PCI DSS gap analysis

PCI DSS 4.0 Gap Analysis and Readiness

Most teams don't fail PCI because they're careless. They fail because the scope is fuzzy, the evidence is scattered, and nobody mapped the current state against the standard before the real assessment started. We fix that. Maverick runs an independent gap analysis against all 12 PCI DSS 4.0 requirements, tells you exactly where you stand, and hands you a prioritized path to close it.

Get your PCI readiness scoped What's included
What's included

Readiness, gap analysis, and the pentest

Everything you need before your QSA or your SAQ, in one engagement.

CDE scoping

We map how cardholder data actually moves through your environment and define what's in scope, the step that makes or breaks everything downstream.

Data flows · Systems · Third parties

Gap assessment

Your current controls measured against the 12 requirements and their sub-controls, with every gap documented and risk ranked.

12 requirements · Risk ranked

Remediation roadmap

A clear, prioritized plan with owners and effort, not a 300 line spreadsheet nobody reads.

Owners · Effort · Priority

Scope reduction

Where segmentation, tokenization, or P2PE can pull systems out of scope and shrink your ongoing burden.

Segmentation · Tokenization · P2PE

Requirement 11 penetration test

PCI requires it anyway. We're OSCP certified testers, so we cover the test and the readiness work in one engagement.

Internal · External · Segmentation

What this isn't

We're not a QSA and we don't issue a Report on Compliance. We get you ready for the formal assessment, whether that's a QSA-led ROC or your own SAQ.

Readiness · Not certification
Why Maverick

Offensive security first, compliance second

We're an offensive security firm first. We test the way a real attacker would, then bring that same rigor to your compliance posture. One team, independent eyes, findings you can act on.

The people who map your CDE are the same senior testers who run your Requirement 11 pentest. No handoff between a compliance team and a testing team.

01
Scope

Map where cardholder data really goes, and cut what doesn't need to be in scope.

02
Assess

Measure every requirement, document every gap, rank by risk.

03
Test & retest

Run the pentest, then verify your fixes.

Deliverables

What you get

The readiness package
  • CDE scope definition and cardholder data flow documentation
  • Gap register mapped to all 12 PCI DSS 4.0 requirements, risk ranked
  • Prioritized remediation roadmap with owners and effort
  • Scope reduction recommendations
  • Requirement 11 penetration test report with evidence, reproduction steps, and remediation guidance
Remediation retest

Fix the pentest findings and we retest them. Retests are included within 90 days of report delivery, and the final report is updated to show which findings are closed.

To be clear about what this is: a readiness assessment and a penetration test. It shows where you stand and what to fix before the formal assessment. It is not a Report on Compliance, and it doesn't decide your compliance status. Your QSA or acquiring bank does that.

Scoping

What we need to scope it

Rough answers are fine. We'll come back with a scope, a timeline, and a fixed price.

  • How you take payments. E-commerce, card present, call center, or a mix, and which payment processors or gateways you use.
  • Merchant or service provider. Your merchant level or service provider status, and whether you file a SAQ or get a ROC today.
  • Environment. Locations, cloud accounts, and a rough count of systems that store, process, or transmit card data or connect to them.
  • Existing scope controls. Any segmentation, tokenization, or P2PE already in place.
  • Prior assessments. Last year's ROC or SAQ, previous pentest reports, and any open findings.
  • The date. When your assessment or attestation is due.
FAQ

PCI gap analysis questions

Are you a QSA?
No. We don't perform formal PCI DSS assessments or issue a Report on Compliance (ROC) or Attestation of Compliance. We do readiness, gap analysis, and the Requirement 11 penetration test, so you go into your QSA assessment or SAQ prepared.
Does PCI DSS require a penetration test?
Requirement 11.4 calls for internal and external penetration testing at least once every 12 months and after significant changes, plus testing of segmentation controls if you use segmentation to reduce scope. Which of these apply to you depends on how you validate, for example which SAQ you file. We'll sort that out during scoping.
Which version of PCI DSS do you assess against?
PCI DSS 4.0, using the current 4.0.1 revision. That includes the requirements that were future dated in 4.0 and are now in effect.
We only file a SAQ. Do we still need a gap analysis?
Often, yes. The SAQ is a self-assessment, which means you're the one attesting that every control is in place. A gap analysis checks that before you sign, and confirms you're filing the right SAQ for how you actually handle card data.
Will this guarantee we pass our assessment?
No one outside your QSA or acquiring bank can promise that. What we give you is a clear picture of where you stand, a prioritized plan to close the gaps, and a pentest report with retest results, so there are fewer surprises when the formal assessment starts.
Is the price fixed?
Yes. Once we've scoped the work you get a fixed price, and the pentest remediation retest is part of it. We'll also sign your NDA and MSA before any work begins.

Get your PCI readiness scoped.

Tell us how you take payments and when your assessment is due. We'll come back with a scope, a timeline, and a fixed price.

Email info@mavericksecurity.ai Scope it yourself first