Card payment security
PCI DSS compliance, from scoping to your assessment
We help you meet PCI DSS, the card industry’s security standard, and prepare for the assessment your payment partners require. We map where card data goes, set the scope and help close the gaps.
Who this service is for
Card security questions from your partners
- Your bank or payment provider has asked you to show PCI DSS compliance.
- You aren’t sure which self-assessment questionnaire applies, or whether you need an outside assessor.
- Card data passes through more systems and suppliers than you can account for.
- An earlier assessment or scan left findings that still need fixing.
- You want PCI DSS work to fit alongside DORA or ISO 27001.
What the work achieves
Card data protected and your assessment in order
-
A clear scope for card data
You know which systems, people and suppliers handle card data or can affect it. Keeping other systems out of scope can reduce the work at each assessment.
-
Gaps closed before the assessment
The safeguards, policies and records the standard asks for are in place, and your team knows how they are checked.
-
Evidence your partners can accept
You know which assessment your payment partners require, and the evidence for it is organised for the questionnaire or the assessor.
-
Compliance kept up between assessments
Testing, reviews and updates keep the safeguards working through the year, ready for the next annual assessment.
What we cover
The PCI DSS work we take on
Scoping and card data mapping
We map where card data enters, moves and is stored, and which systems and suppliers can affect it. We recommend ways to keep systems out of scope, such as network segmentation.
Gap assessment against PCI DSS 4.0.1
We compare your safeguards, policies and records with the requirements that apply to you. Together we agree a prioritised plan to close the gaps.
Remediation and policies
We help your IT team put missing safeguards in place, such as access rules, logging and secure settings. We write the policies and procedures the standard asks for.
Assessment preparation
We help you confirm which assessment your payment partners require and choose the right self-assessment questionnaire (SAQ). We prepare the evidence and support your team during the assessment.
Penetration and segmentation tests
Our testers check that the systems handling card data are protected and kept separate from the rest of your network, as the standard requires.
Ongoing compliance
After the first assessment, we review changes, plan the yearly testing and keep the evidence current. A part-time CISO can lead this work through CISO as a service.
How it works
Scope first, then the gaps and the evidence
-
01
Scope
We map card data flows with your team, confirm what your payment partners ask for and agree the scope.
-
02
Assess
We check your safeguards against the requirements that apply and agree a prioritised plan.
-
03
Remediate
We help put the safeguards, policies and records in place, and test that they work.
-
04
Prepare
We organise the evidence and support your team through the assessment your partners require.
- 05
Maintain
Under an ongoing engagement, we keep testing, reviews and evidence up to date between assessments.
What we need from your team
- A list of your payment channels and payment providers.
- Any network diagrams and system lists you already have.
- Owners for the systems, policies and suppliers in scope.
- What your bank or payment provider has asked you to provide.
PCI DSS Compliance
One fixed price, agreed after scoping
We price PCI DSS work as a fixed project once we agree the scope. Your payment channels, the systems in scope and what is already in place set the amount. Ongoing support is priced separately.
We agree the work and price with you in writing before we start.
Common questions
Common questions
Related services
Free 30-minute call
Get ready for your PCI DSS assessment
On a free 30-minute call, we look at your payment channels, what your partners have asked for and where to start.
