PCI DSS Gap Analysis: What It Covers, How It Works and What You Get

A PCI DSS gap analysis is a pre-assessment review that compares your scope, controls and evidence with every applicable requirement of PCI DSS v4.0.1 and shows you what is missing before a Qualified Security Assessor (QSA) or your Self-Assessment Questionnaire does. It usually takes days for a small environment and weeks for a large one, and it ends with a gap report and a prioritised remediation roadmap.

Findings from a gap analysis are private and fixable. Findings from a formal assessment go in your report. That is the whole case for doing one.

Key takeaways

• A gap analysis is a diagnostic exercise before a formal assessment, not the assessment itself.
• Scoping and data flow mapping come first; everything else depends on them.
• Start six to nine months before your assessment if you can, to leave time for remediation.
• Prioritise findings by risk and lead time, not by requirement number.
• Follow up with a short readiness review once remediation is complete.

What is a PCI DSS gap analysis?

It is a structured comparison of how you operate today against what PCI DSS v4.0.1 requires for your validation route, whether that is an SAQ or a Report on Compliance (ROC). It rates each requirement as in place, partly in place or not in place, explains why, and recommends what to change.

It is advisory. It tells you what needs to change but does not implement the fixes, which keeps the later assessment independent. You may also see it called a PCI DSS gap assessment or a pre-assessment. A PCI readiness assessment is related but usually comes later, as the comparison below shows.

For a quick first pass before you commission one, our free PCI DSS gap analysis tool asks 22 questions on your scope, your SAQ and the 12 requirements, then gives you a readiness score, the likely gaps and the fix for each. It runs in your browser and nothing is sent unless you choose to.

Why run a gap analysis before your PCI assessment?

Because the standard has moved. PCI DSS v3.2.1 was retired on 31 March 2024, and the 51 future-dated requirements introduced in v4.0 became mandatory on 31 March 2025. Organisations that last looked closely at the standard under v3.2.1 usually find more has changed than they expected. Our PCI DSS 4.0.1 changes guide lists the main new requirements, and the standard itself is in the PCI SSC document library.

A gap analysis also tells you early whether you have chosen the right validation route, whether your scope will hold up, and whether any area will need a compensating control or major remediation that has to be budgeted.

What does a PCI DSS gap analysis cover?

Every requirement that applies to you, grouped the way the standard is. The table shows what a reviewer looks at and where v4.0.1 most often catches organisations out.

How does a PCI DSS gap analysis work?

A well-run gap analysis follows five steps.

1. Scoping and data flow mapping. Map every payment channel (online, telephone, face to face) and trace where card data enters, moves, is stored and leaves. Check how segmentation separates the cardholder data environment (CDE) from everything else. This step often finds card data where nobody expected it: call recordings, inboxes, spreadsheets, log files or old backups. Our PCI DSS scoping guide explains the method.
2. Documentation review. Policies, procedures, diagrams, the asset inventory, and the roles and responsibilities that v4.0.1 expects for every requirement area. Targeted risk analyses need particular attention.
3. Technical control review. Sampling of configurations and evidence: firewall rules, hardening standards, MFA coverage, logging, scan results, penetration test reports and encryption settings.
4. Interviews and walkthroughs. Short conversations with administrators, developers, the service desk and anyone who handles card data, plus a walk round data centres, call centres and card storage areas.
5. Report and roadmap. A rating for each requirement, an explanation of each gap and a prioritised plan to close it.

How long does a PCI gap analysis take?

It depends on scope more than anything else. Use the table as a guide to what drives the effort.

Preparation shortens it. Have network and data flow diagrams, an inventory of CDE systems, your policies, recent scan and penetration test reports, and your providers’ Attestations of Compliance ready before the work starts.

What do you get at the end?

• A confirmed scope statement with data flow diagrams.
• A requirement-by-requirement gap report.
• A prioritised roadmap with owners and realistic dates.
• A view on which validation route fits (SAQ type or ROC).
• Early notice of any control that may need a compensating control or the customised approach.

Gap analysis, PCI readiness assessment or formal assessment?

The three sit at different points in the cycle. A gap analysis comes first, a PCI readiness assessment (often called a readiness review) checks the fixes, and the formal assessment validates.

For a first assessment, or after major change such as a new payment platform or a merger, both a gap analysis and a readiness review are worthwhile. A mature, stable environment may only need a lighter annual review.

Can you do a PCI gap analysis yourself?

Yes. A trained Internal Security Assessor (ISA), or a careful compliance lead working from a PCI compliance checklist, can produce a useful result. An external QSA company adds independence and a clear view of how assessors interpret the requirements. That matters most for scope, segmentation and the judgement-based parts of v4.0.1, such as targeted risk analysis.

If one firm both advises you and later assesses you, ask how it keeps the two separate. The PCI SSC sets independence rules for QSA companies, and a good provider will explain how it follows them.

How much does a PCI DSS gap analysis cost?

The price depends on the same things as the effort: the number of payment channels, sites and systems in scope, whether you are a merchant or a service provider, and how much documentation already exists. A narrow scope costs far less to review. Our guide to PCI compliance cost shows how a gap analysis fits into the total budget alongside testing and assessment.

What happens after the gap analysis?

Sequence the remediation so the most important work starts first.

• Fix real risk first: unencrypted stored card data, missing MFA, exploitable vulnerabilities and segmentation that does not hold.
• Start long-lead items early: replacing unsupported systems, deploying script monitoring on payment pages, or renegotiating a provider contract.
• Reduce scope where you can: tokenisation, hosted payment pages and point-to-point encryption can remove whole systems from scope.
• Handle legacy constraints properly: where a genuine constraint exists, a documented PCI DSS compensating control may be acceptable.
• Build business-as-usual habits: six-monthly reviews, automated log review and annual risk analyses need owners and a calendar.

Where the roadmap needs technical proof, our PCI DSS penetration testing covers the internal, external and segmentation tests in Requirement 11.4, and our vulnerability scanning services cover authenticated quarterly scans. Our PCI DSS compliance roadmap template shows how to turn findings into a timed plan.

Working with a QSA company

Sovereign Secure is a PCI SSC-approved Qualified Security Assessor, Qualified PIN Assessor and Card Production Security Assessor company, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. We run gap analyses and readiness reviews for merchants and service providers, and carry out the formal PCI compliance audit when you are ready. To scope a gap analysis, contact us with your payment channels and your validation route, SAQ or ROC.