PCI Gap Analysis — Guide

PCI DSS has 12 high-level requirements and over 300 sub-controls. Tracking your compliance status across all of them — and knowing which gaps are blocking your acquirer application — requires a structured approach. This tool provides a complete checklist of all PCI DSS v4.0 requirements with status tracking, filtering by requirement domain and compliance goal, and CSV export for pre-audit workbooks.

It is designed for engineering leads and compliance teams working towards their first formal PCI DSS assessment, or managing ongoing compliance between annual QSA audits.

1. The five stat cards at the top show totals for Compliant, Partial, Gap, Not Started, and Not Applicable requirements.
2. Focus on the Gap and Not Started counts first — these are the items blocking PCI compliance.

1. Use the status filter chips to show only Gap items — this gives you your remediation backlog.
2. Use the requirement number filter (1–12) to focus on a specific PCI domain (e.g. Req 8 for identity, Req 10 for logging).
3. Use the goal filter to group requirements by their underlying security objective.

1. Click any requirement row to expand it and see the full control description.
2. Use the status dropdown to update the requirement's current state: Compliant, Partial, Gap, Not Started, or Not Applicable.
3. Add notes to record your implementation details or evidence location.

1. Click Export CSV to download all requirements with statuses and notes.
2. Share with your QSA as a pre-audit workbook to accelerate the formal assessment.