Service
A PCI gap assessment that ranks what to fix first
A PCI gap assessment compares how you handle card data today with every requirement that applies to you. So instead of a vague worry, you get a ranked list of what is missing and what to do about it.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
What a PCI gap assessment covers
We start with scope, because the requirements that apply depend on how you take payments. Then we walk through each applicable requirement and ask whether a control exists and whether you can prove it. The standard is in the PCI SSC document library.
- Scope and payment flows
- Network and system configuration
- Access, authentication and logging
- Testing, scans and payment page scripts
- Policies, training and incident response
How gaps are ranked
Not every gap carries the same risk. Therefore each one is ranked by how likely it is to fail an assessment and how exposed it leaves card data.
| Rank | Meaning |
|---|---|
| Critical | Would fail outright, so fix first. |
| High | Likely finding, plan within weeks. |
| Moderate | Evidence or documentation gap. |
Mini PCI gap assessment
Tick what you can prove today. Each open item is a likely gap.
Your result appears here as you tick, so you can see what is still open.
Version 4.0.1 gaps we see most
Since March 2025, several newer requirements catch many businesses. For example, payment page script inventories (6.4.3), tamper detection (11.6.1) and multi-factor for all card environment access (8.4.2) are common gaps. So a PCI gap assessment checks those early.
What a PCI gap assessment costs
Gap analysis and readiness generally run between $8,000 and $40,000, depending on scope, with remediation on top. However, anything under $5,000 for real remediation is not real work, so be wary of very low quotes.
A smaller card environment costs less to assess. Therefore scope reduction is often the first recommendation in the report.
Where our work stops
We are not a QSA. So we prepare, remediate and document, while an independent assessor validates. When you need one, we introduce independent QSA firms.
PCI gap assessment questions
How long does a PCI gap assessment take?
It depends on scope. Small environments take a few weeks, while larger ones take longer.
Is a PCI gap assessment the same as an audit?
No. It prepares you, while a QSA or your own questionnaire validates.
What do we get at the end?
A ranked list of gaps with owners, dates and suggested fixes.
Do you fix the gaps too?
Yes, if you want, through hands-on remediation.
Related guides
Book a PCI gap assessment
Tell us how you take payments. We reply with a written answer and a budget range, with no sales call.
Ask us anything