- Home
- Compliance
- PCI DSS Compliance
Standard compliance
PCI DSS v4.0.1 consulting
If you store, process or transmit card data, PCI DSS applies to you. We help you reduce scope first, then meet the remaining requirements — including the v4.0 requirements that became mandatory in 2025.
Why teams choose Adiroha
- Led by CISA and ISO 27001 lead auditors
- Clear scope, roadmap and timeline before we start
- Evidence organised in the Cydital platform
- Support through the external audit and beyond
Scope
What we cover
- Cardholder data environment (CDE) scoping and reduction
- Gap assessment against PCI DSS v4.0.1
- Self-Assessment Questionnaire (SAQ) guidance
- Customised approach and targeted risk analyses
- Web, API and infrastructure penetration testing
- Segmentation testing and ASV scan coordination
- Policy and procedure development
- QSA audit preparation and support
Deliverables
What you receive
- Scope diagram and data-flow maps
- Gap report and remediation roadmap
- Penetration and segmentation test reports
- Evidence pack ready for your QSA
How we work
Discover. Assess. Remediate. Validate.
Discover
Understand your business, scope, stakeholders and the obligations that actually apply to you.
Assess
Gap assessment against the framework or regulation, turned into a prioritised, costed roadmap.
Remediate
Implement policies, controls and evidence with your teams, tracked in Cydital.
Validate
Internal audit before the external one, audit-day support, and continuous compliance after.
FAQ
Common questions
Are you a QSA?
Our role is consulting, testing and readiness. The Report on Compliance is issued by a PCI SSC–qualified QSA, whom we work alongside.
What changed with PCI DSS v4.0?
Version 4.0 added requirements such as targeted risk analyses, stronger authentication and e-commerce script controls. The future-dated requirements became mandatory on 31 March 2025.
Which PCI DSS level are we?
Merchant and service provider levels depend on annual transaction volume and card brand rules. We help you confirm your level and the validation it requires.
Can we reduce our PCI DSS scope?
Often, yes. Tokenisation, hosted payment pages and network segmentation can significantly reduce the systems in scope.
Do we need a QSA or can we self-assess?
It depends on your level. Smaller merchants usually complete a Self-Assessment Questionnaire; larger ones need a QSA-led Report on Compliance.
How often is PCI DSS validated?
Annually, with quarterly external vulnerability scans by an Approved Scanning Vendor.
Related
Related services
GDPR Compliance
GDPR readiness for companies processing EU personal data — data mapping, DPIAs, transfers and data subject rights.
Learn moreHIPAA Compliance
HIPAA Security and Privacy Rule readiness for healthtech, RCM and healthcare BPO companies serving US clients.
Learn moreAdiroha For Startups
A lean security and compliance programme for startups — enterprise-deal ready, investor-ready, and sized to your stage.
Learn moreTalk to a specialist about PCI DSS Compliance.
A free 30-minute consultation to understand your scope and timeline. We follow up with a fixed proposal.