PCI DSS applies to any business that handles card data, with checks all year. Thiqa’s agent maps the requirements, collects the evidence and keeps your SAQ or ROC ready.
Most PCI effort goes into systems that were never in scope. The agent traces where card data flows, marks in-scope and connected systems, and builds your requirement list from there.
12
requirements under six goals in PCI DSS v4.0.1. Each one gets an owner in Thiqa.
PCI never stops asking: quarterly scans, periodic access reviews, targeted risk analyses. The agent collects each one on time and flags anything missing before it becomes a finding.
Every 3 months
external vulnerability scans must pass. Thiqa tracks each one and the rescans after it.
No last-minute scramble. The agent drafts the policies PCI requires, links each to its requirement and evidence, and builds the package for your SAQ or your QSA. You approve every line.
v4.0.1
the current version of the standard. Its future-dated requirements became mandatory on 31 March 2025.
Read the new CBE requirements, pull out every obligation and route it to the controls it applies to.
Much of PCI DSS overlaps with other security frameworks. Thiqa shows what you’ve already covered, so the next one starts ahead.
The Payment Card Industry Data Security Standard: the security requirements for any organisation that stores, processes or transmits payment card data. The PCI Security Standards Council maintains it, and the card brands and acquiring banks enforce it.
It depends on your transaction volume and how you handle card data. Most smaller merchants complete a Self-Assessment Questionnaire (SAQ). The largest merchants and most service providers need a Report on Compliance (ROC) from a Qualified Security Assessor. Your acquirer confirms which applies.
No. A QSA still performs your assessment. Thiqa does the preparation: scoping, requirement mapping, evidence collection and policy drafting, then gives your assessor organised, read-only access so the assessment runs faster.
No. Your data is never used to train models, and the agent works inside a secure sandbox. It never needs card data either: Thiqa collects evidence about your controls, not cardholder records.
Yes. Many PCI requirements map to ISO 27001 Annex A controls. Thiqa maps each control once and shows where it counts for both, so the second framework starts with evidence you already have.
