PCI DSS gap assessment: how to run one properly

A PCI DSS gap assessment compares your current controls against the Payment Card Industry Data Security Standard and produces a prioritised remediation plan. It is the step that turns "we take card payments" into a clear, costed path to compliance - and the single biggest factor in the result is scope.

Start with scope, not controls

PCI DSS applies to the cardholder data environment (CDE): every system that stores, processes or transmits cardholder data, plus any connected system that could affect its security. Before assessing a single requirement:

• Map the full payment flow from card entry to authorisation and settlement.
• Identify every location where cardholder data is stored - including logs, backups, call recordings and spreadsheets.
• Document connected and security-impacting systems.
• Look for opportunities to reduce scope through segmentation, tokenisation or a redirect or iframe payment integration.

Scope reduction is the highest-return activity in any PCI programme. Outsourcing card capture to a compliant provider can move you from hundreds of applicable controls to a fraction of them.

The twelve requirements at a glance

1. Install and maintain network security controls.
2. Apply secure configurations to all system components.
3. Protect stored account data.
4. Protect cardholder data with strong cryptography during transmission.
5. Protect all systems and networks from malicious software.
6. Develop and maintain secure systems and software.
7. Restrict access to system components and cardholder data by business need to know.
8. Identify users and authenticate access to system components.
9. Restrict physical access to cardholder data.
10. Log and monitor all access to system components and cardholder data.
11. Test security of systems and networks regularly.
12. Support information security with organisational policies and programmes.

Running the assessment

1. Confirm your validation level - driven by annual transaction volume and your acquirer, this determines whether you need a QSA-led Report on Compliance or a Self-Assessment Questionnaire.
2. Select the correct SAQ type if self-assessing. Choosing the wrong SAQ invalidates the exercise, so match it to how you actually accept payments.
3. Assess each requirement as in place, not in place, not applicable, or in place with a compensating control - with evidence for every judgement.
4. Record compensating controls carefully. They need a documented constraint, a rigorous justification and equivalent risk mitigation.
5. Prioritise remediation by risk and by effort - stored unencrypted card data first, always.
6. Re-test and validate, then plan for annual revalidation and quarterly scanning.

Findings that appear in almost every first assessment

• Cardholder data discovered outside the defined CDE - typically in logs, exports or email.
• Default vendor credentials or configurations still in place.
• Segmentation asserted but never penetration-tested.
• Missing or incomplete quarterly vulnerability scans by an Approved Scanning Vendor.
• Log retention shorter than required, or logs that nobody reviews.
• No documented, tested incident response plan for a card data breach.

Key takeaways

• Scope determines cost - reduce the cardholder data environment before assessing it.
• Choose the SAQ that matches how you truly accept payments.
• Compensating controls require documented constraints and equivalent mitigation.
• Stored, unencrypted card data is always the first thing to fix.