PCI DSS v4.0.1 readiness review
Before a QSA assessment, before a customer’s security questionnaire, or before you sign an SAQ: find out where you stand against every applicable requirement, with the requirement number cited beside each gap and a remediation plan you can hand to your engineers.
Book a 20-minute scoping call
Microsoft Teams. No obligation; you get a written scope and fixed price after the call.
Who it is for
- Consultancies with more PCI DSS work than assessor hours: hand the readiness stage to us and keep the client relationship and the assessment.
- SaaS and service companies that need PCI DSS for a customer contract and have never been through it.
- Merchants moving to v4.0.1, where the future-dated requirements became mandatory on 31 March 2025.
What you receive
- Scope statement. Which systems, people and processes are in scope, the SAQ type (or ROC) that applies, and the segmentation that keeps the rest out.
- Gap register. Every applicable requirement, its status (in place, not in place, not applicable, compensating control), the evidence reviewed, and the exact PCI DSS v4.0.1 requirement number behind each finding.
- Remediation plan. Each gap with an owner, an effort estimate and an order of work, so the assessment date is a date you can commit to.
- A one-hour read-through with Edward, and two weeks of email questions afterwards.
Price
Single-SAQ merchant
SAQ D or service provider
The fee is agreed in writing before work starts and does not change. Travel is not required; everything is done remotely from your documents, diagrams and configuration exports.
How it works
- A 20-minute scoping call. You describe the environment; we confirm the SAQ type and the price.
- You share the documents: policies, network and data-flow diagrams, configuration standards, scan and test reports, and anything you already hold as evidence.
- Edward Casteloes runs each document through Compliance Colleague, which reviews it against the standard’s own text and cites the requirement behind every finding, then checks and signs off each finding personally.
- You receive the three documents within 10 business days and we walk through them together.
What it is not
This is a readiness review, not a PCI DSS assessment. It does not produce a Report on Compliance, an Attestation of Compliance or a signed SAQ, and it is not a substitute for a QSA engagement where one is required. Edward is a former QSA and PA-QSA; Compliance Colleague LLC is not a PCI SSC-listed assessor company. If you need a formal assessment, we will say so on the scoping call and can introduce a QSA company.
How your data is handled
- Documents are reviewed through Anthropic’s commercial API; under Anthropic’s default commercial policy, inputs and outputs are not used to train models.
- We do not need cardholder data. If a document contains PANs, mask them before sending; we will tell you how.
- A mutual NDA is available before any document is shared. See how data is handled and the Privacy Policy.
Book a 20-minute scoping call
Or email edward@compliancecolleague.ai with a line about your environment.
Edward Casteloes CISSP, CISA, Founder of Compliance Colleague.