PCI DSS Readiness Assessment
Answer 14 questions about how you handle cardholder data. You get a readiness score, a Red/Amber/Green rating, and your weakest requirement area — in about 4 minutes.
How well do you understand your cardholder data environment (CDE) scope?
What PCI DSS readiness means
The Payment Card Industry Data Security Standard (PCI DSS) is a set of controls for any organisation that stores, processes or transmits cardholder data. Its twelve requirements group into six areas, and this assessment scores your readiness across all of them so you can see where you stand before a formal SAQ or QSA assessment.
The requirement areas it scores
- Scope & Network (Requirements 1–2). How well you understand and document your cardholder data environment (CDE), and whether network security controls — firewalls and secure configurations — are in place and reviewed around it.
- Protect Cardholder Data (Requirements 3–4). How stored cardholder data is handled (minimised, tokenised or encrypted at rest with key management) and whether it is encrypted in transit over open, public networks.
- Vulnerability Management (Requirements 5–6). Anti-malware coverage across systems in and around the CDE, and how quickly critical vulnerabilities are patched under a risk-ranked process with change control.
- Access Control (Requirements 7–9). Whether access to cardholder data is restricted to need-to-know, multi-factor authentication is enforced for access into the CDE (a PCI DSS v4 emphasis), and physical access to systems and media is controlled.
- Monitoring & Testing (Requirements 10–11). Whether access to the CDE is logged and reviewed, and whether you run vulnerability scans (including quarterly ASV scans) and penetration tests.
- Policy & Third Parties (Requirement 12). Whether you maintain an information security policy programme, manage third-party service providers that touch card data, and have a tested incident response plan.
Note: This is a self-assessment for preparation only. It does not constitute a PCI DSS assessment and is not a substitute for validation by a Qualified Security Assessor (QSA) or completion of the official SAQ/ROC.
Frequently asked questions
What does this PCI DSS readiness assessment measure?
It asks 14 questions mapped to the PCI DSS v4.0.1 requirement areas — scope and network security, protecting stored and transmitted cardholder data, vulnerability management, access control, logging and testing, and policy and third-party management. Each answer is scored, and you get an overall readiness score, a Red/Amber/Green rating, and the requirement area where you are weakest so you know where to focus first.
Is this the same as completing an official SAQ or ROC?
No. This is a preparation tool to gauge your readiness before you tackle the formal validation. It is not a PCI DSS assessment and does not replace an official Self-Assessment Questionnaire (SAQ), a Report on Compliance (ROC), or validation by a Qualified Security Assessor (QSA). Use it to find gaps early; use the official documents from the PCI Security Standards Council to report compliance.
How long does the assessment take?
About four minutes. There are 14 multiple-choice questions, each with four options describing increasing levels of maturity from "not started" to "fully in place". Your answers stay in your browser as you go, and you see your scored result immediately at the end.
Which PCI DSS version does it cover?
PCI DSS v4.0.1, the current version of the standard. The questions reflect v4 emphases such as multi-factor authentication for all access into the cardholder data environment and the expanded requirements around web-page scripts and change management.
I do not know which SAQ applies to me — where do I start?
Start with the SAQ selector, which walks you through how you accept payments to identify the likely SAQ type (A, A-EP, B, B-IP, C, C-VT, D or P2PE). Then use this readiness assessment to see how prepared you are against the requirements that SAQ covers. Confirm both with your acquiring bank or a QSA.