PCI DSS Gap Assessment: Template and Method

Gap Assessment Method

1. Confirm merchant vs service provider; brand/acquirer level; candidate SAQ vs ROC
2. Document CHD/SAD flows and CDE + connected-to / security-impacting inventory
3. Select applicability (full DSS vs eligible SAQ question set)
4. Score each requirement or question: In place / Partial / Not in place / Not applicable (with justification)
5. Capture evidence links or mark “missing”
6. Score risk and effort; build a 30/60/90-day remediation plan
7. Re-test critical gaps before assessor fieldwork

Gap Template Columns

Adapt columns to your GRC tool. Keep one row per SAQ question or DSS requirement you are scoring.

How CyberSilo Helps

• CSA gap workflows tied to requirement IDs
• ThreatHawk for Requirement 10 logging gaps
• Scoped gap scans before QSA days

Frequently Asked Questions

Who should run a gap assessment?

Internal owners plus an optional consultant. A QSA may offer readiness work, but ROC fieldwork remains a separate engagement.

How often should we re-run it?

Before each annual validation cycle and after any major CDE or payment-channel change.

Does an SAQ A merchant need a full DSS gap?

No - score the applicable SAQ questions, but confirm eligibility with your acquirer first.

Related PCI Resources

Checklist · Evidence list · Timeline · CDE scoping · 12-requirement hub · Future-dated requirements · Customized Approach · TRA required elements · What is PCI DSS v4.0.1 · SAQ selector