PCI scope drives cost. Reduce it.
Most teams PCI-treat their whole network because they don’t have the segmentation map. The single highest-ROI move in PCI is reducing the cardholder data environment — fewer systems in scope, fewer §3 requirements to meet on each. Audit cost drops 60–80%.
- All 12 PCI DSS v4.0.1 requirements + Business-as-Usual mandate
- CDE scoping wizard with §1.2 segmentation validation
- QSA-ready scope diagram + ROC evidence vault + AOC export
- For procurement: cloud / on-prem / hybrid deployment pricing
What is PCI DSS compliance software?
Scope drives cost. Smaller CDE = fewer §3 requirements on fewer systems. RiskWatch’s CDE scoping wizard maps every system to its scope tier, validates §1.2 segmentation continuously, and produces the QSA-ready scope diagram + ROC + AOC. Aligned to PCI DSS v4.0.1 — all 12 requirements, every SAQ tier, both Defined and Customized Approach scoring. Audit cost drops 60–80% when fewer systems carry the §3 burden.
March 31, 2025 came and went. 90% of merchants wanted an extension.
Industry surveys found 93% of merchants saying v4.0 changes are “significant” and 90% concerned about meeting the deadline. The deadline arrived. Here's where the gaps actually are — based on what merchants and service providers report after the fact.
March 31, 2025 came and went. 90% wanted an extension.
Industry data: 93% of respondents flagged v4.0 changes as significant; 90% were concerned about hitting the deadline. All 50+ new requirements pre-loaded. Customized Approach path with the Targeted Risk Analysis worksheet so you can document compensating logic when the Defined Approach isn't feasible.
PAN in your CDE you can find. PAN in shadow IT — you're still liable.
Cardholder data discovery is the merchant pain v4.0 made urgent: PAN buried in endpoints, SaaS exports, support tickets, shadow IT. PAN-discovery integration with DLP + structured/unstructured scanning across your environment. Evidence captured per system, mapped to scope decisions.
Annual QSA audit was the old model. v4.0 demands BaU.
v4.0.1 explicitly mandates Business-as-Usual — controls operating continuously, evidence captured 365 days a year, log review daily, FIM weekly, scans quarterly. Evidence pulled continuously from your existing tooling — SIEM, EDR, FIM, vulnerability scanners — and auto-mapped to the requirement that needs it.
Every module a PCI program needs — in one platform.
Sixteen modules sharing the requirement library, CDE inventory, evidence vault, and audit trail. Built around the QSA workflow so the AOC is always 30 days away, not 90.
12 requirements at a glance
Per-requirement compliance %, top open findings, evidence freshness, ASV scan status, MFA coverage.
All 12 reqs · v4.0.1
70+ sub-requirements with testing procedures, Defined and Customized Approach paths, evidence templates per control.
Auto-discover the cardholder env
CMDB sync (ServiceNow, Lansweeper) maps systems as in-scope, connected-to, or out-of-scope. Visualize boundary diagrams.
A through D-SP
Right-sized SAQ assigned by acceptance channel and processing model. Auto-fill from prior assessments.
QSA-ready by design
Evidence linked to requirements, requirements to testing procedures, testing procedures to QSA report sections.
v4.0 Targeted Risk Analysis
Document the customized approach with risk analysis, control objective, and compensating control logic per Req 12.3.1.
Find PAN where it shouldn't be
DLP integration plus structured-data scans surface PAN, track-1/track-2, CVV in places it doesn't belong.
Business-as-Usual evidence
v4.0.1 BaU controls — log review, FIM monitoring, IDS/IPS — fed continuously from your security tools.
Req 6.3 + Req 11
CVE-aware finding management, ASV scan integration, internal scan tracking, pen-test schedule.
PCI + ISO 27001 + SOC 2
Each requirement maps to ISO 27001 Annex A, SOC 2 trust services, NIST CSF — score once, satisfy multiple.
Req 12.10.1 playbooks
IR plan, breach-detection procedures, forensic evidence preservation, card-brand notification templates.
Findings → assigned work
Convert findings into tracked tasks with owner, due date, evidence-of-close. Bidirectional Jira/ServiceNow sync.
Req 11.3 quarterly
External ASV scan results auto-mapped to Req 11.3 evidence. Trend pass/fail across quarters.
"Who scored Req 8.3?" answered instantly
Timestamped log of every control score, evidence upload, scoping change. QSA-admissible for ROC review.
Req 12 policies pre-built
12 ready-to-tailor PCI policies — info security, AUP, vendor management, incident response — with attestation tracking.
AOC + ROC submission
Pre-formatted Attestation of Compliance for acquirers. Self-Assessment Questionnaires for the major card brands.
Build · Protect · Monitor · Govern.
v4.0.1 is the most prescriptive PCI DSS to date — and the deadline for full compliance was March 31, 2025. RiskWatch covers all 12 requirements with 70+ sub-requirements, both Defined and Customized Approach paths, the new MFA requirements (Req 8.3 expanded), and the Business-as-Usual continuous-control philosophy.
- Build & Maintain Secure Networks (R1–2) — firewall config standards, default-password elimination, network segmentation testing
- Protect Cardholder Data (R3–4) — PAN storage minimization, encryption at rest and in transit, key management
- Vulnerability Management (R5–6) — antivirus + EDR coverage, secure SDLC, patch cadences, public-facing app protection
- Access Control (R7–9) — least privilege, unique IDs, MFA on all admin (Req 8.3 v4.0 expansion), physical CDE controls
- Monitor & Test (R10–11) — log management, FIM, IDS/IPS, ASV quarterly scans, penetration testing
- Information Security Policy (R12) — policy library, vendor mgmt, incident response, awareness training
PCI DSS + ISO 27001 + SOC 2 + NIST.
Most PCI DSS requirements have direct equivalents in ISO 27001 Annex A and SOC 2 trust services. RiskWatch maps every requirement to its counterpart so a single set of evidence satisfies multiple audits — PCI DSS for the QSA, ISO 27001 for certification, SOC 2 for the customer.
- ISO 27001:2022 Annex A — Req 1–2 maps to A.8.20–A.8.24, Req 3–4 to A.8.24, Req 7–8 to A.5.16/A.8.5
- SOC 2 trust services — PCI Req 6 → CC8.1, Req 8 → CC6.1/CC6.2, Req 10 → CC7.2, Req 12 → CC1
- NIST CSF 2.0 — PCI requirements mapped to Govern, Protect, Detect, Respond, Recover
- NIST 800-53 r5 — PCI Req 8 → IA family, Req 10 → AU family, Req 11 → SI family
- HIPAA Security Rule — for healthcare merchants — PCI Req 8 ↔ §164.312(d)
The PCI DSS structure, organized.
Network security controls, secure configurations, default-password elimination
PAN storage, encryption at rest and in transit, key management
Anti-malware, secure SDLC, patch cadences, public-facing app security
Log management, FIM, IDS/IPS, ASV scans, pen testing, BaU monitoring
Scope drives cost. Smaller CDE = fewer requirements on fewer systems.
The single highest-ROI move in PCI is reducing the cardholder data environment. Most teams PCI-treat their whole network because they don't have the segmentation map. Auto-discovery + segmentation validation moves systems from CDE → connected → out-of-scope, with QSA-aligned evidence per §1.2.4 and §11.4.5.
- Auto-discovery — scanner identifies systems that store, process, or transmit cardholder data
- Segmentation validation — §1.2.4 firewall rule analysis + §11.4.5 pen-test evidence captured
- Quarterly re-validation — §11.4.6 schedule with reminders; segmentation drift surfaced before the QSA finds it
- QSA-ready scope diagram — auto-generated network diagram with CDE, connected, and out-of-scope systems labeled
From scoping to AOC signed in five stages.
Most teams complete CDE scoping in their first week. Stage 4 runs continuously per the v4.0.1 BaU mandate. Stage 5 is on-demand the moment your QSA needs the ROC.
Scope the CDE
CMDB sync auto-discovers in-scope, connected-to, and out-of-scope systems. Boundary diagrams render automatically.
Pick SAQ + Approach
SAQ A through D-SP based on acceptance channel and processing model. Defined or Customized Approach per requirement.
Score and collect evidence
12 requirements scored question-by-question. Evidence linked to controls, controls linked to testing procedures.
BaU controls running
v4.0.1 Business-as-Usual mandate satisfied — log review, FIM, IDS, ASV scans feed continuously to the platform.
Submit ROC + AOC
QSA-ready ROC export, Attestation of Compliance for the acquirer, SAQ for self-assessing merchants — in two clicks.
The QSA audit that stopped requiring a war room.
Real merchants and service providers. Real v4.0.1 transitions. Real QSA sign-offs without the late-night fire drill.
v4.0.1 BaU mandate would have killed our team. The continuous evidence collection from our existing tools means we're always 30 days from a QSA audit, never 90.
“Customized Approach was uncharted territory. The targeted risk analysis template alone was worth the migration. Our QSA accepted the methodology without redlines.”
“We process across 6 acquirers, each with their own SAQ submission template. Acquirer reporting saves us the equivalent of one FTE every quarter.”
“PCI Req 8.3 expanded MFA hit us hard. The MFA-coverage dashboard surfaces every admin without MFA, every elevated session, every legacy gap. We hit 100% before the deadline.”
Plus every framework adjacent to PCI — cross-mapped.
Score one PCI requirement, satisfy ISO 27001, SOC 2, NIST CSF, and HIPAA simultaneously. The same control evidence becomes the same audit deliverable, four times.
Take RiskWatch home before you sign anything.
Three downloads. Use them to evaluate, share with your QSA, or build the v4.0.1 transition business case.
PCI DSS v4.0.1 Compliance Checklist
Thirty pages covering all 12 PCI DSS v4.0.1 requirements with sub-requirements, testing procedures, and a per-requirement scoring worksheet. Includes the v4.0 → v4.0.1 delta summary.
- All 12 reqs + 70+ sub-reqs
- Defined + Customized Approach paths
- v4.0 → v4.0.1 delta summary
SAQ A through D-SP Decision Tree
Which SAQ should you submit? This decision-tree PDF walks through acceptance channels, processing model, and CDE scope to land on the right SAQ — A, A-EP, B, B-IP, C, C-VT, D-Merchant, or D-SP.
- 8-SAQ decision tree
- Per-SAQ requirement matrix
- AOC submission templates
PCI DSS Compliance Platform Buyer's Guide
Vendor scorecard, ROC-export depth comparison, BaU continuous-monitoring features, pricing by transaction volume, QSA partnerships.
- Feature matrix · 6 vendors
- Scorecard template
- Pricing benchmarks
Common questions, answered up front.
About PCI DSS v4.0.1, the 12 requirements, SAQ types, the Customized Approach, and BaU continuous compliance — and how RiskWatch covers all of them.
What is PCI DSS compliance software?
What's new in PCI DSS v4.0.1?
Which SAQ should I submit?
What's the difference between Defined and Customized Approach?
How does CDE scoping work?
What does Business-as-Usual mean for v4.0.1?
How does cross-framework mapping help?
Is there a free trial?
Run your first 12-requirement scoring this week.
Start a 30-day free trial — every requirement, all 8 SAQs, the ROC evidence vault, CDE scoping, BaU continuous monitoring, and Customized Approach scoring. No credit card required.
No credit card required · 30-day free trial · Cancel anytime