PCI DSS 4.0 Snapshot
You take credit cards. You're supposed to be PCI compliant. But which SAQ do you even need? What's actually required for your setup? We figure it out and tell you where you stand.
This is for you if:
- You process credit cards and need to figure out your PCI requirements
- Your acquiring bank is asking about PCI compliance
- You need to know what gaps you have before your next assessment
- PCI DSS 4.0 came out and you're not sure what changed
What you get
SAQ Type Determination
Which SAQ you need (A, A-EP, B, B-IP, C, C-VT, D, P2PE) and why. No more guessing. We analyze your payment flow and tell you exactly which questionnaire applies.
Card Data Flow Diagram
Visual map showing where card data enters, moves through, and leaves your environment. This is the foundation for understanding your scope and protecting cardholder data.
PCI DSS 4.0 Gap Analysis
Your current state vs. requirements. What you have, what you're missing, what will fail an assessment. Aligned to the latest 4.0 standard with all new requirements flagged.
Remediation Roadmap
Prioritized list of fixes. What to tackle first, what can wait, and estimated effort for each. Includes both immediate requirements and those with grace periods.
Scope Reduction Recommendations
Ways to minimize your cardholder data environment. Less scope means less work, less cost, and less risk. We show you where you can reduce exposure.
QSA Prep Documentation
If you need a QSA, this gets you ready. Documented scope, control inventory, and gap status so you can get accurate quotes and avoid surprises.
The process
8 steps from intake to complete PCI DSS 4.0 assessment.
Submit intake
Online form
Payment flow review
How you process
SAQ determination
Right questionnaire
CDE mapping
Data flow diagram
Control assessment
4.0 requirements
Gap analysis
What's missing
Scope reduction
Recommendations
Delivery
Full report
Mount Saint EliasWhat's included
- SAQ type determination
- Card data flow diagram
- PCI DSS 4.0 gap analysis
- Scope reduction recommendations
- Remediation roadmap
- QSA prep documentation
- Future-dated requirements flagged
- Control inventory checklist
- 30-day email support
Important
This engagement constitutes a gap assessment and does not include completion of a Self-Assessment Questionnaire (SAQ). This assessment evaluates your current compliance posture to facilitate confident SAQ completion or preparation for engagement with a Qualified Security Assessor (QSA).
SAQ types explained
There are 8 different SAQ types depending on how you handle card data. Pick the wrong one and you're either doing too much work or not enough. We figure out exactly which one applies to your setup.
Card-not-present, fully outsourced
E-commerce with website redirect
Imprint machines only
Standalone IP terminals
Payment application systems
Virtual terminal only
P2PE hardware terminals
All others (merchant/SP)
Before vs After
Without assessment
Guessing which SAQ to use
Card data flows unknown
4.0 changes unclear
Scope larger than needed
Assessment surprises
With PCI Snapshot
Definitive SAQ type
Complete data flow diagram
4.0 requirements mapped
Scope reduction identified
No surprises at assessment
Result
PCI clarity in 10 days
Common questions
We use Stripe/Square/etc. Do we still need PCI compliance?
Yes, but your scope is usually smaller. Using a payment processor reduces what you need to do, but doesn't eliminate it. We'll figure out exactly what applies to you based on how you integrate with them.
What's the difference between PCI DSS 3.2.1 and 4.0?
PCI DSS 4.0 has new requirements and more flexibility in how you meet them. Some 4.0 requirements are mandatory now, others have a grace period until March 2025. We assess against 4.0 and tell you which requirements are immediate vs future-dated.
Do we need a QSA after this?
Depends on your volume and how you process cards. Most companies self-assess with an SAQ. Level 1 merchants and service providers typically need a QSA. If you need one, this package gets you ready for that conversation.
What if we're not compliant right now?
Most companies aren't fully compliant when they start. The point is to know the gaps so you can fix them. We won't judge—we'll just tell you what needs work and help you prioritize.
Can you help with remediation too?
This package is assessment only. If you need help fixing things, email us after you see the results. We can quote follow-on work if it makes sense.
How do I know which SAQ I need?
It depends on how you accept cards and where cardholder data touches your systems. We analyze your payment flow and give you a definitive answer. No more guessing or hoping you picked the right one.
Know where you stand on PCI.
We figure out your SAQ type, map your card data flows, and show you every gap. 10 days, $2,490, clear answers.
Get Started