Skip to main content
VexaroSecurity
PCI DSS readiness

PCI DSS readiness & penetration testing

A Report on Compliance is signed off by a Qualified Security Assessor, and an Attestation of Compliance is your formal declaration. We issue neither. What we do is get you ready for the assessment: scope your cardholder-data environment, close the gaps against PCI DSS v4.0.1, and perform the Requirement 11.4 penetration testing and segmentation testing the standard requires.

Scope

Scope, gaps & the required testing

PCI DSS protects the cardholder-data environment (CDE). Scoping is the step that matters most: scope too narrowly and you fail, too widely and you pay for it. We map the CDE and connected systems, assess the gap to v4.0.1, and run the penetration testing the standard requires at Requirement 11.4.

Typical scope
  • Cardholder-data environment (CDE) scoping and data-flow mapping
  • Gap assessment against the PCI DSS v4.0.1 requirements
  • External and internal penetration testing per Requirement 11.4
  • Segmentation testing that actively validates isolation of the CDE
  • Remediation of exploitable findings, then re-test (supports Req 11.4.4)
  • Evidence packaging to hand to your QSA or for your SAQ
How we work

Readiness and testing, QSA-independent

We are clear about the limits of our work: we provide PCI DSS readiness, the gap assessment and the Requirement 11.4 penetration and segmentation testing. We are not a Qualified Security Assessor and do not validate compliance, issue a Report on Compliance or sign an Attestation of Compliance. That is the QSA's role. We can provide a testing confirmation letter, which is explicitly not a QSA attestation.

  1. 1

    Scoping

    We map the CDE, data flows and connected systems, agree rules of engagement and sign an NDA.

  2. 2

    Gap assessment

    We measure controls against PCI DSS v4.0.1 and prioritise what must close before assessment.

  3. 3

    Penetration testing

    We run external and internal testing per Requirement 11.4, confirming weaknesses by exploiting them.

  4. 4

    Segmentation validation

    We actively try to reach the CDE from outside it, so segmentation is tested, not just scanned.

  5. 5

    Remediation & re-test

    You remediate; we re-test fixed findings (supporting Req 11.4.4) and package the evidence for your QSA.

Deliverables

What you receive

A picture of your scope and gaps, plus the penetration-testing evidence your assessment depends on, structured along the PCI SSC outline for penetration-testing reports. The RoC and AoC come from your QSA, not from us.

What you get
  • CDE scope statement and data-flow documentation
  • Gap assessment mapped to PCI DSS v4.0.1 requirements
  • Penetration test report with a dedicated segmentation-test results section
  • Each finding: exploitability, evidence, reproduction and remediation (CVSS 3.1)
  • Free re-test of remediated issues within the window set in the SoW, supporting Requirement 11.4.4
  • Testing confirmation letter (explicitly not a QSA attestation)
Methodology & standards

Grounded in PCI DSS v4.0.1 & the PCI SSC testing guidance

PCI DSS v4.0.1Requirement 11.4NIST SP 800-115PTESCVSS 3.1CDE scoping

Readiness maps to PCI DSS v4.0.1 (the current standard). Penetration and segmentation testing sit at Requirement 11.4 and follow the PCI SSC Penetration Testing Guidance, based on PTES and NIST SP 800-115. Segmentation testing checks isolation in practice rather than scanning for it. We provide readiness and testing; we are not a QSA, we do not validate compliance or issue a Report on Compliance, and any confirmation letter is explicitly not a QSA attestation. PCI versions and validation rules change, so we re-confirm them at scoping.

Get ready for PCI DSS.

Tell us about your cardholder-data environment. We'll scope it, assess the gap to v4.0.1, run the Requirement 11.4 penetration and segmentation testing, and package the evidence for your QSA, under NDA. The first consultation is free.