PCI-DSS v4.0 Compliance
PCI-DSS v4.0 readiness, internal audit and QSA coordination.
Full PCI-DSS v4.0 readiness for merchants, processors, issuers, acquirers and service providers. Macksofy delivers ROC / SAQ readiness, network segmentation validation, ASV scanning and QSA coordination — all under one engagement.
- PCI-DSS v4.0 (mandatory March 2025)
- PCI Software Security Framework (SSF)
- PCI Mobile Payment Acceptance Security
- PCI 3DS Core Security Standard (where in scope)
Compliance is leverage, not paperwork.
PCI-DSS v4.0 became fully mandatory in March 2025 — with 64 new or revised requirements including continuous discovery of vulnerabilities, customised approach options and tighter authentication. Non-compliant merchants face fines from card brands ($5K–$100K+/month) and increased liability shift. Macksofy is the only Indian / UAE firm combining CERT-In empanelment with PCI-DSS depth across QSA-coordination, ASV scans and segmentation tests.
- Merchants — Levels 1–4 (transaction-volume tiers)
- Acquirers + Issuing banks
- Payment processors + gateways
- Service providers (storage / processing / transmitting CHD)
- Mobile wallet operators
Aligned to the regulations that matter.
How we run a PCI-DSS engagement.
Interactive walkthrough — every phase clickable, every activity documented, every artefact regulator-ready.
1 · Scope reduction + CDE definition
- 01Cardholder Data Environment (CDE) inventory
- 02Network segmentation review
- 03Tokenisation + scope-reduction architecture
Everything you need to satisfy auditors.
- PCI-DSS v4.0 gap analysis (per requirement)
- Network segmentation diagram + validation
- ASV scan reports (quarterly)
- ROC / SAQ + AOC drafts
- Targeted Risk Analysis (TRA) artefacts
- QSA-handover pack + remediation closure
v3.2.1 → v4.0 transition + ROC
Outcome: Cleared QSA assessment first attempt; saved ~₹35L in penalty exposure during transition
Scope-reduction + tokenisation architecture
Outcome: PCI scope reduced ~70% of systems; annual recurring audit cost down 40%
The shape of a PCI-DSS engagement.
Every number below is grounded in how Macksofy actually runs the engagement — not aspirational marketing copy.
What we actually examine.
Each pillar is a distinct workstream inside the engagement — scoped, evidenced, and signed off independently before the audit pack is assembled.
- Scope reduction3 pts
- Build & maintain secure systems3 pts
- Protect account data3 pts
- Vulnerability & access management3 pts
- Monitor, test, respond3 pts
- QSA audit pack3 pts
Most PCI cost overruns come from over-broad scope. We fix that first.
- Cardholder-data discovery & flow mapping
- Network-segmentation validation testing
- Tokenisation / outsourcing reduction strategy
PCI DSS v4.0 requirements 1, 2, 6 — secure baselines + change control.
- Firewall + segmentation rules walk-through
- Hardened-baseline evidence per device class
- Secure-SDLC artefacts (Req 6) for in-scope apps
Encryption, key management and access — the heart of the standard.
- Stored cardholder data: encryption + retention
- Key-management lifecycle (Req 3.6)
- Transmission encryption + cipher hygiene (Req 4)
Reqs 5, 7, 8 — Defender, MFA, RBAC, anti-malware evidence.
- Anti-malware coverage + tamper-protection
- Role-based access + least-privilege evidence
- MFA on all in-scope access (v4 enforcement)
Reqs 10–12 — daily ops evidence that QSAs sample heavily.
- Centralised logging + retention proof
- Internal + external ASV scans, segmentation test
- IR plan + breach-notification flow
Everything the Qualified Security Assessor needs in one place.
- Self-assessment questionnaire (SAQ) or RoC dry-run
- Evidence catalogue keyed to each requirement
- Compensating-controls worksheet where applicable
From kick-off to regulator-ready report.
The horizontal flow below shows the typical week-by-week shape of a PCI-DSS engagement. Click any station for detail in the methodology section above.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things compliance leads ask before signing.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements