Seat-led · PCI DSS v4.0.1 : PCI DSS readiness, before the QSA arrives.
If you store, process, or transmit card data, PCI DSS applies — and v4.0 expects continuous evidence, not an annual scramble. We scope the cardholder-data environment, shrink it, close the gaps against the twelve requirements, and hand the QSA an evidence set that answers the questions before they are asked.
Twelve requirements. One evidence set.
- Determine your merchant or service-provider level and whether you need an SAQ or a Report on Compliance (RoC)
- Map every place cardholder data is stored, processed, or transmitted — and shrink that scope wherever it can be shrunk
- Gap-assess against the twelve PCI DSS v4.0.1 requirements, including the future-dated ones now in force
- Segment the cardholder-data environment so the rest of the network stays out of scope
- Implement and evidence the controls: access, encryption, logging, vulnerability management, secure development
- Prepare the SAQ, or the evidence set for the QSA’s RoC
- Coordinate the quarterly ASV scans and the annual penetration test
- Keep you compliant between assessments — v4.0 expects continuous, not annual
What we do. What the QSA does.
Golonex prepares you and stands beside you during the assessment. The Report on Compliance is issued by a Qualified Security Assessor, independent of Golonex.
Golonex
- ·Scoping and scope reduction
- ·Gap assessment and remediation roadmap
- ·Controls, policies, and the evidence set
- ·SAQ preparation, or RoC preparation for the QSA
- ·The seat that keeps you compliant between assessments
The QSA and ASV
- ·The Qualified Security Assessor performs the formal RoC assessment
- ·The Approved Scanning Vendor runs the quarterly external scans
- ·Both are independent of Golonex, by rule
Comply once, satisfy many.
PCI DSS shares most of its control set with ISO 27001 and NIST 800-171 — access control, encryption, logging, vulnerability management. We implement the controls once and crosswalk them, so PCI does not become a second project running beside your security program.
PCI DSS — your questions, answered
Which SAQ applies to us? +
It depends on how you take payments. Fully outsourced e-commerce with a redirect is SAQ A; a hosted payment page with some page control is SAQ A-EP; card-present with a standalone terminal is SAQ B or B-IP; anything that touches cardholder data in your own systems is SAQ D. Scoping settles it, and a wrong SAQ is the most common finding we see.
Do we need a QSA? +
Level 1 merchants and most service providers need an annual Report on Compliance from a Qualified Security Assessor. Lower levels can usually self-assess with an SAQ. Either way the controls are the same; what changes is who signs the attestation. We prepare you for both, and we are not the QSA.
What changed in PCI DSS v4.0.1? +
v4.0.1 replaced v4.0 at the end of 2024 with clarifications, not new controls. The future-dated requirements became mandatory in March 2025: targeted risk analyses, authenticated internal vulnerability scans, stronger multi-factor authentication, payment-page script integrity, and continuous rather than annual evidence for many controls. Firms that treated PCI as a once-a-year exercise are the ones now failing.
Can PCI scope really be reduced? +
Usually, and it is the highest-leverage thing we do. Tokenisation, a hosted payment page, network segmentation, and removing stored PAN can take most of the company out of scope. Less scope means fewer controls to evidence, a smaller assessment, and a lower fee.
Are you the assessor? +
No, and that separation is required. Golonex prepares you and stands beside you during the assessment. The Report on Compliance is issued by a QSA, and the external scans by an ASV, both independent of Golonex. A firm that prepares you cannot also grade you.
Be ready before the QSA arrives.
Bring your scope and your last assessment. Leave with a gap list and a plan to close it.