PCI-DSS Compliance Services

Protect cardholder data and achieve PCI DSS compliance with expert assessments, gap analysis, and hands-on remediation support.

Get a PCI-DSS Assessment

Requirements

PCI DSS Core Requirements

Network Security

Install and maintain network security controls. Protect the cardholder data environment with properly configured firewalls and segmentation.

Data Protection

Protect stored account data and encrypt transmission of cardholder data across open, public networks using strong cryptography.

Vulnerability Management

Protect systems against malware, develop and maintain secure systems and software with regular patching.

Access Controls

Restrict access to cardholder data by business need-to-know. Identify users and authenticate access to system components.

Monitoring & Testing

Log and monitor all access to network resources and cardholder data. Regularly test security systems and processes.

Security Policies

Maintain an information security policy that addresses all PCI DSS requirements for personnel.

Our Process

How We Get You PCI Compliant

Scoping & Data Flow Mapping

Identify all systems, people, and processes that store, process, or transmit cardholder data.

Gap Assessment

Evaluate current controls against all applicable PCI DSS requirements and identify gaps.

Remediation Planning

Prioritized remediation roadmap with implementation guidance for each gap identified.

Control Implementation

Hands-on support implementing security controls, policies, and technical safeguards.

Validation & Documentation

Comprehensive evidence collection and documentation to demonstrate compliance readiness.

Overview

What is PCI-DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard for all entities that store, process, or transmit cardholder data. Compliance is mandatory for any organization that handles credit card transactions.

PCI DSS v4.0, released in March 2022 with mandatory compliance by March 2025, introduces significant updates including customized implementation approaches, enhanced authentication requirements, and expanded encryption mandates. SiegePal ensures your organization meets the latest requirements.

PCI DSS v4.0

What PCI DSS v4.0 Changed and Why It Matters

PCI DSS v4.0 introduced two significant structural changes that affect how organizations approach compliance. The customized implementation approach allows organizations to meet the intent of a requirement through compensating controls designed for their specific environment, rather than implementing prescriptive controls that may not fit modern cloud-native architectures. This flexibility is valuable but comes with a higher evidence burden: the organization must document the methodology, test effectiveness, and demonstrate that the custom control meets the requirement objective.

The authentication requirements in v4.0 are materially stronger than v3.2.1. Multi-factor authentication is now required for all access into the cardholder data environment, not just administrative access. Passwords must meet minimum length and complexity requirements that most organizations had not enforced previously. Session management controls are more specific about timeout requirements and re-authentication triggers. Each of these translates to specific configuration changes in your identity provider, cloud IAM policies, and application authentication layer.

Encryption mandates were expanded to cover additional transmission scenarios and storage contexts that v3.2.1 did not explicitly address. Organizations that had addressed the prior requirements in good faith may find gaps under v4.0 that require infrastructure changes rather than documentation updates. We assess your environment against the v4.0 baseline specifically, not against prior versions, so the gap analysis reflects what your current obligations actually are.

Scoping and Reduction

PCI DSS Scoping, Segmentation, and Scope Reduction in Cloud Environments

Defining the Cardholder Data Environment

PCI DSS scope covers all systems that store, process, or transmit cardholder data, and all systems that could affect the security of those systems. Scoping errors are the most expensive mistake in a PCI engagement: too narrow and you pass an assessment that does not cover your actual risk; too broad and you create compliance obligations that significantly increase cost and complexity. We conduct data flow mapping across your cloud environment before defining scope, tracing cardholder data from ingestion through processing, storage, and transmission to establish what is genuinely in scope.

Network Segmentation

Network segmentation is the primary mechanism for limiting PCI DSS scope in cloud environments. Systems outside a properly isolated cardholder data environment, with no connectivity paths into it, are out of scope. In AWS, GCP, and Azure this means VPC segmentation, security group rules, and network ACLs designed to prevent any traffic path between in-scope and out-of-scope systems that is not explicitly required and monitored. We assess whether your current segmentation is sufficient to support scope isolation claims and identify any connectivity paths that undermine the boundary.

Tokenization and Scope Reduction

Tokenization replaces primary account numbers with non-sensitive tokens at the point of capture, so downstream systems never handle actual cardholder data. Systems that store and process only tokens are generally out of PCI DSS scope, which can dramatically reduce the compliance footprint for organizations that currently handle raw PANs across multiple systems. We assess whether tokenization is feasible in your current payment processing architecture and, where it is, help you implement it in a way that the assessor will accept as genuinely removing those systems from scope.

Industries

Who Needs PCI-DSS Compliance

E-commerce & Online Retailers

Financial Services & FinTech

Payment Processors & Gateways

SaaS Platforms Handling Payments

Hospitality & Restaurant Chains

Healthcare Organizations with Payment Processing

Our Approach

PCI DSS Gap Assessment at the Infrastructure Level

PCI DSS has direct experience behind it at SiegePal. We have conducted gap assessments against FedRAMP NIST 800-53 and PCI-DSS control frameworks with control-by-control verification against live cloud infrastructure and codebase, not documentation review alone. That experience shapes how we approach every PCI engagement: every gap we identify is grounded in what we can demonstrate exists or is absent in your actual environment.

For each requirement in scope, we pull the relevant infrastructure configuration directly. Firewall rules and VPC security groups are reviewed against the network security requirements. IAM policies and authentication configurations are examined against the access control requirements. Encryption settings on every storage resource in scope are verified against the data protection requirements. Logging configurations are checked for completeness, integrity controls, and retention periods. The gap analysis reflects what your environment does, not what your policies describe.

Remediation guidance is written at the implementation level. For cloud configuration gaps we provide specific resource configuration changes alongside the finding. For application-layer gaps we identify the precise code or service configuration that needs to change. Your engineering team can work directly from our remediation roadmap without needing to interpret high-level recommendations into actionable tasks.

The Cost of Non-Compliance

PCI-DSS non-compliance can result in fines of $5,000 to $100,000 per month from card brands, liability for fraud losses, increased transaction fees, and potential revocation of card processing privileges. Beyond financial penalties, a data breach erodes customer trust and can trigger costly forensic investigations and legal action.

Explore our full range of compliance services

FAQ

Common Questions About PCI DSS Compliance

What is the difference between a SAQ and a ROC for PCI DSS?

A Self-Assessment Questionnaire is a validated self-assessment tool available to merchants and service providers that meet specific eligibility criteria, primarily smaller transaction volumes and limited cardholder data environment complexity. A Report on Compliance is a formal assessment conducted by a Qualified Security Assessor and is required for Level 1 merchants processing over six million Visa or Mastercard transactions annually, and for service providers above certain thresholds. The SAQ type that applies to your organization depends on how you accept payments, whether you store cardholder data, and your transaction volume. We help you determine which validation path applies before scoping the engagement.

How does PCI DSS apply to cloud-hosted environments on AWS, GCP, or Azure?

Cloud providers can be PCI DSS compliant at the infrastructure layer, and most major providers publish their compliance documentation. However, cloud provider compliance covers the underlying infrastructure, not what you build on top of it. Your organization remains responsible for the configuration of cloud services within the cardholder data environment: IAM policies, security group rules, encryption settings, logging configuration, and network segmentation. We assess the customer responsibility layer directly, pulling your cloud configuration and comparing it against the applicable PCI DSS requirements rather than relying on the provider's compliance documentation to cover your environment.

Can we reduce our PCI DSS scope by using a payment processor that handles cardholder data for us?

Yes, but scope reduction depends on the specifics of the integration. If your payment processor uses a hosted payment page or tokenization solution that prevents cardholder data from ever reaching your systems, your scope can be significantly reduced. If your systems transmit, process, or store any cardholder data before passing it to the processor, those systems remain in scope regardless of the processor's own compliance status. We map your payment data flows at the start of every engagement to establish precisely what scope reduction your current integration supports, and where architecture changes could reduce it further.

What changed between PCI DSS v3.2.1 and v4.0 that we need to address?

The most operationally significant changes in v4.0 are the expanded multi-factor authentication requirements, stronger password and session management controls, new targeted risk analysis requirements for several previously prescriptive controls, and enhanced encryption mandates. v4.0 also introduced the customized implementation approach, which allows organizations to meet requirement objectives through alternative controls rather than prescriptive ones, but this requires documented methodology and independent testing. Organizations that were compliant under v3.2.1 should not assume their current controls satisfy v4.0 without a gap assessment specifically against the new version.

How long does a PCI DSS gap assessment typically take?

Duration depends on the size of your cardholder data environment, the number of in-scope systems, and whether you have existing documentation and controls to build from. A focused assessment for a SaaS company with a well-defined, segmented cardholder data environment typically runs four to eight weeks. More complex environments with multiple payment channels, legacy systems, or significant remediation backlogs take longer. We scope the engagement after an initial architecture review so you get an accurate timeline before committing, rather than a fixed estimate based on organization size alone.

Insights