PCI DSS Gap Analysis & Gap Assessment Guide
TL;DR · the short version
A PCI DSS gap analysis is a pre-assessment that compares your current controls against the Payment Card Industry Data Security Standard, so you can fix gaps before a formal assessment or self-assessment questionnaire (SAQ). The process: define scope (the cardholder data environment and everything connected to it), map controls to each requirement, find shortfalls, rate and prioritise the gaps, and build a remediation plan with owners and dates. Getting scope right matters most — too broad wastes effort, too narrow leaves you non-compliant.
A PCI DSS gap analysis is how you find out whether you can pass — before it counts. It compares your current controls against the standard's requirements, surfaces the gaps, and gives you a remediation plan, so a formal assessment or Self-Assessment Questionnaire becomes a confirmation rather than a gamble. The work lives and dies on getting one thing right: scope.
Step 1 — Define scope (the most important step)
PCI DSS applies to the cardholder data environment (CDE) — systems that store, process or transmit cardholder data — plus everything connected to or able to affect it. Scope too narrowly and you pass the analysis but remain non-compliant where it matters; too broadly and you waste effort. Good network segmentation reduces scope, which is why scoping and segmentation are the foundation of an efficient PCI programme.
Step 2 — Map controls to requirements
Go requirement by requirement and record what control you have today, where the evidence is, and whether it fully meets the requirement.
PCI DSS gap assessment checklist: the 12 requirements
A PCI DSS gap assessment (the terms gap analysis and gap assessment are used interchangeably) works through the 12 principal requirements of PCI DSS v4.0.1 and records, for each, whether your in-scope systems fully meet, partly meet or do not meet it, and where the evidence lives:
- Install and maintain network security controls.
- Apply secure configurations to all system components.
- Protect stored account data.
- Protect cardholder data with strong cryptography during transmission over open, public networks.
- Protect all systems and networks from malicious software.
- Develop and maintain secure systems and software.
- Restrict access to system components and cardholder data by business need to know.
- Identify users and authenticate access to system components.
- Restrict physical access to cardholder data.
- Log and monitor all access to system components and cardholder data.
- Test security of systems and networks regularly.
- Support information security with organizational policies and programs.
Two version points matter when you scope the work. PCI DSS v3.2.1 was retired on 31 March 2024, and the requirements that v4.0 introduced as future-dated became mandatory on 31 March 2025. A gap assessment today should therefore be run against v4.0.1 in full, including the formerly future-dated items such as MFA for all access into the cardholder data environment and targeted risk analyses.
Step 3 — Identify and rate the gaps
List every requirement you do not fully meet, and rate each gap by risk and remediation effort so you can prioritise.
Step 4 — Build a remediation plan
Assign owners and target dates to each gap, fix the high-risk/low-effort items first, and re-check closed gaps before the formal assessment.
Step 5 — Then complete the SAQ or assessment
Which Self-Assessment Questionnaire applies depends on how you handle card data; the gap analysis tells you whether you can honestly attest compliance and what to fix first if not.
Work through it with the PCI DSS tools →, run the interactive PCI gap analysis, and prep for the assessment with certification prep.
Frequently asked questions
What is it? A pre-assessment comparing current controls to PCI DSS requirements to find and fix gaps before it counts.
Why is scope key? PCI applies to the CDE and connected systems; wrong scope means wasted effort or hidden non-compliance — segmentation reduces it.
How to run it? Scope, map controls to requirements, rate gaps, remediate with owners/dates, re-check.
Relation to the SAQ? The gap analysis prepares you to honestly complete the SAQ; run it, remediate, then attest.
Frequently asked questions
What is a PCI DSS gap analysis?
A gap analysis is a pre-assessment exercise that compares your organisation's current security controls against the requirements of PCI DSS. Its purpose is to find where you do not yet meet the standard — before a formal Report on Compliance or a Self-Assessment Questionnaire — so you can remediate the gaps rather than fail the assessment. It produces a prioritised list of what is missing and what to fix.
Why is scoping the most important step?
PCI DSS applies to the cardholder data environment (CDE) — the systems that store, process or transmit cardholder data — plus everything connected to or that could affect it. If you scope too narrowly, you will pass a gap analysis but still be non-compliant where it matters; too broadly, you waste effort assessing systems that are out of scope. Well-designed segmentation reduces scope, which is why scoping and segmentation are the foundation of any efficient PCI programme.
How do I run the gap analysis?
Define and confirm scope (the CDE and connected systems), map your current controls to each PCI DSS requirement, identify the requirements you do not fully meet, rate each gap by risk and effort, and build a remediation plan with owners and target dates. Then re-check the closed gaps before the formal assessment or SAQ.
How does a gap analysis relate to the SAQ?
The Self-Assessment Questionnaire (SAQ) is the formal self-attestation of PCI DSS compliance for eligible merchants, and which SAQ type applies depends on how you handle card data. A gap analysis is the preparation: it tells you whether you can honestly answer the SAQ's requirements as compliant, and what to fix first if you cannot. Run the gap analysis, remediate, then complete the SAQ.