PCI DSS Certification Preparation
Non-compliance with PCI DSS means fines up to $100,000 per month plus losing ability to accept cards. We'll guide you through standard requirements - implementation, documentation, audit. Protect customer data and avoid sanctions.
What is PCI DSS Certification Preparation?
PCI DSS Certification Preparation is end-to-end support for organizations that accept card payments — from CDE scoping and gap analysis against all 12 PCI DSS 4.0 requirements, through technical control implementation and penetration testing, to obtaining the Attestation of Compliance (AOC) accepted by banks and acquirers. nFlo guides companies through the entire process to avoid fines of up to $100,000 per month and eliminate the risk of losing the ability to process card payments.
Without PCI DSS you lose the right to accept card payments
Comprehensive PCI DSS certification preparation
Gap Analysis
Compliance assessment against all 12 PCI DSS requirements
Control Implementation
Missing technical security control implementation
SAQ & AOC
Documentation preparation and compliance audit
€55K Monthly Fine - Online Store Story
An online store with €2.5M annual revenue was fined €55K by acquirer for PCI DSS non-compliance. After 3 months without remediation - lost ability to accept card payments. Company went bankrupt within 6 months.
Without PCI DSS compliance:
- Fines from $5,000 to $100,000 per month from card organizations
- Increased transaction fees (up to 0.5% higher)
- Risk of losing ability to accept card payments
- Liability for card data breach - card replacement costs can reach millions
From CDE Scoping to Attestation of Compliance
We don’t leave you with a long list of requirements to meet. We guide you through the entire process - from defining cardholder data environment scope to obtaining AOC (Attestation of Compliance).
What you get:
- CDE scoping - precise determination of which systems process card data
- Compliance assessment against all 12 PCI DSS 4.0 requirements
- Implementation plan for missing controls with priorities
- Technical security implementation (segmentation, encryption, monitoring)
- Security policy and procedure preparation
- Self-Assessment Questionnaire (SAQ) appropriate for your business type
- Penetration testing and ASV scanning coordination
- Support during QSA audit (for Merchant Level 1 and 2)
- Attestation of Compliance (AOC) for bank submission
Who Is It For?
This service is for you if:
- You accept card payments (e-commerce, POS, call center)
- You’re required by bank/acquirer to obtain PCI DSS
- You process, store or transmit payment card data
- You’re a payment service provider or payment processor
- You want to lower transaction fees and avoid fines
PCI DSS Requirements
12 Payment Card Industry Data Security Standard Requirements
PCI DSS 4.0 defines 12 core requirements in 6 goals:
Build and Maintain Secure Network:
- Firewall configuration for card data protection
- Change default passwords and parameters
Protect Cardholder Data: 3. Protect stored card data 4. Encrypt transmission over public networks
Maintain Vulnerability Management: 5. Malware protection 6. Secure systems and applications
Implement Strong Access Control: 7. Restrict data access by need-to-know 8. Authenticate system access 9. Restrict physical access
Monitor and Test Networks: 10. Log and monitor data access 11. Regular security testing
Maintain Information Security Policy: 12. Information security policy
SAQ Types
Which SAQ is Right for You?
| SAQ Type | Who | Complexity |
|---|---|---|
| SAQ A | E-commerce with redirect to PSP | Simplest |
| SAQ A-EP | E-commerce with payment page elements | Low |
| SAQ B | Imprint machines, standalone terminals | Low |
| SAQ B-IP | IP-connected terminals | Medium |
| SAQ C | Payment applications | Medium |
| SAQ C-VT | Virtual terminal (manual entry) | Low |
| SAQ P2PE | P2PE-validated payment solutions | Low |
| SAQ D Merchant | All other merchants | Full scope |
| SAQ D SP | Service providers | Full scope |
Compliance Process
Step by Step to Certification
Phase 1: Scoping (1-2 weeks)
- Identify all systems processing card data
- Map data flows (where card data goes)
- Define CDE boundaries
- Identify connected systems
Phase 2: Gap Analysis (2-3 weeks)
- Assessment against all 12 requirements
- Technical configuration review
- Policy and procedure review
- Gap documentation and risk assessment
Phase 3: Remediation (4-12 weeks)
- Technical control implementation
- Network segmentation
- Encryption implementation
- Access control hardening
- Logging and monitoring setup
- Policy and procedure development
Phase 4: Validation (2-4 weeks)
- Internal penetration testing
- ASV external scanning
- SAQ completion
- Evidence collection
Phase 5: Audit/Certification (1-4 weeks)
- QSA on-site audit (if required)
- Finding remediation
- AOC issuance
- Submission to acquirer
Key Technical Requirements
What You Need to Implement
Network Security:
- Firewall protecting CDE
- DMZ for public-facing systems
- Network segmentation
- Wireless security (if applicable)
Data Protection:
- No PAN storage (if possible)
- Strong encryption for stored data (AES-256)
- TLS 1.2+ for transmission
- Key management procedures
Access Control:
- Unique user IDs
- Strong authentication (MFA)
- Role-based access
- Physical access controls
Monitoring:
- Log all access to cardholder data
- Centralized log management
- Daily log review
- Alerting on suspicious activity
Related Glossary Terms
Learn more about key concepts related to this service:
Contact your account manager
Discuss PCI DSS Certification Preparation with your dedicated account manager.
How we work
Our proven service delivery process.
Scoping
Define CDE (Cardholder Data Environment)
Gap Analysis
Compliance assessment against 12 PCI DSS 4.0 requirements
Remediation
Missing security control implementation
SAQ & Testing
Self-Assessment Questionnaire and penetration testing
QSA Audit
Audit by Qualified Security Assessor (if required)
Benefits for your business
What you gain by choosing this service.
Accept Payments
Maintain right to accept payment cards
Avoid Fines
Protection from fines up to $100,000 per month
Customer Trust
Customers know their data is secure
Lower Premiums
Cyber insurers value compliance
Related Articles
Expand your knowledge with our resources.
CVE-2026-12249: An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active...
An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (int...
Read more →CVE-2026-9648: The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS...
The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted ...
Read more →CVE-2026-50752: Site-to-Site VPN Certificate Bypass in Check Point (IKEv1)
Check Point Research discovered a Site-to-Site VPN certificate bypass in the deprecated IKEv1 key exchange. No active exploitation observed; the same hotfix as CVE-2026-50751 fixes it....
Read more →Frequently Asked Questions
Common questions about PCI DSS Certification Preparation.
How long does PCI DSS certification preparation take?
Implementation takes 3 to 9 months depending on the size of the CDE environment and current compliance level. Companies with ISO 27001 already in place can shorten this time by 30-40%.
Do I need a full QSA audit or is an SAQ sufficient?
It depends on your Merchant Level. Level 1 (over 6 million transactions per year) requires a QSA audit. Level 2-4 typically complete an SAQ (Self-Assessment Questionnaire). We help determine the appropriate type during the CDE scoping phase.
What does PCI DSS 4.0 cover and how does it differ from version 3.2.1?
PCI DSS 4.0 introduces a customized approach (flexibility in meeting requirements), requires continuous monitoring instead of point-in-time audits, and strengthens requirements for MFA, encryption and vulnerability management.
Do you also help with penetration testing and ASV scanning required by PCI DSS?
Yes, we coordinate both internal and external penetration testing (Requirement 11) as well as quarterly scanning by an Approved Scanning Vendor (ASV) required for all Merchant Levels.