PCI DSS Consulting
PCI DSS is the payment card industry's security standard, with 12 mandatory requirements for any organization that stores, processes, or transmits cardholder data. Berghem runs the compliance journey end to end — from gap analysis to the required penetration test — and prepares the evidence for the QSA assessment.
What is PCI DSS?
PCI DSS (Payment Card Industry Data Security Standard) is the standard maintained by the PCI Security Standards Council that defines the minimum controls for protecting cardholder data. The version in force is v4.0.1, and all future-dated requirements became mandatory on 31 March 2025.
The standard organizes 12 requirements into 6 control objectives and applies to merchants, acquirers, processors, and service providers. Effort depends on transaction volume, the validation type required (a QSA-signed ROC or a self-assessment SAQ), and the size of the cardholder data environment (CDE) after network segmentation.
What the engagement covers
What are the PCI DSS requirements?
The 12 PCI DSS v4.0.1 requirements are grouped into six control objectives. The engagement assesses each one against the current state of the cardholder data environment.
Secure network and systems
Requirements 1 and 2 — network controls, firewalls, and secure configuration of components, removing vendor defaults and unnecessary services.
Protect cardholder data
Requirements 3 and 4 — protection of stored cardholder data and strong cryptography for transmission across open, public networks.
Vulnerability management
Requirements 5 and 6 — protection against malware and secure development and maintenance of systems and software, with continuous patching.
Strong access control
Requirements 7, 8, and 9 — need-to-know access, user authentication (including MFA), and restriction of physical access to data.
Monitor and test
Requirements 10 and 11 — logging and monitoring of access, vulnerability scanning, and periodic penetration testing of networks and systems.
Security policy
Requirement 12 — information security policy, risk management, training, and an incident response program that sustains the whole program.
How does Berghem support the PCI DSS journey?
From scope definition to technical validation, Berghem delivers the offensive-security and compliance components the QSA requires — with auditable evidence.
Gap analysis and roadmap
Assessment of current posture against the 12 requirements, with a remediation plan prioritized by gap and a timeline to validation.
Penetration test (Req. 11.4)
External and internal penetration testing (EHT) of the CDE network and applications, with validation of the required segmentation.
Payment security
Assessment of capture, authorization, and settlement flows and of the controls protecting cardholder data.
Security for financial services
Assessment and remediation for banks, acquirers, and fintechs, where PCI DSS meets the sector's broader payment-security requirements.
Financial services industry
How Berghem serves the financial services industry — from payment compliance to offensive security of the card environment.
PCI MPoC
For acceptance on COTS devices, the assessment follows the PCI MPoC standard alongside PCI DSS.
DevSecOps (Req. 6)
Security across the development lifecycle — code review, SAST/DAST, and a secure pipeline for software touching cardholder data.
Offensive security
A dedicated offensive team for the technical tests that back the environment's compliance evidence.
What drives the cost and timeline of a PCI DSS engagement?
There is no single price. The investment depends on measurable environment factors and the validation type your acquirer or brand requires.
Merchant level
Annual transaction volume sets the level (1 to 4) and the validation type — a QSA-signed ROC for level 1, or a SAQ for the others. Higher levels mean more evidence effort.
Scope size (CDE)
The more systems store, process, or transmit cardholder data, the larger the scope. Network segmentation reduces the CDE and, with it, testing and assessment cost.
Control maturity
Environments with vulnerability management, logging, and MFA already in place reach validation with less remediation. Open gaps extend the timeline.
Payment architecture
Card-present, e-commerce, tokenization, or COTS-device acceptance (PCI MPoC) change the applicable requirements and the depth of testing.
PCI DSS questions
Who needs to be PCI DSS compliant?
What is the current PCI DSS version?
Is penetration testing mandatory under PCI DSS?
What is the difference between ROC and SAQ?
Does Berghem issue the PCI DSS certificate?
Ready to start your PCI DSS engagement?
In one conversation we map your cardholder data environment, define the scope, and design the path to validation — from gap analysis to the penetration test.
Contact Us