PCI DSS 4.0.1 readiness without the guesswork
Every PCI DSS 4.0 future-dated requirement became mandatory on March 31, 2025, including new controls for payment page scripts that catch many ecommerce merchants off guard. We help you understand your scope, close gaps, and arrive at your self-assessment questionnaire or QSA assessment prepared.
How we help
Readiness work that reduces both risk and the size of your compliance burden:
- Cardholder data flow mapping and scope definition
- Scope reduction through tokenization, hosted payment fields, and segmentation
- Gap assessment against PCI DSS 4.0.1 requirements
- Choosing and completing the correct SAQ
- Payment page script inventory and tamper detection (6.4.3 and 11.6.1)
- Internal and external penetration testing and segmentation testing (11.4)
- Policy, targeted risk analysis, and evidence preparation
Payments engineering experience
Our sister company, SwiftSoft Solutions, has built Stripe and Authorize.net integrations for years. That hands-on experience helps us spot where payment architectures unintentionally pull systems into PCI scope — and how to redesign them so they don’t.
A note on independence: we prepare you for compliance and strengthen the controls behind it. We are not a law firm, CPA firm, QSA, or C3PAO, and we don’t issue certifications or attestation reports — we’re glad to work alongside the counsel and assessors who do.
PCI DSS 4.0.1 Readiness: common questions
Don’t see your question? Ask our security team directly.
Can you issue our PCI Report on Compliance (ROC)?
No. A Report on Compliance must be completed by a PCI SSC Qualified Security Assessor (or an Internal Security Assessor for their own employer). We prepare you for that assessment, support SAQ completion, and provide the penetration testing PCI DSS requires.
What changed with PCI DSS 4.0.1 for ecommerce?
Requirements 6.4.3 and 11.6.1 require merchants to manage and authorize scripts on payment pages and detect unauthorized changes to those pages. They target the “web skimming” attacks that inject malicious JavaScript into checkout pages.
Does using Stripe or another processor make us PCI compliant?
It can greatly reduce your scope, but it doesn’t eliminate your obligations. You still need to validate compliance, usually through an SAQ, and protect the pages and systems that could affect how card data is collected.
Find your gaps before someone else does.
Talk directly with a senior security practitioner about where you’re exposed and what to fix first — no sales script, no obligation.