Governance, Risk & Compliance
A PCI DSS compliance consultant in India earns their fee in the first fortnight, and not by writing policy. They earn it by working out exactly which systems store, process or transmit cardholder data, and how many of them do not need to. Every system you remove from scope is a system you never have to harden, monitor, patch on a clock or evidence for a year.
Worth saying plainly: we are not a Qualified Security Assessor. A Report on Compliance is signed by a QSA, and for most merchants a Self-Assessment Questionnaire is signed by you. Our work is everything on either side of that signature: establishing scope, reducing it, closing the gaps, and building the evidence so the assessment is a review rather than a discovery exercise.
Version 4.0.1 is the standard in force; v3.2.1 was retired in March 2024, and the requirements that were future-dated became mandatory on 31 March 2025. If your last assessment was against v3.2.1, the delta is real, particularly around scripts on payment pages, authenticated scanning and the new targeted risk analyses. Where the same estate also needs penetration testing, PCI DSS mandates it, so the two should be planned together rather than bought twice.
Why you need it
01 / 06Requirements apply to the cardholder data environment and to anything connected to it. Tokenising, redirecting payment pages to the provider, and segmenting what remains can move an assessment from hundreds of systems to a handful. Nothing else you do will save as much.
If you assert that a network is out of scope, that assertion is tested: annually for merchants, twice yearly for service providers. A firewall rule you believe in is not evidence. A segmentation test that tries to cross the boundary and fails is.
Requirements 6.4.3 and 11.6.1 mean the scripts loaded on a payment page must be inventoried, authorised and monitored for unauthorised change. This is a direct answer to digital skimming, and it is the requirement most e-commerce teams discover late.
Where a requirement genuinely cannot be met, a compensating control has to meet the intent, exceed the rigour of the original, and be documented in a worksheet the assessor accepts. It is a legitimate route and a slow one. Far better to design the requirement out.
Instrument
02 / 06Most organisations meeting PCI DSS are already doing two thirds of it for another framework. This shows the overlap before you fund a second programme.
What we deliver
03 / 06Where card data enters, where it rests, where it leaves, and every system that touches or can reach it. Delivered as a diagram and an asset inventory you can hand an assessor, not a paragraph of description.
The practical options for your architecture (tokenisation, hosted payment pages or iframes, point-to-point encryption, network segmentation) costed against the assessment effort each one removes. Sometimes the answer is to change the payment flow, and we will say so.
Every applicable requirement assessed as met, partially met or not met, with what is missing and who owns it. Including the requirements that changed in v4.0 and the targeted risk analyses the standard now expects you to have written.
Hands-on work on the gaps: logging and retention, access control and MFA, change management, secure configuration standards, key management, and the file-integrity and script-monitoring controls on payment pages.
Internal and external vulnerability scanning, segmentation testing, and application and network penetration testing to Requirement 11, run by our own testers, with the reproduction steps and the retest.
The evidence pack assembled before the QSA arrives, the SAQ completed correctly for your merchant level and channel, and someone in the room who can answer the assessor without inventing an answer.
How we run it
04 / 06Interviews, network and data-flow discovery, and a review of every payment channel, including the ones nobody mentioned, like phone orders taken on a recorded line.
Weeks 1-2Present the scope-reduction options with the effort each removes from the assessment, and agree the target architecture before any control work starts.
Weeks 2-3Assess the reduced scope against every applicable v4.0.1 requirement and produce the remediation plan, prioritised by assessment risk and by effort.
Weeks 3-5Close the gaps alongside your teams. The long poles are usually logging, key management and the payment-page script controls, so they start first.
Months 2-4Run the scans, the segmentation test and the penetration test, fix what they find, retest, and assemble the evidence pack against each requirement.
Month 4-5Support the QSA assessment or the SAQ, then set the recurring calendar: quarterly scans, annual testing, and the reviews the standard expects between assessments.
Month 5, then quarterlyKey benefits
05 / 06Scope reduction done properly does not just cut the assessment. It permanently removes cardholder data from systems that never had a good reason to hold it, which is a security outcome long after the certificate is filed.
Because the gaps were found and closed by us rather than by the assessor, the assessment becomes a review of evidence that already exists instead of a negotiation about what might count.
Quarterly scanning, change management and access review run on a calendar with named owners, so the next assessment starts from a working system rather than from a scramble.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Standard
Scanning and testing
Segmentation validation
Evidence and monitoring
Mapping
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.