Everything you need to assess, document, and remediate against PCI DSS v4.0 — 200+ control checklist, six payment-environment policies, gap analysis, risk matrix, and a 12-month implementation roadmap. Built for merchants and service providers who actually have to make this work.
✓ 30-day money-back guarantee · ✓ Lifetime access · ✓ Markdown · PDF · Word
Most merchants get told by their acquirer "you need to be PCI compliant" and then handed a 400-page standard with no roadmap. QSAs charge $30–$150K to translate. You can do it yourself — with the right deliverables in hand.
Every requirement and sub-requirement, mapped to checkable items with evidence prompts. Covers all 12 requirements:
Each is 400–800+ words, mapped to specific PCI requirements, structured for audit defensibility.
All 12 requirements, with current/target compliance status, priority, owner, timeline, and remediation budget columns. Identify gaps, plan remediation, track to closure.
5×5 probability/impact matrix with 10 worked PCI threat scenarios: e-commerce skimmer, POS malware, third-party compromise, insider misuse, unpatched critical CVE, segmentation failure, admin credential phishing, stored CHD outside CDE, rogue wireless, logging gap. Each with current controls, gaps, mitigation actions, target score.
Four phases — Scoping & Foundation, Core Controls, Maturation & v4.0 Enhancements, Validation — with month-by-month activities, costs, owners, success metrics. Includes scope-reduction strategies (P2PE, hosted fields, tokenization). Total budget reference: $715K–$1.2M annual program; compressed paths from $50K–$150K for small merchants.
Pre-assessment checklist, evidence collection patterns, common findings to clean up before a QSA arrives, and what to expect during fieldwork.
Especially anyone who handles PAN on their own pages (SAQ A-EP, D). The v4.0 script-integrity requirements are non-negotiable.
POS, terminal, and back-office controls. SAQ B-IP through D coverage.
Tighter requirements (segmentation tested every 6 months, more rigorous logging). RoC + AOC pathway.
Standardize how you onboard and remediate clients.
The scope-reduction guidance alone may save you a five-figure annual line item.
| Approach | Time | Cost |
|---|---|---|
| Full QSA-led RoC | 4–6 months | $100K–$300K |
| Internal program from scratch | 9–12 months | $200K–$500K (loaded) |
| This package + targeted QSA validation | Customize in 2–3 weeks | $149 + validation |
The package is the documentation and process layer. Tools, validation, and operational work are still yours to do.
| Lite — $59 | Standard — $89 | Pro — $149 | |
|---|---|---|---|
| 200+ control checklist | ✓ | ✓ | ✓ |
| Cardholder Data Protection policy | ✓ | ✓ | ✓ |
| 5 additional PCI policies | — | ✓ | ✓ |
| Gap analysis (all 12 reqs) | — | ✓ | ✓ |
| Risk matrix (PCI-specific) | — | — | ✓ |
| 12-month implementation roadmap | — | — | ✓ |
| QSA assessment prep guide | — | ✓ | ✓ |
| Scope-reduction playbook | — | — | ✓ |
| Email support (60 days) | — | — | ✓ |
Recommended: Pro. If you're going through any kind of QSA validation, the pre-assessment prep alone is worth the upgrade.
Yes — current with PCI DSS v4.0. v4.0.x bulletins are tracked and updates released to existing customers.
This is the documentation and process foundation. PCI compliance also requires you to operate the controls (MFA, scanning, logging, etc.). The package shows you exactly what and how; you do the operating.
Depends on your level and merchant category. Small merchants typically self-assess via SAQ. Level 1 merchants and most service providers need a QSA-attested RoC. The package is useful in either path.
Yes — fully editable Markdown and Word.
You still need an Approved Scanning Vendor for quarterly external scans. The package includes a vendor-selection guide.
30-day, no-questions-asked money-back guarantee.
Buy PCI Pro — $149. Instant download.
Buy PCI Pro — $149 Compare All Tiers