Regulatory Standards · Global
PCI DSS
PCI DSS v4, evidenced continuously.
PCI DSS v4 shifts from point-in-time checks to ongoing security. Astragar tracks controls across the cardholder data environment and prioritises the vulnerabilities that put card data at risk.
Book a PCI DSS review✓ Available in Astragar GRC
v4.0.1
Current version of the standard
12
Principal requirements
31 Mar 2025
Future-dated v4 requirements became mandatory
What PCI DSS requires
The obligations, in brief.
Scope the CDE
Know where cardholder data is stored, processed and transmitted.
Vulnerability management
Internal and external scanning, and timely remediation.
Targeted risk analyses
Justify control frequencies with documented risk analysis.
Ongoing evidence
Show controls operate throughout the year, not just at assessment.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every PCI DSS requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put PCI DSS controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
Astragar's sensitive data discovery and vulnerability prioritisation map directly to scoping and Requirement 6 and 11 work.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Find the data. Test the controls. Reduce the risk.
Start with a scoped PCI DSS review: requirements mapped, evidence gaps found, remediation prioritised by financial impact.
Book a PCI DSS reviewAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
