The complete v4.0.1 matrix
Every defined-approach requirement across the twelve requirement families, plus Appendices A1, A2 and A3, regenerated from the official standard with the nested testing procedures retained.
See it in the demoA QSA will ask for evidence on 230 requirementsKnow what they'll find before they do
Collects evidence across your cloud environments, maps it onto every PCI DSS v4.0.1 requirement, and returns a verdict per control written in auditor language, with the gaps, the missing evidence and the workbook already prepared.
Try it
Interactive demo with a completed assessment, no signup, no cloud account
How It Works
Collect, map, assess, evidence.
01
Collect
Short-lived read-only credentials are minted per environment, then roughly 60 evidence categories are swept across every enabled region, network, encryption, identity, logging, threat detection and backup.
02
Map
Evidence is mapped onto the official v4.0.1 matrix: all 12 requirements plus Appendices A1–A3, with nested testing procedures under each defined-approach requirement.
03
Assess
Each in-scope requirement gets a verdict written the way an assessor writes it, citing the specific resources examined and naming exactly what was missing.
04
Evidence
Results land as a seven-sheet workbook, a self-contained HTML report and a saved snapshot you can diff against the next assessment.
What You Can Do
Everything the analyzer does.
Around 60 evidence categories
Network security controls, subnets and flow logs; key management and encryption across disks, object storage and databases; identities, roles, policies, multi-factor devices and credential reports; audit trails, log retention, alarms and metric filters; threat detection, web application firewalls, configuration recording and vulnerability assessment.
See it in the demoIt will not rubber-stamp a control
Configuration alone can never produce an In Place verdict on a policy-level requirement. Those return as Manual Review with the specific documents named, so a passing score means something.
See it in the demoVerdicts in auditor language
Each observation reads the way an assessor writes one, what was examined, what was found, which resource identifiers were involved, so findings can go into a report rather than being rewritten first.
See it in the demoAutomatic scope reduction
Requirements that cannot apply to your environment are marked Not Applicable with a written justification. A fully cloud-hosted estate drops the physical security requirements; no wireless drops the wireless controls.
See it in the demoClarify once, apply everywhere
Type a scope correction on any single requirement and the model identifies every other requirement it affects, updating each with a scope note, rather than making you find them yourself.
See it in the demoInterrogate the raw evidence
Ask questions against what was actually collected and get answers citing exact resource identifiers and field paths. When the cached evidence cannot answer it, a read-only query runs against the live environment.
See it in the demoMulti-account and multi-region
Assess any subset of your accounts, subscriptions or projects in one pass. Every finding is tagged with the environment it came from, and a naming sanity check flags evidence that looks like it came from the wrong place.
See it in the demoWorkbook, report and snapshots
A seven-sheet Excel workbook with status colour coding, a self-contained HTML report that opens without re-collection, and named snapshots that diff into resolved, newly failing and still failing.
See it in the demoBusiness Outcomes
What it changes.
Sooner
Gaps surface months before the assessment window, when there is still time to remediate rather than explain.
Honest
Requirements needing policy evidence are called out as such, so the score reflects real readiness instead of what the cloud API happened to return.
Repeatable
Each assessment is a saved snapshot, so you can show an auditor what changed between periods rather than asserting it improved.
See where you stand against v4.0.1.
Connect a read-only role and the first assessment completes in under ten minutes.