PCI-DSS v4.0 Compliance
PCI-DSS v4.0 readiness, internal audit and QSA coordination.
Full PCI-DSS v4.0 readiness for merchants, processors, issuers, acquirers and service providers. Macksofy delivers ROC / SAQ readiness, network segmentation validation, ASV scanning and QSA coordination — all under one engagement.
- PCI-DSS v4.0 (mandatory March 2025)
- PCI Software Security Framework (SSF)
- PCI Mobile Payment Acceptance Security
- PCI 3DS Core Security Standard (where in scope)
What is PCI-DSS compliance?
PCI-DSS is the mandatory security standard for any business that stores, processes, or transmits payment-card data, spanning network, encryption, and access controls. Macksofy runs PCI-DSS 4.0 gap assessments, segmentation validation, and the required penetration test for fintech and merchants across India and the UAE.
PCI-DSS is leverage, not paperwork.
PCI-DSS v4.0 became fully mandatory in March 2025 — with 64 new or revised requirements including continuous discovery of vulnerabilities, customised approach options and tighter authentication. Non-compliant merchants face fines from card brands ($5K–$100K+/month) and increased liability shift. Macksofy is the only Indian / UAE firm combining CERT-In empanelment with PCI-DSS depth across QSA-coordination, ASV scans and segmentation tests.
- Merchants — Levels 1–4 (transaction-volume tiers)
- Acquirers + Issuing banks
- Payment processors + gateways
- Service providers (storage / processing / transmitting CHD)
- Mobile wallet operators
Aligned to the regulations that matter.
How we run a PCI-DSS engagement.
Interactive walkthrough — every phase clickable, every activity documented, every artefact regulator-ready.
1 · Scope reduction + CDE definition
- 01Cardholder Data Environment (CDE) inventory
- 02Network segmentation review
- 03Tokenisation + scope-reduction architecture
What your PCI-DSS engagement puts on the table.
- PCI-DSS v4.0 gap analysis (per requirement)
- Network segmentation diagram + validation
- ASV scan reports (quarterly)
- ROC / SAQ + AOC drafts
- Targeted Risk Analysis (TRA) artefacts
- QSA-handover pack + remediation closure
v3.2.1 → v4.0 transition + ROC
Outcome: Cleared QSA assessment first attempt; saved ~₹35L in penalty exposure during transition
Scope-reduction + tokenisation architecture
Outcome: PCI scope reduced ~70% of systems; annual recurring audit cost down 40%
The shape of a PCI-DSS engagement.
Every number below is grounded in how Macksofy actually runs the engagement — not aspirational marketing copy.
What we actually examine.
Each pillar is a distinct workstream inside the engagement — scoped, evidenced, and signed off independently before the audit pack is assembled.
- Scope reduction3 pts
- Build & maintain secure systems3 pts
- Protect account data3 pts
- Vulnerability & access management3 pts
- Monitor, test, respond3 pts
- QSA audit pack3 pts
Most PCI cost overruns come from over-broad scope. We fix that first.
- Cardholder-data discovery & flow mapping
- Network-segmentation validation testing
- Tokenisation / outsourcing reduction strategy
PCI DSS v4.0 requirements 1, 2, 6 — secure baselines + change control.
- Firewall + segmentation rules walk-through
- Hardened-baseline evidence per device class
- Secure-SDLC artefacts (Req 6) for in-scope apps
Encryption, key management and access — the heart of the standard.
- Stored cardholder data: encryption + retention
- Key-management lifecycle (Req 3.6)
- Transmission encryption + cipher hygiene (Req 4)
Reqs 5, 7, 8 — Defender, MFA, RBAC, anti-malware evidence.
- Anti-malware coverage + tamper-protection
- Role-based access + least-privilege evidence
- MFA on all in-scope access (v4 enforcement)
Reqs 10–12 — daily ops evidence that QSAs sample heavily.
- Centralised logging + retention proof
- Internal + external ASV scans, segmentation test
- IR plan + breach-notification flow
Everything the Qualified Security Assessor needs in one place.
- Self-assessment questionnaire (SAQ) or RoC dry-run
- Evidence catalogue keyed to each requirement
- Compensating-controls worksheet where applicable
From kick-off to regulator-ready report.
The horizontal flow below shows the typical week-by-week shape of a PCI-DSS engagement. Click any station for detail in the methodology section above.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
PCI-DSS — what compliance leads ask before signing.
HIPAA Compliance Audit
HIPAA + HITRUST audits for healthcare entities and business associates.
Learn moreGDPR Compliance Audit
GDPR audits, DPIAs, EU representative and DPO services for India + UAE businesses.
Learn moreVAPT for RBI / PCI-DSS
VAPT engineered to satisfy RBI and PCI-DSS in one engagement.
Learn morePCI-DSS evidence starts with hands-on testing.
A clean PCI-DSS report rests on real technical assurance. These Macksofy assessments generate the vulnerability, penetration and control-effectiveness evidence your auditor expects to see.
Penetration Testing
Find what attackers will. Before they do.
Explore serviceVulnerability Assessment & Penetration Testing (VAPT)
VAPT done properly — not a scan with a cover page.
Explore serviceWeb Application Security Testing
Test web apps the way attackers (and bug bounty hunters) do.
Explore serviceMacksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements