PCI DSS, scoped to reality.
PCI DSS rewards aggressive scope reduction. We help you minimize the CDE, implement controls correctly, and pass QSA review — without paying the enterprise-edition tax.
- Version
- PCI DSS v4
- Levels
- 1–4
- SAQ types
- All
- QSA support
- Yes
What's included
CDE scope reduction
The single highest-leverage activity in PCI. We help you minimize the cardholder data environment aggressively.
SAQ determination
Which SAQ actually applies — A, A-EP, B, C, C-VT, D-Merchant, D-SP. Often a surprise.
Control implementation
All 12 requirements implemented to the level your SAQ requires.
QSA selection (Level 1)
For Level 1, we help select a QSA and support the ROC engagement.
Tokenization & segmentation
Architectural work to reduce scope further — typically saves audit cost in subsequent cycles.
Annual reassessment
Annual posture refresh; SAQ resubmission or ROC support.
Engagement lifecycle
- 01Weeks 1–4
Scope + SAQ
CDE mapping and scope-reduction analysis. SAQ determination.
- 02Months 1–6
Implement
Controls implemented; tokenization / segmentation if applicable.
- 03Months 6–8
Assess
SAQ submission or QSA ROC engagement, depending on level.
- 04Annual
Reassess
Annual refresh + scope re-validation.
What you walk away with
- Minimized cardholder data environment
- Correct SAQ or ROC for your level
- All 12 requirements implemented and documented
- Brand-acceptable validation evidence
- Lower long-term assessment cost