PCI DSS Compliance Roadmap: A Five-Phase Template

A PCI DSS compliance roadmap breaks the standard into five phases: scoping, gap analysis, remediation, assessment and maintenance. Each phase has an owner, a deadline and a set of outputs your assessor will later ask to see. A merchant with a simple, outsourced setup can work through it in weeks; a first Report on Compliance (ROC) programme commonly takes several months. Download the roadmap template (Excel, free, no sign-up) to give every task an owner and a deadline.

Most PCI DSS programmes that go wrong do not fail on technology. They fail because nobody owned the timeline, scope was drawn too late and evidence was gathered in a rush the week before the assessor arrived. A written PCI compliance roadmap prevents all three. This template reflects PCI DSS v4.0.1, the current version. The future-dated requirements introduced in v4.0 became mandatory on 31 March 2025, so treat them as baseline, not extras.

Key takeaways

• A PCI DSS roadmap has five phases: scoping, gap analysis, remediation, assessment and maintenance.
• Scoping comes first because every later cost depends on the size of your cardholder data environment.
• Confirm your validation route (ROC or SAQ) with your acquirer early, as it sets the depth of the work. Our free PCI compliance check suggests your likely SAQ before that conversation.
• All of v4.0’s future-dated requirements have been mandatory since 31 March 2025.
• Plan to collect evidence all year, not in a scramble before the audit.

What are the phases of a PCI DSS compliance roadmap?

The five phases run in sequence, although maintenance tasks start as soon as each control is in place.

A good roadmap does three jobs. It tells the board what compliance will cost and when it will be done. It gives every control an owner, so nothing falls between IT, finance and operations. And it builds a trail of evidence as you go, which is what a Qualified Security Assessor (QSA) will ask to see.

Phase 1: how do you scope PCI DSS?

Map every place cardholder data enters, moves through and leaves the business: websites, payment pages, telephone channels, call recordings, email inboxes, back-office systems and third parties. By the end of this phase you should have:

• Current network and data flow diagrams (Requirements 1.2.3 and 1.2.4)
• An inventory of in-scope system components (Requirement 12.5.1)
• A list of third-party service providers and what each one does for you (Requirement 12.8.1)
• A decision on whether you will use segmentation to reduce scope

Scoping is where most of the savings are. If a system does not need to touch card data, move it out of the cardholder data environment (CDE) and prove the separation. Requirement 12.5.2 also makes scoping a recurring task: you must confirm scope at least every 12 months and after significant change. Our PCI DSS scoping guide covers the method in more detail.

Phase 2: what does a PCI DSS gap analysis involve?

A gap analysis compares your current controls with each applicable requirement. For each gap, record the requirement, the current state, what is missing, the owner, the estimated effort and the cost. Our PCI compliance checklist lists every v4.0.1 requirement with the evidence assessors expect, which makes a practical starting point.

Confirm your validation route here too. Your PCI compliance level decides whether you need a ROC from a QSA or can complete a Self-Assessment Questionnaire (SAQ), and the SAQ type decides which requirements apply. Your acquirer has the final say, and our guide to which PCI SAQ you need explains the options.

A gap analysis run by an experienced PCI DSS consultant shows you how an assessor is likely to read your controls before it matters, and gives the board a costed plan rather than a list of worries.

Phase 3: what should you remediate first?

This is usually the longest phase. Work in this order:

1. Reduce scope. Tokenisation, validated point-to-point encryption (P2PE) and outsourced payment pages can remove whole systems from the CDE. Every system you remove is one you do not have to remediate.
2. Fix high-risk technical gaps. Unsupported software, missing multi-factor authentication, weak segmentation and unencrypted stored card numbers come first.
3. Close process and documentation gaps. Policies, defined roles and responsibilities for each requirement, and targeted risk analyses.

Several former future-dated requirements catch people out:

• Targeted risk analyses for any requirement where you set the frequency (12.3.1); see our targeted risk analysis template
• MFA for all non-console access into the CDE, not just remote access (8.4.2)
• Authenticated internal vulnerability scanning (11.3.1.2)
• Automated mechanisms for audit log review (10.4.1.1)
• Passwords of at least 12 characters where systems support it (8.3.6)
• Anti-phishing mechanisms and awareness training on phishing and social engineering (5.4.1 and 12.6.3.1)
• Payment page script management and tamper detection for e-commerce (6.4.3 and 11.6.1)

Build the evidence library as you go: configuration exports, change tickets, log review records, training records and approved policies. Label each item with the requirement it supports.

Phase 4: what happens at the PCI DSS assessment?

Book your QSA early, as good assessors are busy in the months before common compliance deadlines. A short readiness review a few weeks before fieldwork is worth the time, because it finds missing evidence while there is still time to produce it.

Before fieldwork, make sure you have the technical testing results the assessor will need:

• Quarterly internal vulnerability scans, and quarterly external ASV scans by a PCI SSC Approved Scanning Vendor
• Annual internal and external PCI DSS penetration testing, plus segmentation testing if you rely on segmentation
• Remediation evidence and rescans for anything found

During fieldwork the QSA interviews staff, samples systems and reviews evidence. The output of a PCI compliance audit is a ROC and AOC. SAQ merchants complete the SAQ and AOC themselves and submit them to their acquirer; our guide on how to fill out a PCI SAQ covers the mistakes to avoid. The common PCI audit failures are worth checking against your evidence before fieldwork starts.

Phase 5: how do you stay compliant after sign-off?

PCI DSS expects security to be business as usual. In practice that means a compliance calendar with named owners:

Service providers have extra duties, including segmentation testing every six months and quarterly reviews confirming that staff are following security policies. Our guide to PCI DSS business as usual sets out the full year-round calendar.

How long does PCI DSS compliance take?

A merchant with a fully outsourced e-commerce checkout that is eligible for SAQ A may need only a few weeks. A first ROC programme commonly takes several months, and longer where remediation means redesigning networks or replacing systems. What moves the timeline most:

Whatever your size, build in contingency before the assessment date. Late scans, a missing third-party AOC or an unapproved policy can delay sign-off by weeks.

How does the roadmap change for your environment?

Cloud and third parties

Cloud providers secure their own infrastructure, but you remain responsible for how you configure and use their services. For each provider, get a clear responsibility matrix (Requirement 12.8.5) and a current AOC. Add renewal dates for those documents to your calendar, because an expired AOC is a common finding.

Customised approach

Version 4.0 introduced the customised approach, which lets you meet a requirement’s objective with your own control design. It is only available to entities assessed through a ROC, and each customised control needs a documented targeted risk analysis (12.3.2) and extra testing by the QSA. Use it where a defined requirement genuinely does not fit your technology, not as a shortcut.

Other frameworks

If you also hold or plan ISO 27001 or Cyber Essentials, map the overlap. Access control, patching, logging and incident response evidence can often serve more than one framework, which reduces duplicated effort.

What should you budget for?

Budget for four things: external help (consultancy, the QSA assessment, scans and penetration tests), remediation (new tools, hardware or development work), internal staff time, and the recurring cost of maintenance each year. Scope drives all four, which is why phase 1 matters so much. Our guide to PCI compliance cost explains how each factor changes the price.

Can I download the PCI DSS roadmap template?

Yes. Download the PCI DSS compliance roadmap template (.xlsx), free to use and adapt within your organisation. It turns this guide into a working plan:

Keep it with your evidence library, so the plan and the proof stay together.

Getting started

The most useful first step is a scoping and gap analysis exercise, because it tells you how big the job is before you commit budget. Sovereign Secure is a PCI SSC-approved QSA company. Our PCI DSS consultancy team can build and run the roadmap with you, and our QSAs can carry out the formal assessment when you are ready, within PCI SSC independence rules. If you are based in Britain, our guide to PCI compliance in the UK explains what acquirers here expect.