions before anyone talks about a fee.
Get a realistic timeline and a fixed fee
A 30-minute call is usually enough to scope PCI DSS accurately. You will leave with a timeline, an evidence checklist and a number — whether or not you engage us.