Ask for a walkthrough
Menu

The platform

Where you stand on every requirement.

The platform checks your cloud accounts against PCI DSS v4.0.1, holds the evidence a cloud account cannot show, and files both by requirement.

It observes configuration. It does not alter it.

Ask for a walkthrough

Normatiq does not perform PCI DSS assessments or issue Reports on Compliance. Your QSA does.

Readiness by requirement · PCI DSS v4.0.1Example
12.5.2PCI DSS scope is documented and confirmed every 12 monthsScope confirmed by you on 2 Sep 2026 · 14 systems in scope, 3 connectedIn place
8.4.2Multi-factor authentication (MFA) for all non-console access into the cardholder data environment3 accounts without itNot in place
11.6.1Changes to payment pages are detected and reportedNeeds evidence from youNot checked
Wording paraphrased from PCI DSS v4.0.11 in place · 1 not in place · 1 not checked
Covers todayPCI DSS v4.0.1
Cyber Essentials v3.3 (April 2026)
Connects toAmazon Web Services, Microsoft Azure, Google Cloud, Alibaba Cloud
Built byA practitioner who has led PCI DSS assessments since 2018

1 · Scope

Get scope right first.

The platform sorts your systems into three groups and draws them as a diagram. You confirm the scope and your QSA validates it.

Three scope mistakes an assessor sees most in firms on a cloud

  • Connected systems left out. Admin access, deployment tooling, logging and identity are in scope even when no card data passes through them.
  • The cloud provider assumed to cover it. Its attestation covers its own part, not how you set up your accounts.
  • Segmentation claimed but not tested. The separation has to be tested.
Scope · PCI DSS v4.0.1Example
In scope14
  • payments-api
  • card-vault
  • tokeniser
  • and 11 more
Connected3
  • admin access
  • deploy pipeline
  • log store
Out of scope22
  • marketing site
  • data warehouse
  • and 20 more
Cardholder data environmentConnectedOut of scopeadmin accessdeploy pipelinelog storepayments-apicard-vaulttokeniserand 11 moremarketing sitedata warehouseand 20 more

2 · Each requirement

What it cannot check, it says.

Every result is tied to a numbered PCI DSS v4.0.1 requirement.

  • In place

    What the platform found matches what the requirement asks for. Your QSA still tests it.

  • Not in place

    It found something that falls short, and says what.

  • Not checked

    It could not check this from your cloud accounts. It says so, and never shows it as a pass.

Readiness by requirement · PCI DSS v4.0.1Example
12.5.2PCI DSS scope is documented and confirmed every 12 monthsScope confirmed by you on 2 Sep 2026 · 14 systems in scope, 3 connectedIn place
1.2.5Allowed services, protocols and ports are identified and approved2 open ports with no recorded approvalNot in place
8.4.2Multi-factor authentication (MFA) for all non-console access into the cardholder data environment3 accounts without itNot in place
10.4.1.1Audit logs are reviewed by automated meansReviews running dailyIn place
11.6.1Changes to payment pages are detected and reportedNeeds evidence from youNot checked
Wording paraphrased from PCI DSS v4.0.12 in place · 2 not in place · 1 not checked

3 · Your own evidence

The paperwork, in one place.

Some requirements are met on paper, by people or in a building: the security policy (12.1), awareness training (12.6), physical access (requirement 9), the incident response plan (12.10). The platform holds those documents under the requirement they answer.

12.6.3 · PCI DSS v4.0.1Example
What it asks for
Security awareness training for all personnel, on joining and at least once every 12 months
From your cloud accounts
Nothing a cloud account can show
Added by you
Awareness training policy. Attendance record, September 2026

4 · The hand-over

Evidence your QSA can follow.

Evidence for the systems in your scope, filed so an assessor can find each item under its requirement.

Your QSA still chooses what to test, tests it, and decides what to accept. The platform does not replace that judgement and does not write the report.

Evidence by requirement · PCI DSS v4.0.1Example
12.5.2From your cloud accountsAdded by youIn place
1.2.5From your cloud accountsAdded by youNot in place
8.4.2From your cloud accountsAdded by youNot in place
10.4.1.1From your cloud accountsIn place
11.6.1Waiting for your evidenceNot checked

Standards

What it covers today.

On Amazon Web Services, Microsoft Azure, Google Cloud and Alibaba Cloud.

Today

PCI DSS v4.0.1

PCI DSS readiness
Today

Cyber Essentials v3.3 (April 2026)

Cyber Essentials readiness
Planned extensions
  • ISO/IEC 27001:2022
  • SOC 2
  • NIST Cybersecurity Framework 2.0
  • SWIFT Customer Security Controls Framework
  • ASD Essential Eight
  • SAMA Cyber Security Framework
  • CMMI
  • CyberFundamentals
  • BSI C5
  • NIS2
  • DORA
Other standards

The limits

What it does not do.

  • Assess you

    Your QSA does.

  • Change your accounts

    It observes. It does not alter.

  • Decide what is accepted

    Your QSA tests the evidence and decides.

  • Certify you

    For Cyber Essentials, a certification body does.

See it on your own case.

Ask for a walkthrough and we will show you the platform against a scope like yours.

Ask for a walkthrough

The button opens an email to info@normatiq.io.