Skip to content

QSA · QPA · 3DS Assessor

SearchFrançais

How we work

How a PCI assessment runs with us

We don’t write the rules. We tell you honestly where you stand against them, and we help you get there. From the first conversation to the signed Report on Compliance: what happens at each step, who does it, and what you receive.

Before we start

  1. 01

    A first conversation with a QSA

    Not a salesperson. We talk through how you take payments, what your acquirer or customers are asking for, and what has been assessed before.

  2. 02

    The right assessment, not the biggest

    Sometimes that is a full assessment and Report on Compliance; sometimes a gap assessment first, or advice on an SAQ. We say which, and why.

  3. 03

    A written proposal

    Scope, phases, deliverables and the QSA who will lead the engagement. We do not publish prices: the cost follows from your scope, so we quote once we understand it.

The engagement, step by step

Five phases in three acts. Each has a clear owner, and each produces something you keep.

One QSA, from scope to signature

  1. 01 · Prepare

    What are we assessing?

    1. Scoping

      Agree what is in scope, and why.

    2. Readiness

      Answer each requirement in plain language, with evidence.

    You describe, your QSA validates

  2. 02 · Assess

    Where do we stand?

    1. Gap analysis

      Each requirement tested; gaps raised as findings.

    2. Remediation

      Findings worked to closure, together.

    Your QSA tests, you close the gaps

  3. 03 · Report

    Write it up.

    1. Reporting and QA

      Report on Compliance and Attestation of Compliance, quality-reviewed before signature.

    Your QSA writes and signs

One continuous record

  1. Answers
  2. Evidence
  3. Determinations
  4. ROC & AOC
Every answer you give is carried forward into the report. Nothing is typed twice.

  1. 01 · Prepare

    Scoping

    You

    Describe your environment in plain language: systems, networks, data flows, locations and third parties.

    Your QSA

    Reviews the scope, challenges what does not hold, and approves it.

    You receive

    An agreed, written scope. It feeds the report directly, so this work is never redone.

  2. 02 · Prepare

    Readiness

    You

    Answer each requirement as a plain-language task and upload the evidence it asks for. Questions that do not apply to your scope are left out.

    Your QSA

    Reviews each task and accepts it or asks for clarification. Accepted means complete, not yet that the requirement is met.

    You receive

    A complete, organised set of answers and evidence.

  3. 03 · Assess

    Gap analysis

    You

    Make the people who own each control available for questions and interviews.

    Your QSA

    Tests each in-scope requirement against your answers and evidence, records a determination, and raises a specific finding wherever something is missing.

    You receive

    A gap report grouped by what closes each item: a decision to take, a control to change, a deliverable to wait for, or evidence to provide.

  4. 04 · Assess

    Remediation

    You

    Work each finding: provide the evidence or make the change, and explain what you submitted.

    Your QSA

    Re-tests each submission and either closes the finding or says exactly what is still missing.

    You receive

    Findings closed one by one. Anything that cannot be fixed in time is recorded as it stands, not papered over.

  5. 05 · Report

    Reporting and QA

    You

    Confirm the entity details the report needs.

    Your QSA

    Writes the Report on Compliance from the same record, puts it through quality review, and signs it.

    You receive

    Your Report on Compliance and Attestation of Compliance, signed by the QSA who scoped the assessment.

What you can count on

We don’t write the rules, and we don’t bend them

The standard is the standard. We tell you honestly where you stand against it, say what would close each gap, and we will not sign what is not true.

The QSA who scopes it signs it

The same QSA leads from the first scoping call to the signature. No hand-over from the people who sell to the people who deliver.

One method, whichever QSA leads

247 CyberLabs holds the accreditation and the quality manual. Every engagement follows the same method and passes the same quality review.

No late surprises

Findings are shared as soon as your QSA confirms them, with exactly what would close each one, rather than saved for the report.

Asked once

Each piece of evidence is requested once and linked to every requirement it supports.

What we need from you

  • A named lead on your side who can make decisions and chase answers.
  • Access to the people who own each control, for questions and interviews.
  • Evidence shared through the engagement workspace we set up, rather than by email.
  • Answers within the timeline agreed in the proposal.

Not every engagement runs every phase

PCI Gap Assessment

Runs Prepare and the gap analysis, and ends with the gap report: a clear view of where you stand before the formal assessment.

About gap assessments

PCI Advisory

On demand, around a specific question: scope, segmentation, or the right SAQ.

About advisory

Want a straight answer about your PCI scope?

Talk to a QSA, not a salesperson. First conversation, real answers.

Talk to a QSA

Or reach us directly

QSAQPA3DS AssessorAuthorised to assess across Europe & CEMEA