Are you ready for a PCI DSS assessment?
Eight questions, two minutes. Scored against what QSAs test first -- scoping, MFA, scanning, pen testing, and the v4.x new requirements.
What a PCI gap assessment actually includes
A gap assessment is a pre-assessment dry run: a QSA (or a separate readiness consultant) tests your environment against the PCI DSS requirements you've scoped, then hands you a remediation list -- the exact scoping fixes, MFA rollouts, logging, and policy work to complete. It is not a validation and produces no ROC or AOC; its product is a fix list. Budget it as its own line item: folding it silently into the "assessment cost" is how first-year budgets blow up.
Gap assessment vs. the ROC (why firms separate them)
The assessment prepares; the QSA validates. The firm that designs or implements your controls shouldn't be the one assessing them -- which is why many buyers deliberately hire a readiness consultant to prepare and a separate QSA company to validate. If your QSA offers both, ask exactly how independence is preserved and get the answer in the engagement letter. The quiz below approximates what a gap assessment probes, in eight questions.
The 2-minute quiz
1. Do you know your PCI merchant level and which SAQ type (or ROC) applies to you?
2. Is your cardholder data environment (CDE) scoped, documented, and network-segmented?
3. Is multi-factor authentication enforced for all access into the CDE?
4. Are quarterly ASV scans passing, with failures remediated and rescanned?
5. Have you completed annual penetration testing covering the CDE and segmentation?
6. Are payment-page scripts inventoried with integrity controls and tamper detection?
7. Do you have written information-security policies acknowledged by staff?
8. Do you collect and review PCI compliance evidence (AOCs) from your service providers?
How scoring works
Each answer is worth 0–2 points (max 16). 0–5: foundational gaps -- start with a gap assessment. 6–11: core controls exist -- allow 1–3 months of prep. 12–16: likely ready to engage assessors. This is a self-assessment aid, not an assessment opinion.
Know your score? Get quotes
Assessors scope fees around readiness. Tell us where you stand and get matched.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.