The Payment Card Industry Data Security Standard is mandatory for any organisation that stores, processes, or transmits cardholder data. Every PCI DSS v4.0.1 requirement is now scored, including the 51 that were best practice until March 2025.
What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards developed by the PCI Security Standards Council (PCI SSC), founded by Visa, Mastercard, American Express, Discover, and JCB. It applies to all organisations that store, process, or transmit cardholder data.
PCI DSS v4.0.1 has been the only active version since v3.2.1 retired in March 2024. The deadline that matters now is 31 March 2025, when the 51 future-dated requirements stopped being best practice and became scored in every assessment. There is no grace period left. The two that catch e-commerce hardest are 6.4.3, which requires every script on a payment page to be authorised and integrity-checked, and 11.6.1, which requires tamper detection on payment page content and HTTP headers.
Compliance requirements vary by merchant level, determined by annual transaction volume. Larger merchants require a Report on Compliance (RoC) from a Qualified Security Assessor (QSA); smaller merchants may self-assess using a Self-Assessment Questionnaire (SAQ).
Compliance requirements
PCI DSS v4.0.1 organises its 12 requirements across six goals, covering network security, data protection, vulnerability management, access control, monitoring, and policy.
Install and maintain network security controls, and do not use vendor-supplied defaults for system passwords and other security parameters.
Protect stored account data and protect cardholder data with strong cryptography during transmission over open, public networks.
Protect all systems and networks from malicious software, and develop and maintain secure systems and software.
Restrict access to system components and cardholder data by business need to know, and identify users and authenticate access.
Log and monitor all access to system components and cardholder data, and test security of systems and networks regularly.
Support information security with organisational policies and programmes, including a security awareness programme for all personnel.
Audit process
Netru manages the complete PCI DSS compliance journey, from defining your cardholder data environment through to QSA assessment and annual renewal.
We define your cardholder data environment (CDE) and identify all systems, processes, and personnel in scope for PCI DSS assessment.
We assess your current controls against all 12 PCI DSS v4.0.1 requirements, producing a prioritised remediation roadmap.
Your compliance manager guides implementation of required controls, with evidence collection throughout the remediation period.
For eligible merchants, we complete the appropriate SAQ and Attestation of Compliance (AoC) on your behalf.
For organisations requiring a Report on Compliance (RoC), we manage the engagement with a Qualified Security Assessor (QSA).
We prepare the Report on Compliance and Attestation of Compliance for submission to your acquiring bank or payment brand.
We provide ongoing support for annual PCI DSS assessments, quarterly vulnerability scans, and penetration testing requirements.
How Netru delivers it
Our team has deep experience in PCI DSS compliance across merchant levels and service provider tiers. We scope your CDE, implement controls, manage QSA assessments, and provide ongoing support for annual renewals and quarterly scanning requirements.
Talk to our teamBefore you talk to anyone