PCI DSS v4.0 Compliance — Scope Reduction & Certification Support
PCI DSS is the mandatory security standard for any organisation that stores, processes, or transmits payment-card data, set by the major card brands through the PCI Security Standards Council. Version 4.0 — with v3.2.1 fully retired since the end of March 2024 — introduced more prescriptive authentication requirements, targeted risk-analysis flexibility, and an expanded focus on continuous security rather than point-in-time compliance.
Mutex Systems builds PCI DSS compliance around scope minimisation first — reducing the cardholder data environment to its smallest defensible size through tokenisation and network segmentation — before addressing the remaining control requirements.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- PCI Security Standards Council (PCI SSC)
- Current Version
- PCI DSS v4.0.1 — v3.2.1 was fully retired at the end of March 2024
- Who It's For
- Merchants, payment service providers, and any organisation storing, processing, or transmitting cardholder data — scope and validation level depend on annual transaction volume.
Core Domains
A Practical Compliance Path
- 01
Scoping & Segmentation Review
Determine exactly which systems fall inside the cardholder data environment and identify segmentation opportunities to shrink that scope before anything else.
- 02
Gap Assessment
Assess controls against the applicable PCI DSS v4.0 requirements and the correct SAQ type or full Requirements checklist for your merchant/service-provider level.
- 03
Remediation & Tokenisation
Close control gaps and, where viable, replace stored card data with tokens to remove systems from scope entirely.
- 04
QSA Liaison & Validation
Prepare and support the Self-Assessment Questionnaire (SAQ) or, for higher-volume merchants, the Report on Compliance (ROC) with a Qualified Security Assessor.
Scope Reduction Before Control Sprawl
Reducing the cardholder data environment to its smallest defensible size, through tokenisation and network segmentation, is addressed before layering on the remaining PCI DSS v4.0 controls.
- Scope reduction through tokenisation and network segmentation, cutting audit effort and ongoing compliance overhead
- PCI DSS v4.0 gap assessment and remediation roadmap mapped to your correct SAQ type or ROC requirement
- QSA liaison and SAQ/ROC preparation support through validation
Scope Tracked as Data, So It Stops Silently Growing
grComply models the cardholder data environment as a scoped set of systems inside the platform, so scope-creep — a new system quietly added to the CDE without anyone updating the compliance record — shows up as a tracked change instead of a surprise the QSA finds first.
- Hybrid agentless and agent-based scanning continuously evidences segmentation and vulnerability-management requirements instead of relying on a point-in-time network diagram
- SAQ and ROC evidence is uploaded once and auto-linked to every applicable PCI DSS v4.0 requirement, with live completion percentage replacing a manually tallied checklist
- The mandatory quarterly and annual testing cadence — scans, penetration tests, segmentation checks — is scheduled and tracked with an immutable audit trail the QSA can review directly
- Cross-framework mapping reuses PCI DSS encryption and access-control evidence against overlapping ISO 27001 or SOC 2 controls where both apply
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About PCI DSS
What changed in PCI DSS v4.0?
PCI DSS v4.0 introduced more prescriptive authentication requirements (including expanded multi-factor authentication scope), a Customised Approach option allowing organisations to meet a requirement's objective through validated alternative controls, targeted risk analysis for certain requirement frequencies, and a stronger overall emphasis on continuous security monitoring rather than point-in-time compliance. Version 3.2.1 was fully retired at the end of March 2024, making v4.0 (now v4.0.1) the sole active standard.
What is the fastest way to reduce PCI DSS compliance burden?
Scope reduction. The PCI DSS requirements only apply to systems that store, process, or transmit cardholder data, or that are connected to systems that do. Tokenisation — replacing stored card numbers with a non-sensitive token — and network segmentation to isolate the cardholder data environment from the rest of the network are the two most effective ways to shrink that scope and reduce both audit effort and ongoing compliance overhead.
What is the difference between an SAQ and a ROC?
A Self-Assessment Questionnaire (SAQ) is a self-validation tool available to lower-volume merchants, with different SAQ types depending on how the business handles card data. A Report on Compliance (ROC) is a formal assessment conducted by a Qualified Security Assessor (QSA), required for higher-volume merchants and most service providers, involving a full on-site or remote audit against all applicable PCI DSS requirements.
Does PCI DSS apply if we use a third-party payment processor?
Using a PCI-compliant third-party payment processor (such as a hosted payment page) can significantly reduce scope, but it rarely eliminates PCI DSS obligations entirely. The merchant still typically has some SAQ-level obligations related to how the payment flow is integrated, and remains responsible for confirming the processor's own compliance status.
Can Mutex Systems support PCI DSS v4.0 compliance end to end?
Yes. Mutex Systems provides scope reduction through tokenisation and segmentation, PCI DSS v4.0 gap assessment and remediation, and QSA liaison and SAQ/ROC preparation support.
Ready to Start Your PCI DSS Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.