Payments · Framework
PCI DSS v4.0.1, the payment card data security
The security standard for anyone who stores, processes or transmits card data.
- Type
- Framework
- Group
- Payments
- We help with
- Cybersecurity and VAPT
- Issued by
- QSA or self-assessment (SAQ)
What it is.
PCI DSS v4.0.1 is the Payment Card Industry Data Security Standard. It applies to any entity that stores, processes or transmits cardholder data. The requirements that were previously future-dated became mandatory on 31 March 2025.
Who usually needs it
- Merchants and e-commerce businesses
- Payment service providers and fintechs
- Service providers that can affect cardholder data security
What it covers.
- 01
Scope
The cardholder data environment and connected systems.
- 02
Security requirements
Network security, secure configuration, access control, logging, testing and policy.
- 03
Future-dated requirements
Became mandatory on 31 March 2025.
How we help with PCI DSS
We first reduce scope: where card data flows, whether a hosted payment page or tokenisation can take systems out of scope, and which Self-Assessment Questionnaire (SAQ) or Report on Compliance your acquirer expects. Then we help you meet the remaining requirements, including the v4.0.1 items that became mandatory on 31 March 2025, and prepare evidence for your QSA or SAQ.
Typical phases.
Each phase ends with something you keep. Timelines depend on scope and are agreed in the proposal.
- 1
Scope
- Data flow diagram
- Scope statement
- 2
Assess
- Gap report
- 3
Remediate
- Controls in place
- Test results
- 4
Ready
- Evidence pack
It applies to any entity that stores, processes or transmits cardholder data, and to systems that can affect that security. Using a gateway can reduce scope, but rarely removes it entirely.
The requirements that were previously future-dated in PCI DSS v4 became mandatory.
No. We prepare you; the formal assessment is carried out by your assessor or through the applicable self-assessment.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal
This page is general guidance, not legal advice. Last reviewed October 2026.