PCI DSS v4.0 Compliance Services | US, UK, Canada, & EU

PCI DSS (Payment Card Industry Data Security Standard) v4.0 is the global standard maintained by the PCI Security Standards Council for organizations that store, process, or transmit cardholder data. Effective dates for v4.0 require all entities to be assessed against v4.0 as of March 2024, with certain new requirements becoming required (rather than best practice) as of March 2025.

Obligations apply to Merchants (Levels 1 to 4 by annual transaction volume) and to Service Providers (Levels 1 to 2). BluEnt engineers cardholder data environment (CDE) controls, supports scope reduction, and prepares evidence for either a Report on Compliance (ROC) by a Qualified Security Assessor (QSA) or a Self-Assessment Questionnaire (SAQ).

BluEnt is a PCI DSS v4.0 readiness and engineering partner for merchants and service providers. We define the cardholder data environment, reduce its scope where possible, engineer the controls v4.0 requires, manage approved scanning vendor (ASV) engagement, and prepare your evidence for ROC or SAQ assessment.

Engagements are scoped to your merchant level or service provider level and to the payment channels actually in use.

Every engagement delivers four artifacts: a cardholder data environment scope diagram with documented segmentation and flows; engineered v4.0 controls including the new customized-approach evidence where applicable; an ASV-scan and penetration-testing cadence with passing results documented; and a ROC-ready or SAQ-ready evidence pack mapped clause by clause to the 12 PCI DSS requirements.

BluEnt is not your QSA. We are your readiness partner, working alongside your chosen QSA firm for ROC engagements.

20+ Years Enterprise Delivery | 6 Global Markets | 4 Industry Verticals | Platform-Agnostic Approach

Trusted By

Is This Your Situation?

BluEnt is the right PCI DSS readiness partner if any of the following describe your current state.

Your last PCI assessment was performed against v3.2.1 and v4.0 requirements have not yet been engineered.
The cardholder data environment scope has grown larger than necessary because segmentation is informal or unverified.
ASV scans are passing but penetration testing is sporadic and segmentation testing has not been performed annually.
v4.0 customized approach is attractive but you do not have the documentation a QSA needs to accept it.
Your service provider tier (Level 1 vs Level 2) status has changed and the assessment path needs reconsidering.
A Level 1 ROC is required for a payment brand contract or partnership and the timeline is tight.

For the broader compliance program, see the Cybersecurity Compliance Services Hub. For the platform engineering behind PCI controls, see Cloud Security Services.

Request a PCI DSS Gap Assessment

What Makes BluEnt Different

PCI vendors come in three shapes: QSA firms (assess but cannot remediate the same controls), tooling resellers (sell scanners and segmentation tooling), and policy shops (write documents). BluEnt does the engineering and evidence work between the QSA firm and the tooling vendors.

Without an Engineering-Led PCI Partner	With BluEnt
CDE scope undocumented or larger than necessary.	CDE scope reduced through tokenization, segmentation, and channel restructuring; documented in diagrams.
Segmentation tested only by ad hoc scan.	Annual segmentation testing per PCI DSS 11.4.5, with results in the evidence pack.
Customized approach considered but never adopted.	Customized approach adopted where it reduces total control burden, with the documentation a QSA can sign off on.
ASV scans passing one quarter, failing the next.	Vulnerability management integrated with engineering so findings are remediated in sprints, not at scan time.
Penetration testing reports filed without remediation tracking.	Pen test findings tracked to closure with remediation evidence in the GRC tool.

For the platform controls behind PCI, see Cloud Security Services. For identity-driven controls under PCI 7 and 8, see Identity and Access Management.

Engage BluEnt for PCI DSS v4.0 Readiness

PCI DSS v4.0 Requirements We Operationalize

PCI DSS v4.0 organizes 12 requirements into six purpose-driven groups. v4.0 introduced the customized approach alongside the traditional defined approach, plus new requirements that became best practice in March 2024 and required in March 2025.

The catalog below maps each requirement group to the engineering work BluEnt performs.

Control Family	Control IDs	What BluEnt Engineers	Tooling Examples
1. Install and Maintain Network Security Controls	Firewall and router configuration, default-deny rule sets, network segmentation reviewed every six months.	Engineered firewall and router configurations, segmentation diagrams refreshed continuously, change management for rule changes.	AWS Security Groups, Azure NSG, Palo Alto, Check Point, Cisco Firepower.
2. Apply Secure Configurations	Vendor defaults changed, configuration standards based on hardening guides.	CIS Benchmark hardening enforced through configuration management, drift detection, automatic remediation for high-confidence drift.	AWS Config, Azure Policy, Ansible, Chef, CIS-CAT.
3. Protect Stored Account Data	Storage minimization, tokenization where possible, strong encryption with key management, data retention and disposal.	Tokenization to take systems out of scope, AES-256 encryption with KMS, retention enforcement, secure disposal procedures.	Spreedly, Basis Theory, AWS KMS, Azure Key Vault, HashiCorp Vault.
4. Protect Cardholder Data with Strong Cryptography During Transmission	TLS configuration, strong cryptography across open networks.	TLS 1.3 enforced at load balancers, certificate management, OCSP stapling, HSTS, weak cipher disabled.	AWS Certificate Manager, Azure Key Vault Certs, Let’s Encrypt, Venafi.
5. Protect All Systems and Networks from Malicious Software	Anti-malware deployment and currency, evolving attack vector coverage.	EDR rollout across all in-scope endpoints, server protection, anti-phishing controls, behavioral detection.	CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne.
6. Develop and Maintain Secure Systems and Software	Secure SDLC, vulnerability identification, change management, custom software security.	SAST and DAST in CI/CD, SCA dependency scanning, secure code training, change-management gates.	Snyk, Checkmarx, GitHub Advanced Security, GitLab Ultimate.
7. Restrict Access by Business Need to Know	Least-privilege access, role-based access control.	RBAC and ABAC policies, quarterly access reviews, just-in-time elevation for sensitive functions.	Okta, Entra ID, CyberArk, BeyondTrust.
8. Identify Users and Authenticate Access	Strong authentication factors, MFA for all access to CDE, no shared accounts.	MFA enforced for all CDE access including service accounts, FIDO2 keys where possible, password policy aligned to v4.0 length and complexity changes.	Okta, Entra ID, Yubico, Duo Security.
9. Restrict Physical Access to Cardholder Data	Facility access controls, media handling, devices in public spaces.	Badge access systems, camera systems, media disposal procedures, POI device inspection cadence per 9.5.	Lenel, Genetec, secure-shredding vendor management.
10. Log and Monitor All Access to System Components and Cardholder Data	Centralized log collection, retention, review, time synchronization.	SIEM ingest of all CDE logs, 12-month online retention plus 3-month immediately available, NTP synchronization, alert tuning for v4.0 use cases.	Splunk, Sentinel, Chronicle, SumoLogic.
11. Test Security of Systems and Networks Regularly	Vulnerability scanning, ASV scans, penetration testing, segmentation testing, file integrity monitoring.	ASV scan management with named provider, quarterly internal scans, annual penetration testing, annual segmentation testing per 11.4.5, FIM for critical files.	Tenable, Rapid7, Veracode, NetSPI, Bishop Fox, CrowdStrike Falcon FIM.
12. Support Information Security with Organizational Policies and Programs	Information security policy, risk assessment, awareness training, vendor management, incident response.	Policy library covering all v4.0 requirements, annual risk assessment, training tracked in LMS, vendor program for in-scope service providers.	Confluence or SharePoint policy library, KnowBe4, OneTrust Vendorpedia.

For the engineering layer behind these controls, see Cloud Security Services. For identity controls under Requirements 7 and 8, see Identity and Access Management.

Commission a PCI DSS v4.0 Coverage Diagnostic

How to Choose a Cybersecurity Partner

Buyers evaluating PCI DSS readiness partners ask the same questions.

Scope reduction first

The cheapest control is one you do not have to implement. The right partner attempts scope reduction (tokenization, hosted payment fields, P2PE) before scoping a remediation program for the existing CDE.

Customized approach experience

v4.0’s customized approach can reduce total control burden where the entity meets the customized objective with alternative measures. The right partner has documentation a QSA will accept; novelty alone is not sufficient.

Independence from the QSA

PCI SSC rules prevent the same firm from preparing and assessing the same ROC. The right partner does not also offer QSA services; BluEnt does not, and coordinates handover to your chosen QSA firm.

Segmentation testing depth

Annual segmentation testing under 11.4.5 is increasingly scrutinized. The right partner conducts segmentation testing as a real exercise, not a paper review.

Continuous evidence collection

PCI is an annual cycle but the controls must operate year-round. The right partner integrates evidence collection into a GRC tool so the next ROC or SAQ is a renewal, not a project.

Hire BluEnt to Engineer Your PCI DSS v4.0 Readiness

Where does your compliance posture stand today?

Take the BluEnt Cybersecurity Maturity Assessment for a free, audit-defensible benchmark across governance, controls, evidence readiness, and continuous monitoring.

Take the Cybersecurity Maturity Assessment

How We Deliver: A Five-Stage Methodology

Every BluEnt PCI DSS engagement follows the same five-stage methodology.

Weeks 1 to 6

Stage 1: CDE Scoping and Scope Reduction

We define the cardholder data environment, map all flows, and identify scope-reduction opportunities (tokenization, hosted payment fields, P2PE, channel restructuring). The smaller the CDE, the lower the total control burden.

Deliverable: CDE scope diagram, data-flow inventory, scope-reduction plan, merchant/service-provider level confirmation.

Weeks 4 to 10

Stage 2: v4.0 Gap Assessment and Customized Approach Decision

We assess current controls against PCI DSS v4.0 (including March 2025 newly required items) and decide whether to use the defined approach, the customized approach, or a mix per requirement.

Deliverable: v4.0 gap report, customized-approach decision register, prioritized remediation backlog.

Weeks 8 to 20

Stage 3: Control Engineering

We engineer the controls: segmentation, tokenization, encryption, access controls, logging, vulnerability management, penetration testing program. Controls are engineered into the platforms, not into a binder.

Deliverable: Engineered controls, segmentation tested and documented, ASV scans clean, penetration test scheduled.

Weeks 18 to 22

Stage 4: Evidence Pack and Pre-Assessment

We assemble the evidence pack mapped to each requirement (and to customized-approach objectives where chosen) and run a pre-assessment that mirrors the QSA’s procedures.

Deliverable: ROC-ready or SAQ-ready evidence pack, pre-assessment report, remediation tracker.

Stage 5: QSA Handover or SAQ Submission and Continuous Operations

We coordinate handover to your chosen QSA firm for ROC engagements, or finalize the SAQ for self-assessing entities. The control program then operates continuously, ready for the next annual cycle.

Deliverable: QSA handover package or signed SAQ, continuous evidence collection, quarterly readiness check-ins.

For platform controls behind PCI, see Cloud Security Services.

Schedule a PCI DSS Scoping Call

Capabilities at a Glance

Six capability areas frame the PCI DSS v4.0 readiness practice.

CDE Scoping and Scope Reduction

Cardholder data environment definition, flow mapping, tokenization design, hosted payment field deployment, P2PE evaluation, channel restructuring.

Customized Approach Documentation

Where v4.0 customized approach reduces total control burden, BluEnt builds the documentation a QSA will accept: customized objectives, alternative controls, risk analysis.

Segmentation and Penetration Testing Coordination

Annual segmentation testing per 11.4.5, penetration testing per 11.4.1 to 11.4.6, coordination with specialist pen test firms (NetSPI, Bishop Fox, NCC Group).

ASV Scan Management

Approved Scanning Vendor selection, quarterly external scan management, internal scan cadence, remediation tracking, false-positive handling.

ROC or SAQ Evidence Pack

Evidence packs mapped clause by clause to v4.0, organized for QSA review or SAQ self-submission. GRC tool configured for continuous evidence.

Continuous PCI Operations

Year-round control monitoring, quarterly evidence review, annual refresh, change-driven re-scoping, next-cycle readiness.

For the cloud platforms underpinning PCI controls, see Cloud Security Services.

Engage BluEnt for PCI DSS v4.0 Readiness

Industries We Serve

BluEnt delivers PCI DSS readiness across four verticals where payment-card flows are material.

E-Commerce and Retail

Primary PCI scope: storefront payment flows, recurring billing, marketplace settlement, loyalty redemption. Scope reduction through tokenization and hosted payment fields is the first lever.

Architecture, Engineering, and Construction

AEC firms with project-based invoicing increasingly accept cards. PCI scope is usually narrow (SAQ A or SAQ A-EP) but must be documented; BluEnt scopes accordingly.

Healthcare and Life Sciences

Healthcare patient-payment flows (copays, retail pharmacy, telehealth) require PCI scope alongside HIPAA. BluEnt scopes both in parallel and reuses shared controls (encryption, access management, audit logging).

Manufacturing and Industrial

Manufacturers with B2B payment flows occasionally accept cards and need narrow PCI scope. Subscription and aftermarket service business lines bring additional PCI obligations.

Vertical-specific compliance programs are detailed on the Cybersecurity Compliance Services Hub.

Request a Vertical-Specific PCI Diagnostic

Cybersecurity Services Across Six Markets

PCI DSS is a global standard maintained by the PCI Security Standards Council. Card brand enforcement and regional rules layer on top.

PCI DSS v4.0 Compliance Services for US, UK, Canada, EU, Australia

United States PCI DSS v4.0, card brand programs (Visa CISP, Mastercard SDP, AmEx DSOP, Discover DISC, JCB), state-level breach notification.

United Kingdom PCI DSS v4.0, UK card-brand-equivalent programs, ICO data protection alignment.

Australia PCI DSS v4.0, Australian card schemes alignment, ACCC consumer protection where relevant.

Canada PCI DSS v4.0, Interac scheme rules, PIPEDA and provincial privacy law alignment.

Netherlands and EU PCI DSS v4.0, PSD2 strong customer authentication interaction, GDPR alignment for cardholder personal data.

Broader Europe PCI DSS v4.0 plus national variations on card-scheme enforcement and consumer protection.

For region-specific compliance programs, see the Cybersecurity Compliance Services Hub.

Book a Region-Specific PCI Compliance Review

Engineer PCI Out of Scope Where You Can, In Depth Where You Cannot

PCI DSS v4.0 has raised the bar on engineering rigor: segmentation tested annually, MFA across service accounts, customized approach available but requiring real documentation. The organizations that handle v4.0 well start with scope reduction, then engineer depth where scope cannot be reduced, then operate the program continuously rather than annually.

BluEnt reduces the CDE, engineers the v4.0 controls, manages the ASV and pen test cycles, and prepares the ROC or SAQ evidence pack. Your chosen QSA firm issues the ROC; you self-submit the SAQ.

Whether you are upgrading from v3.2.1, working toward your first Level 1 ROC, or maintaining an annual SAQ cycle, our team works alongside yours from day one.

Hire BluEnt to Engineer Your PCI DSS v4.0 Readiness

Explore the IT Security and Cybersecurity Practice

Frequently Asked Questions

What changed in PCI DSS v4.0?

v4.0 introduced the customized approach as an alternative to the defined approach, expanded MFA requirements (8.4 across all access including service accounts), enhanced password requirements (12-character minimum), required annual segmentation testing (11.4.5), and added new requirements for service providers around customer evidence. v4.0 also clarified scoping and tokenization treatment. Required dates: March 2024 baseline; certain new requirements became required (rather than best practice) in March 2025.

What is the difference between Defined Approach and Customized Approach?

Defined Approach implements PCI DSS requirements exactly as written. Customized Approach allows the entity to meet the customized-approach objective using alternative controls, supported by documentation including a customized-approach risk analysis. A QSA must accept the customized control as meeting the objective. Most v4.0 implementations use a mix; the customized approach is most valuable where the defined requirement is impractical for the architecture in use.

What is the difference between ROC and SAQ?

A Report on Compliance (ROC) is produced by a Qualified Security Assessor (QSA) and is required for Level 1 merchants and most Level 1 service providers. Self-Assessment Questionnaires (SAQs) come in several types (A, A-EP, B, B-IP, C, C-VT, D-Merchant, D-Service Provider, P2PE) and apply to lower-volume merchants depending on payment channels in use. BluEnt scopes the correct path in Stage 1.

Can BluEnt be both readiness partner and QSA?

No. PCI SSC rules prevent the same firm from preparing and assessing the same ROC. BluEnt is a readiness partner only and coordinates handover to your chosen QSA firm.

How long does PCI DSS v4.0 readiness take?

A Level 1 merchant with a moderately sized CDE typically reaches v4.0 readiness in 4 to 9 months from kickoff, depending on the amount of scope reduction achievable and the gap to current controls. Smaller merchants under SAQ A can often reach readiness in 6 to 10 weeks.

How does PCI DSS interact with SOC 2 or ISO 27001?

Approximately 60 percent of PCI v4.0 controls overlap with SOC 2 Common Criteria and ISO 27001 Annex A. BluEnt scopes a unified evidence program where multiple frameworks apply, reducing duplicate work across PCI, SOC 2, ISO 27001, and HIPAA.