PCI DSS Readiness Assessment
PCI DSS readiness assessment with a payment-security action plan
Clarify your payment-data scope and the gaps to address before applicable validation. ICA’s scoped review connects scope observations, control findings and an evidence checklist to a remediation plan.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Turn a validation request into clear preparation priorities
An acquirer asks for evidence. Your validation is approaching, or a payment-processing change has left ownership unclear. Merchants and payment service providers need to understand what their environment includes before deciding where to direct preparation effort.
CISOs and compliance leads use the findings to plan preparation. Use the findings to separate unresolved scope questions from missing evidence and work that needs funding or an accountable owner.
Define the payment flows and environments under review
Coverage starts with how payments move through your business and the services supporting them. Depending on the agreed boundary, relevant environments may include online checkout, payment terminals, telephone payments and service-provider connections. Identify where your organization handles cardholder data and which systems could affect its security.
The scope also considers provider responsibilities and the validation path you are preparing for. Existing diagrams and provider documentation help explain the boundary. Assumptions about outsourced processing or network separation need evidence; the readiness report records scope observations rather than treating those assumptions as settled.
Review documented controls against supporting evidence
The proposed approach combines discussions with payment, IT and compliance owners with review of relevant documents and evidence. Materials may include payment-flow diagrams, system inventories, security policies, access records and existing scan or test reports. The engagement establishes the applicable assessment criteria and review depth.
The review distinguishes a documented control from evidence that supports its operation. Findings identify gaps within the agreed coverage and explain remaining uncertainty. Reviewing a prior technical report does not perform a new scan or test. Active technical work needs its own express scope and authorization.
Use four connected outputs to organize the work
The agreed engagement defines the detail of these catalog deliverables:
Scope observations: Document the payment flows and environment boundaries reviewed, including questions that need resolution before validation planning.
Gap report: Explain identified control and documentation gaps so compliance and technical owners can understand the preparation work.
Evidence checklist: Identify supporting materials to assemble or improve. Use it to coordinate evidence collection across teams and providers.
Remediation plan: Recommend a sequence for addressing findings. Leadership can use it to discuss priorities, dependencies and ownership with delivery teams.
These outputs support planning within the assessed boundary; they do not establish a validated compliance status.
Prepare the people and evidence that shape the scope
Start scoping with the reason for the review and any validation instructions already received. For merchants, confirm reporting requirements with the acquirer or payment brand as applicable. A self-assessment questionnaire is a validation tool for eligible environments; the appropriate path should be confirmed rather than assumed.
Identify owners who can explain payment processing and provider responsibilities. Have existing diagrams, inventories and relevant evidence available for review. Payment-flow complexity, environment coverage, evidence quality and stakeholder access affect cost and timing. Agree document-handling arrangements before sharing sensitive materials. Scoping confirms the work and deliverables without assuming a particular portal or tool.
Keep readiness separate from validation and technical execution
This is a scoped readiness review, not Qualified Security Assessor (QSA) validation. PCI SSC qualifies QSA companies to validate adherence to PCI DSS. Readiness findings do not replace applicable validation or guarantee its outcome.
Approved Scanning Vendor (ASV) scans, penetration testing, segmentation testing and remediation are separate unless expressly included. A review of network boundaries does not prove segmentation works. If findings point to technical testing or implementation, define that work separately, including qualified resources and written authorization where required. The remediation plan recommends actions; execution remains a separate responsibility.
PCI DSS readiness questions
Is this assessment for merchants or payment service providers?
Both are catalog audiences. The fit depends on your payment flows, environment and preparation objective. A merchant responding to an acquirer request may need different review coverage from a provider supporting customers’ payment services.
Can we limit the review to one payment channel?
A defined channel can be the proposed engagement boundary. Scoping must identify connected systems and provider relationships relevant to it. The report should make clear what was reviewed and which payment environments remain outside coverage.
What if our policies exist but evidence is incomplete?
Bring the materials you have. The review examines documentation alongside supporting evidence and identifies gaps within scope. Agree evidence depth during scoping so a policy’s existence is not mistaken for demonstrated control operation.
What determines the cost and timing?
Payment flows, service-provider dependencies, environment size and validation path shape the work. Evidence availability and access to knowledgeable owners also matter. Those details are needed before an engagement-specific price or schedule can be confirmed.
Does this include PCI scanning or penetration testing?
ASV scans, penetration testing and segmentation testing are separately scoped unless expressly included. Existing reports may inform readiness findings, but document review does not generate a new scan result or demonstrate that a technical control withstands testing.
Will ICA fix the gaps or validate our compliance?
The catalog outputs include a remediation plan for your team’s decisions. Remediation execution requires express inclusion or separate scope. This assessment does not provide QSA validation, certification or a guaranteed compliance result.
Define the preparation work your payment environment needs
Discuss your payment environment to establish the review boundary and useful outputs. Use scope observations to guide leadership decisions and organize evidence and remediation priorities before applicable validation.
Turn a validation request into clear preparation priorities
An acquirer asks for evidence. Your validation is approaching, or a payment-processing change has left ownership unclear. Merchants and payment service providers need to understand what their environment includes before deciding where to direct preparation effort.
CISOs and compliance leads use the findings to plan preparation. Use the findings to separate unresolved scope questions from missing evidence and work that needs funding or an accountable owner.
Define the payment flows and environments under review
Coverage starts with how payments move through your business and the services supporting them. Depending on the agreed boundary, relevant environments may include online checkout, payment terminals, telephone payments and service-provider connections. Identify where your organization handles cardholder data and which systems could affect its security.
The scope also considers provider responsibilities and the validation path you are preparing for. Existing diagrams and provider documentation help explain the boundary. Assumptions about outsourced processing or network separation need evidence; the readiness report records scope observations rather than treating those assumptions as settled.
Review documented controls against supporting evidence
The proposed approach combines discussions with payment, IT and compliance owners with review of relevant documents and evidence. Materials may include payment-flow diagrams, system inventories, security policies, access records and existing scan or test reports. The engagement establishes the applicable assessment criteria and review depth.
The review distinguishes a documented control from evidence that supports its operation. Findings identify gaps within the agreed coverage and explain remaining uncertainty. Reviewing a prior technical report does not perform a new scan or test. Active technical work needs its own express scope and authorization.
Use four connected outputs to organize the work
The agreed engagement defines the detail of these catalog deliverables:
Scope observations: Document the payment flows and environment boundaries reviewed, including questions that need resolution before validation planning.
Gap report: Explain identified control and documentation gaps so compliance and technical owners can understand the preparation work.
Evidence checklist: Identify supporting materials to assemble or improve. Use it to coordinate evidence collection across teams and providers.
Remediation plan: Recommend a sequence for addressing findings. Leadership can use it to discuss priorities, dependencies and ownership with delivery teams.
These outputs support planning within the assessed boundary; they do not establish a validated compliance status.
Prepare the people and evidence that shape the scope
Start scoping with the reason for the review and any validation instructions already received. For merchants, confirm reporting requirements with the acquirer or payment brand as applicable. A self-assessment questionnaire is a validation tool for eligible environments; the appropriate path should be confirmed rather than assumed.
Identify owners who can explain payment processing and provider responsibilities. Have existing diagrams, inventories and relevant evidence available for review. Payment-flow complexity, environment coverage, evidence quality and stakeholder access affect cost and timing. Agree document-handling arrangements before sharing sensitive materials. Scoping confirms the work and deliverables without assuming a particular portal or tool.
Keep readiness separate from validation and technical execution
This is a scoped readiness review, not Qualified Security Assessor (QSA) validation. PCI SSC qualifies QSA companies to validate adherence to PCI DSS. Readiness findings do not replace applicable validation or guarantee its outcome.
Approved Scanning Vendor (ASV) scans, penetration testing, segmentation testing and remediation are separate unless expressly included. A review of network boundaries does not prove segmentation works. If findings point to technical testing or implementation, define that work separately, including qualified resources and written authorization where required. The remediation plan recommends actions; execution remains a separate responsibility.
PCI DSS readiness questions
Is this assessment for merchants or payment service providers?
Both are catalog audiences. The fit depends on your payment flows, environment and preparation objective. A merchant responding to an acquirer request may need different review coverage from a provider supporting customers’ payment services.
Can we limit the review to one payment channel?
A defined channel can be the proposed engagement boundary. Scoping must identify connected systems and provider relationships relevant to it. The report should make clear what was reviewed and which payment environments remain outside coverage.
What if our policies exist but evidence is incomplete?
Bring the materials you have. The review examines documentation alongside supporting evidence and identifies gaps within scope. Agree evidence depth during scoping so a policy’s existence is not mistaken for demonstrated control operation.
What determines the cost and timing?
Payment flows, service-provider dependencies, environment size and validation path shape the work. Evidence availability and access to knowledgeable owners also matter. Those details are needed before an engagement-specific price or schedule can be confirmed.
Does this include PCI scanning or penetration testing?
ASV scans, penetration testing and segmentation testing are separately scoped unless expressly included. Existing reports may inform readiness findings, but document review does not generate a new scan result or demonstrate that a technical control withstands testing.
Will ICA fix the gaps or validate our compliance?
The catalog outputs include a remediation plan for your team’s decisions. Remediation execution requires express inclusion or separate scope. This assessment does not provide QSA validation, certification or a guaranteed compliance result.
Define the preparation work your payment environment needs
Discuss your payment environment to establish the review boundary and useful outputs. Use scope observations to guide leadership decisions and organize evidence and remediation priorities before applicable validation.