PCI DSS v4.0 Certification in India

PCI DSS v4.0.1 · Payment Card Industry Data Security Standard · typical timeline 12–36 weeks

PCI DSS compliance is mandatory for merchants, payment gateways, processors and service providers handling cardholder data, enforced by acquiring banks and card brands. We scope the cardholder data environment, implement the 12 requirements, run gap and penetration testing, and deliver the SAQ or coordinate the QSA for a Report on Compliance. Priced on request — one fixed all-inclusive quote within 24 hours of a scoping call.

Who needs PCI DSS v4.0 certification

• Payment gateways, aggregators and fintechs (Level 1 service providers)
• E-commerce and subscription businesses
• BPOs handling card data for banks and merchants
• Hotels, airlines, retailers and SaaS with payment pages

PCI DSS v4.0 requirements in plain words

1. Scope and segment the cardholder data environment (CDE)
2. 12 requirements: firewall, defaults, stored data protection, encryption in transit, malware, secure development, access control, authentication, physical, logging, testing, policy
3. Quarterly ASV scans and annual penetration tests
4. SAQ (A, A-EP, D…) for merchants / service providers or full RoC by a QSA
5. Customised approach and targeted risk analyses (v4.0)
6. Attestation of Compliance to acquirer/bank

Certification process

1. Step 1Gap assessmentWe audit your current processes against the standard and list exactly what is missing.
2. Step 2DocumentationPolicies, procedures, records and formats written for your plant, not copied templates.
3. Step 3Implementation & trainingYour team trained on the floor; internal audit and management review done with you.
4. Step 4Certification auditStage 1 and Stage 2 audit by an IAF-accredited certification body of your choice.
5. Step 5Certificate & surveillanceCertificate issued; we support annual surveillance audits for the full 3-year cycle.

PCI DSS v4.0 certification cost in India

Indicative 2026 all-inclusive prices — consulting, documentation, training and the certification-body audit fee. No separate charges. Full cost breakdown →

Documents required

• CDE scope and network/data-flow diagrams
• Policy and procedure set mapped to 12 requirements
• ASV scan and penetration test reports
• Access, logging and change records
• SAQ or RoC and Attestation of Compliance

Benefits

• Required by banks, card brands and payment partners
• Reduces breach liability and card-brand fines
• Shares controls with ISO 27001 and SOC 2
• Enables onboarding with major gateways and acquirers

Frequently asked questions

Do we need a QSA?

Level 1 merchants and service providers need a QSA Report on Compliance; lower levels self-assess with an SAQ, which we prepare.

What changed in v4.0?

Stronger authentication (MFA everywhere), targeted risk analyses, e-commerce script controls, and a customised approach option; v3.2.1 retired in 2024.

How long is compliance valid?

Annual revalidation with quarterly ASV scans.

PCI DSS v4.0 consultants by city

• Baddi
• Ludhiana
• Mohali
• Chandigarh
• Delhi
• Gurgaon
• Noida
• Ahmedabad
• Mumbai
• Pune
• Bangalore
• Chennai
• Hyderabad
• Kolkata
• Indore

Written by Sahil Dubey, CISA — lead consultant, PraxisQ Consulting LLP. Reviewed October 2026.