PCI DSS v4.0 · CARDHOLDER DATA · READINESS

Under PCI DSS, scope is the whole argument — and the whole bill.

One card payment puts you in scope. What it costs depends on how far the data spread.

Apply to be an Auditor Request an Audit
A compliance professional seated at a desk in a warm, low-lit office, signing a printed document with a pen, further papers and a cup of coffee on the desk beside them and a window throwing daylight across the page.
Validated once a year, required every other day
12 requirements Cardholder data environment Segmentation SAQ and RoC Quarterly ASV scans

Our promise

“Self-assessment is a form. The test is evidence.”

Every finding is written against a clause of the instrument itself — defensible line by line, to anyone who asks. The fee is fixed at $12,500, and nothing is charged until you approve it.

Each additional system
$3,000
Re-audit, same scope
$8,000
Renewal, every twelve months
$10,500 locked

This costs more than the estate ladder, and it should. The ladder is a private assessment written for you. A framework readiness assessment produces a published summary iDharma maintains for twelve months - a notice template where the law requires one, a 60-day expiry warning, and a quarterly check that the summary is still live and still linked.

Request this readiness assessment
Readiness assessment Certification is issued by an accredited certification body, not by iDharma. We assess your readiness against the standard and prepare the evidence and gap list that body will ask you for.
The case file

PCI DSS, in three chapters

The Standard

PCI DSS reaches anyone who stores, processes or transmits cardholder data, from the first transaction. It is a contract, not a statute: the 12 requirements come from the card brands, through your merchant agreement - which changes who enforces them but not whether they apply.

The Gap

Version 4.0 became mandatory when v3.2.1 retired in March 2024, and it widened the argument — multi-factor authentication across every path, payment-page skimming duties, and a risk analysis that now has to be evidence in its own right rather than a background assumption.

The Scope

We map where the data actually went before testing anything against it. Every system touching cardholder data pulls itself, and everything connected to it, into the assessment — so a boundary drawn early is the cheapest control on this page, and the one nobody ever budgets for.

What is the CDE?

The part of your estate the card data reached.

Every system that touches cardholder data, plus everything connected to it.

Who is caught № 01
  • Merchants, at every transaction volume there is
  • Service providers handling card data for others
  • Payment gateways and e-commerce checkout paths
  • Hosting providers inside a customer’s environment
PCI DSS · iDharma · Presented for review
What drags a system in № 02
  • Card data stored, processed or passed through it
  • A flat network path to something that does
  • An analytics table or feature store holding a copy
  • A model prompt or an inference log carrying a PAN
PCI DSS · iDharma · Presented for review
Whose job is which

The data is yours. The switch is theirs.

You

The entity that takes the card

Every requirement lands on whoever stores, processes or transmits cardholder data - at any volume, from the first transaction. The merchant level, which your acquirer sets, does not change what you must do. It changes only how you are made to prove it, and who has to countersign the proof.

Your acquirer

The bank that can switch you off

PCI DSS is a contract rather than a statute, so the consequence arrives through your merchant agreement instead of through a regulator. Your acquiring bank sets your level, receives the Attestation, prices the risk - and can end card acceptance outright, which no regulator anywhere can do.

The line

We are not a QSA, and cannot be yours

Only a Qualified Security Assessor can produce a Report on Compliance, and nobody signs a Self-Assessment Questionnaire except you. iDharma assesses readiness and builds the evidence either route needs - which is why nothing we find is ever commercially convenient for us.

What most teams assume

“We filled in the SAQ, so we’re compliant.”

What the form says

Nobody signs an SAQ except you.

It is the most common finding we write up.

  • Who it is for
  • E-commerce & marketplaces
  • SaaS & payment gateways
  • Hosting providers
  • Service providers
  • Anyone taking cards
Why this matters in 2026
A clipped stack of printed reports on a dark desk, the top sheet headed AUDIT and stamped CONFIDENTIAL, with tabbed dividers below it labelled CONFIDENTIAL, AUDIT EVIDENCE and FINANCIAL RECORDS.
01 The consequence arrives through your merchant agreement, not through a regulator — and it escalates with how long the position persists rather than with what you meant.
02

An acquirer can raise your per-transaction pricing and leave it raised. That is a permanent margin cost, not a one-off penalty.

03

It can also end card acceptance outright. Reinstatement means full validation, and finding a bank willing to take on the history.

04

Validation is annual and the standard is daily. Most of the findings live in the eleven months of the year when nobody at all is looking at it.

The 60-second check

Three questions. Then you’ll know.

No email. No signup. A starting point, not a determination.

0 of 3

The integration -

There is no volume exemption. One card payment a year puts you in scope. What changes with the integration is how much of your estate comes with you.

Copies downstream -

A copy is the original, for scope. A feature store holding account numbers is stored cardholder data; a prompt carrying one is cardholder data in transmission; a retained inference log is both.

Last validation -

Only v4.0 counts now. v3.2.1 retired on 31 March 2024, and several v4.0 requirements were best practice only until 31 March 2025 — worth knowing which your last assessment treated as optional.

The calendar

Four rhythms, and the first one sets the price.

Three of these are set by the card brands and your acquirer rather than by you - so they cannot be added up, and they cannot be run in parallel.

  1. Scope

    Before anything

    Every system touching card data drags everything connected to it in. Segmentation is the cheapest control here.

  2. Scan

    Quarterly

    External scanning by an Approved Scanning Vendor, on cadence, with the passing scans retained as evidence.

  3. Validate

    Annually

    A Report on Compliance from a QSA, or a Self-Assessment Questionnaire - both end in an Attestation.

  4. Operate

    Every day between

    Log reviews, patching, access reviews. Validation is annual; the standard is daily. The gap holds findings.

The trap

Teams treat validation as the deadline and the rest of the year as slack. The standard applies every day, and an assessor samples the whole period - so a quarter with no log review, or a scan that failed and was never re-run, is a finding at the next one.

Requirement & coverage

What the standard asks, what we ship

12 requirements, and the artefact that evidences each one. Paired, so every claim on this page can be checked against the requirement beside it.

Network security controls Requirement 1 - Secure network
The environment boundary drawn and defended: diagrams, rule sets reviewed rather than inherited, and the segmentation evidence.
Secure configurations Requirement 2 - Secure network
Vendor defaults changed, unnecessary services disabled, and a hardening standard someone can be shown to follow.
Protect stored cardholder data Requirement 3 - Cardholder data
Storage minimised, the account number masked, encryption where it is kept - and the copies in analytics and model stores found.
Protect data in transmission Requirement 4 - Cardholder data
Strong cryptography over open networks, and an inventory of every boundary card data crosses.
Anti-malware protection Requirement 5 - Vulnerability management
Anti-malware deployed, maintained and actually reporting on the systems the standard reaches, with the gaps named.
Secure systems and software Requirement 6 - Vulnerability management
Patches on a defined timeline, secure development evidenced rather than asserted, and the payment-page protections v4.0 added.
Restrict access by need to know Requirement 7 - Access control
Role-based access to systems in scope, and a review that removes the access nobody needs.
Identify and authenticate access Requirement 8 - Access control
A unique identifier per person, and multi-factor authentication across every path v4.0 reaches.
Restrict physical access Requirement 9 - Access control
Physical security for systems and media, and a disposal path for anything that ever held card data.
Log and monitor all access Requirement 10 - Monitor and test
Audit trails across every access in scope, retained as required, and a log review someone performs and records.
Test systems and networks Requirement 11 - Monitor and test
Quarterly scanning by an Approved Scanning Vendor, penetration test findings retained, and segmentation tested rather than diagrammed.
Policies and programmes Requirement 12 - Security policy
The policy suite under version control, the annual risk assessment, awareness training, and an incident response plan rehearsed.
The engagement

Card data, independently traced

From one checkout page to the whole estate.

  1. Scope

    Where cardholder data actually flows, and what that drags in with it.

  2. Test

    All twelve requirements against the environment as it really runs.

  3. Report and hand over

    You see the draft first. Then the gap list and the evidence pack - dated.

Request an assessment
An auditor in a charcoal suit and open-collared white shirt, standing against a warm pale wall and pointing into the open space alongside.
The scope argument, settled before anyone prices it.
Struck in your favour

Why teams choose iDharma before a PCI validation

Scope before controls

The cardholder data environment is mapped first, because everything else is priced off how big it is.

No report to sell

We are not a QSA and cannot become yours, so nothing we find is commercially convenient for us.

We look at the pipelines

Training sets, prompts and inference logs are checked for card data, which most assessments never open.

Evidence, not assertion

You get the artefacts a QSA or an acquirer asks for - not a score, and not a badge for your footer.

Four marks, struck on every report.

Deliverables

What you get

Concrete artefacts, each with a name and a format - you know what lands before you buy.

PCI DSS readiness report

The full assessment: where the environment stands against all twelve requirements, written requirement by requirement, with each gap ranked by what it costs at validation rather than by how easy it is to close. Where a scoping call is genuinely arguable - and on this standard several always are - it says so instead of picking the convenient reading.

Data map

Cardholder data inventory

Where card data flows - storage, transmission and retention - including copies in analytics tables, training sets and inference logs.

Diagrams

Scope and segmentation pack

The environment boundary drawn and argued, with network diagrams, rule-set review and segmentation testing that keeps the estate out of scope.

Repository

Policy and procedure set

The suite Requirement 12 expects, under version control and written to your operations rather than lifted from a template an assessor knows.

Per requirement

Evidence pack

Scans, logs, access reviews and change records assembled against the requirement each answers, in the order a QSA works through them.

SAQ or RoC

Validation route memo

Which questionnaire your integration lands on, or whether a Report on Compliance is required - settled in writing before you commit to a date.

Memo

AI exposure note

Where card data has reached analytics, training sets or model logs, what that pulls into scope, and the cheapest route back out of it.

Format & fee

Real numbers, upfront.

Scope
Where the card data went
Output
A gap list, not an Attestation
Re-review
Before each validation - $10,500 against your known baseline

The standard fixed the scope, so the fee is flat - nothing to meter, and nothing charged until you approve it.

Request this assessment
PCI DSS · Readiness assessment $12,500 flat
  • Cardholder data inventory & scope map
  • All 12 requirements tested
  • 30 policy and procedure documents
  • Evidence pack, per requirement
Show your hand

Four things a validation will ask you to produce

PCI DSS is not graded on intent. Each of these is either in your hand on the day somebody asks, or it is not.

The scope,
drawn

A cardholder data environment mapped to where the data actually is, not where the diagram says. Everything an assessment costs is priced off this one boundary.

The boundary,
proven

Controls that keep the rest of the estate out of scope, and the testing that shows the boundary holds. Untested segmentation is not segmentation, it is a diagram.

The scans,
passing

Quarterly external scans by an Approved Scanning Vendor, retained and passing. A failed scan that was never re-run is worse than one you never booked at all.

The sign-off,
current

The Attestation of Compliance your acquirer holds, matching the environment you run today. Validation is annual; the standard applies on all the other days.

Four cards, and the date on each one is part of the card.

FAQ

Plain answers

Scope, the CDE, SAQ against RoC, AI, cost. Answered straight.

Request this assessment
What is the cardholder data environment?

The part of your estate that stores, processes or transmits cardholder data, plus the people, processes and systems that touch it. Scoping it tightly is the single biggest lever on effort: segmentation keeps everything else out of the assessment.

What is the difference between an SAQ and a Report on Compliance?

A Self-Assessment Questionnaire is a validation tool you complete and sign yourself. A Report on Compliance is produced by a Qualified Security Assessor, with evidence review, interviews and testing. Both end in an Attestation submitted to your acquiring bank.

What changed in v4.0?

A customised implementation approach based on targeted risk analysis, multi-factor authentication for all access to the environment, new payment-page skimming duties, and explicit documentation of roles. v3.2.1 retired on 31 March 2024.

Where does AI touch PCI DSS scope?

In three places that routinely get missed. Card data copied into a training set or feature store is stored cardholder data. A prompt carrying an account number is cardholder data in transmission. Retained inference logs are a copy of both - and any of the three pulls that system into scope.

What does an iDharma PCI DSS assessment cover, and what comes with it?

A flat fee, stated in full on this page, with nothing charged until you approve the scope. It covers the cardholder data inventory, the scope and segmentation pack, the evidence set and the policy suite the assessment writes against. We are not a QSA and do not sign Reports on Compliance.

Get started

Request your PCI DSS assessment

Tell us how card data reaches you and we come back with a scoping call in a day.

What we need from you

Nothing you do not already have. Most of this comes out of your payment integration notes and your last validation in an afternoon, and we tell you which extracts first.

  1. How card data reaches you, and where it goes next
  2. Your merchant level, and who your acquirer is
  3. The last SAQ or Report on Compliance, if there is one
  4. Your most recent quarterly scan results
  5. Whether card data has reached analytics or a model

What happens next

  1. You send the five items we need.
  2. We call to scope it within one business day.
  3. Nothing is charged until you approve the scope.
Request an assessment
Sources & standing

Where this page gets its facts

Where the claims on this page come from, and what they are worth - stated, not assumed.

What it is drawn from

  • PCI DSS v4.0, published by the PCI Security Standards Council
  • The Council’s supporting SAQ and reporting documents
v4.0 mandatory
31 March 2024
Future-dated from
31 March 2025

What it means

  • General information about what the standard requires — not legal advice, and not a validation decision.
  • Where a scoping call is genuinely arguable, and on this standard several always are, our reports say so rather than pick the convenient answer.

Scope & limitation

  • No penalty figure appears on this page. Card-brand fines and acquirer fee increases are contractual and unpublished, they differ by brand and by agreement, and they are the most-often-wrong detail in summaries of this standard. Merchant level thresholds are set by the brands and differ between them, so they are attributed rather than stated. Ask your acquirer what your agreement says.
  • iDharma is not a Qualified Security Assessor. We do not sign Reports on Compliance and cannot validate you.

Something on this page out of date?

Tell us

From Insights

Before you commission one

View all Insights →
METHODOLOGY NOTES

How to Prepare for an AI Audit: The Readiness Checklist

Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.

Read the notes
METHODOLOGY NOTES

What Is an AI Audit? Scope, Standards, and What You Get

An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.

Read the notes
STANDARDS EXPLAINED

What an AI Governance Framework Actually Contains

Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.

Read the guide
INSIGHTS

Startups, Meet Your AI Stack: Budget‑Friendly Tools That Scale

For early-stage founders, building an AI-powered toolkit doesn’t have to break the bank. From ideation to growth mode, here’s how startups can tap into affordable, effective AI tools to autom

Read more