PCI DSS Readiness Assessment
SAQ recommendation engine, critical finding detection, and gap register for merchants and service providers. v4.0 new requirements — payment page scripts, MFA, change detection — all covered. SAQ-A and SAQ-B assessments are completely free.
Before you start — what to have ready for PCI DSS
Gather these first. Every one of them is something the assessment will ask for, and finding them mid-way is where an assessment stalls.
Decide your scope first
This module works out which controls apply to you from your answers, so complete the scope step first. Starting without it assesses a population you did not choose.
- Which systems, services and locations are in scope — write this down before you answer anything.
- Who owns each area, so an answer about it is somebody’s to give.
- The period the evidence should cover, where the framework opines on a period rather than a moment.
Gather these documents
What PCI DSS is assessed against. Find them before you start — the assessment reads what you upload, not what you tell it.
- Network / cardholder data environment (CDE) diagram
- Firewall and router configuration standards
- Information security policy and acceptable use policy
- Access control policy and user access review
- Vulnerability scan and penetration test reports
- Change management and patch management records
- Written agreements with third-party service providers (TPSPs) and their AOCs
Have the right people
Who needs to be involved, and what changes if it is only you.
- Someone who can find the documents — usually whoever owns the control day to day.
- A second person to review what was uploaded, if you want reviewed coverage. They must not be the person who submitted or attached that evidence: no one reviews their own work.
- One person can complete the whole assessment. Reviewed coverage will read zero, and that is accurate rather than a fault.
- A reviewer’s acceptance is what raises a control from partial to proven, and every workspace has that during the open beta. It becomes something a plan includes once there is anything to buy.
Prepare the files
Upload only what the assessment needs. You are responsible for removing or masking personal and sensitive data that a control does not require — do it before you upload. NEVER upload actual cardholder data (PAN), and never upload live firewall rule-sets with real public IPs or credentials. Redact IP addresses and secrets, and provide standards and diagrams, not live configs.
- Upload digital documents only — a Word file, a spreadsheet, or a PDF with real text. A photograph or a scanned paper has no readable text, so it cannot be assessed or prove a control.
- A scan or a photograph has no text to read, so it cannot prove a control. Export the original instead.
- The same file cannot be uploaded twice to one library — it is recognised by its contents, not its name.
- Upload the document itself, not a summary of it. A summary is your description of the evidence, not the evidence.
- A document that is not about this framework will be accepted and matched against nothing. It still counts against your library, so it is worth checking before you send it.
Know what you will get
So the result is what you expected when you started.
- You get a readiness position derived from the evidence you upload, and a list of where the gaps are.
- You do not get an audit, an opinion, or a certification. Only a licensed auditor, an accredited certification body, or the relevant regulator can give you those.
- Controls you upload nothing for are reported as UNEXAMINED — not as failed. That distinction is deliberate.
- A document can support a control without proving it. Supporting evidence raises a control to partial; reaching proven takes evidence a second person independently reviewed and accepted.
SAQ routes — who qualifies for each
Your processing environment informs the SAQ type our tool recommends. SAQ type is a legal/regulatory determination — our tool provides a conservative recommendation that must be confirmed with your acquirer and card brands.
| SAQ type | Requirements | Plan |
|---|---|---|
| SAQ-A | ~22 | Free |
| SAQ-A-EP | ~61 | Engagement |
| SAQ-B | ~41 | Free |
| SAQ-B-IP | ~83 | Engagement |
| SAQ-C-VT | ~65 | Engagement |
| SAQ-C | ~83 | Engagement |
| SAQ-P2PE | ~33 | Engagement |
| SAQ-D-Merchant | ~250+ | Engagement |
| SAQ-D-SP | ~250+ | Engagement |
| ROC | All | Professional |
SAQ-A and SAQ-B assessments are fully free. All other SAQ types show a 5-control critical preview then require an Engagement plan for the full assessment.
Merchant levels — validation requirements
Your acquiring bank may set requirements stricter than the card brand minimums. Always confirm with your acquirer.
How it works
Describe your payment environment — entity type, channels, terminal type, and how your payment page is hosted. The SAQ type recommendation is derived from your answers.
Rate controls 0–3 across PCI DSS Requirements 1–12. Evidence cap rule applies automatically. Critical finding triggers are flagged in real time.
See your readiness level (Critical → Substantially Evidenced), compliance calendar status, domain heatmap, and a prioritised gap register. Export as JSON.
Upload documents once — each is checked against every requirement on your SAQ path. Evidence must be current: ASV scan evidence older than the 92-day quarterly window cannot prove a control.
PCI DSS v4.0.1 (June 2024) is the current standard — v3.2.1 was retired March 2024. All future-dated v4.0 requirements became mandatory on 31 March 2025. Key requirements added in v4.0 affecting merchants:
- →Req 11.6.1 — Automated change and tamper detection on payment page content and headers (affects SAQ-A).
- →Req 6.4.3 — Authorised inventory, integrity verification, and justification for all scripts on the payment page.
- →Req 8.4.2 — MFA now required for ALL access to the CDE, not just remote access.
- →Req 12.3.3 / 12.3.4 — Annual review of cryptographic suites and hardware / software technology inventories.
- →Req 12.5.2 — Formal PCI DSS scope documentation confirmed in writing at least annually.