# PCI DSS v4.0.1 readiness > PCI DSS is the payment card industry's security standard for any organization that stores, processes or transmits cardholder data, or can affect its security. Version 4.0.1 is current. CyberAccord scopes your cardholder data environment, runs a control gap analysis, helps complete Self-Assessment Questionnaires and prepares you for a Qualified Security Assessor. Source: https://www.cyberaccord.com/compliance/pci-dss ยท Last reviewed: 2026-10-21 We help merchants and service providers that store, process or transmit payment card data meet PCI DSS v4.0.1. That covers scoping, gap analysis, Self-Assessment Questionnaires and preparation for a Qualified Security Assessor. ## Key facts - **Current version:** PCI DSS v4.0.1; v3.2.1 and v4.0 are retired - **Who it applies to:** Merchants and service providers that handle card data - **Validated by:** A QSA (Report on Compliance) or a Self-Assessment Questionnaire - **Key date:** Future-dated v4 requirements mandatory since March 31, 2025 ## Who needs PCI DSS compliance? Any business that accepts, processes, stores or transmits payment card data, and any service provider that can affect the security of that data, must comply. Your acquiring bank and the card brands decide how you validate compliance, usually based on your transaction volume and how you take payments. Larger merchants and service providers typically need an on-site assessment by a Qualified Security Assessor, documented in a Report on Compliance. Many smaller merchants validate with a Self-Assessment Questionnaire. Both end with an Attestation of Compliance. ## What changed with PCI DSS v4? Version 3.2.1 was retired in March 2024, and v4.0 was retired at the end of 2024 in favor of v4.0.1, a limited revision that clarified wording. The requirements that v4 introduced as future-dated best practices became mandatory on March 31, 2025. Those newer requirements include broader multi-factor authentication into the cardholder data environment, targeted risk analyses for flexible requirements, stronger password rules and controls on scripts running in payment pages. If your last assessment predates them, expect new work. ## What does PCI DSS require? The standard is organized into 12 requirements under six goals: build and maintain a secure network, protect account data, maintain a vulnerability management program, implement strong access control, regularly monitor and test networks, and maintain an information security policy. ## What we do We review your cardholder data environment against the standard and report exactly where you fall short. Reducing scope is often the fastest win, so we look for ways to keep card data out of systems that do not need it. Self-Assessment Questionnaires are long and technical. We help you pick the right SAQ and answer it accurately. We also deploy and tune log monitoring that records the events PCI DSS requires, and we prepare you for the QSA when an on-site assessment is needed. ## What you get - Cardholder data environment scoping and data flow diagrams - Control gap analysis against PCI DSS v4.0.1 - Scope reduction recommendations - SAQ selection and completion support - Remediation plan for the v4 requirements that are now mandatory - Log monitoring setup aligned to PCI DSS logging requirements - QSA readiness review before an on-site assessment ## How it works 1. **Scope.** We map how card data enters, moves through and leaves your environment, and identify systems in scope. 2. **Gap analysis.** We compare your controls with the 12 requirements and give you a detailed report of what needs attention. 3. **Remediate.** We help you fix gaps, reduce scope and put monitoring in place, prioritizing the items assessors focus on. 4. **Validate.** We help you complete the right SAQ or prepare for your QSA so you can submit your Attestation of Compliance. ## Frequently asked questions ### Can CyberAccord sign our Report on Compliance? No. A Report on Compliance must be completed by a Qualified Security Assessor. We do the readiness work and gap analysis beforehand, and we help you complete Self-Assessment Questionnaires when an SAQ is the right validation path. ### Which SAQ do we need? It depends on how you accept payments, for example fully outsourced e-commerce, a payment terminal or systems that store card data. Your acquirer has the final say. We review your payment flows and recommend the SAQ that fits, then help you answer it. ### We use a third-party payment processor. Are we still in scope? Usually yes, though your scope can be much smaller. Outsourcing payment handling reduces what you have to protect, but you still have to validate compliance and manage the security of the pages or systems that connect to the processor. ### Is PCI DSS v4.0.1 a big change from v4.0? No. Version 4.0.1 clarified and corrected wording without adding new requirements. The larger shift was moving from v3.2.1 to v4, and the future-dated v4 requirements became mandatory on March 31, 2025. ### Does PCI DSS require penetration testing? Yes. Requirement 11 includes internal and external penetration testing at least annually and after significant changes, plus segmentation testing if you rely on segmentation to reduce scope. We can perform that testing as part of the engagement. ## Related - [Penetration Testing](https://www.cyberaccord.com/services/security-testing/penetration-testing): Manual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes. - [Managed Security](https://www.cyberaccord.com/services/managed-security): Managed device, email, cloud app, and AWS security, with a team that monitors alerts and responds to incidents for you. - [SOC 2](https://www.cyberaccord.com/compliance/soc-2): SOC 2 readiness and renewal: gap assessment, controls, policies and evidence, prepared for your independent CPA firm's audit. ## Contact CyberAccord - Book a free consultation: https://www.cyberaccord.com/contact - Phone: +1 (832) 429-5665 - Email: info@cyberaccord.com - Office: 8990 Kirby Dr, Suite 220, Houston, TX 77054