Most findings are not exotic. They are the same dozen things, in different companies, and most of them are cheaper to fix before the assessment than to argue about during it. Here they are, with what closes each one.
1. The scope documents disagree with each other
Two documents, two operating systems for the same servers; a critical-software list that omits the main application. What closes it: one dated inventory, one owner, every system in one of three places, and a rule that anything not on the list is in scope.
2. The control was defined last week
Six versions of a standard in the last four days of the assessment. A policy can show a control is defined. It cannot show it operated during the period. What closes it: fix the configuration first, let it run, then write the document, and submit one current version.
A policy can show a control is defined. It cannot show it operated during the period.
3. One record for a recurring process
A single quarterly review, or a screenshot of a document’s cover page, as evidence of a process that is supposed to run all year. What closes it: several dated records, with a name on each, ideally not identical.
4. Data kept longer than the policy says
The policy says thirteen months after the last payment. The database says thirteen months after the card expires. Settlement files kept a year when ten days would do. What closes it: run the query yourself, align the system with the policy or the policy with a real justification, and purge.
5. A service nobody approved is listening
A process on every interface of a worker node, listed in the company’s own inventory as “must be disabled”, with the finding closed by a firewall rule. What closes it: the service disabled in the image, shown on a running node. Blocking traffic is a different requirement.
6. Segmentation that the cloud default undid
A peering plus a default allow rule, and two untrusted networks reach the cardholder environment on every port, including the testing firm’s own. What closes it: override the default, then test from each out-of-scope network.
7. One shared administrator account
At a colocation provider, one administrator account for everyone, and video footage nobody could attribute. What closes it: one account per person, and a log that says who.
8. Multi-factor authentication on most paths
It is enforced on the VPN and not on the console, or on the console and not on the management API. What closes it: a list of every path into the environment, with the authentication control named for each, and login records showing the prompt for each.
9. A payment page with a weak content security policy
A policy that allows inline scripts has given up most of its protection. On an outsourced payment page the merchant’s one job is the integrity of the page that hands the customer over. What closes it: a policy that names its sources, and a mechanism that notices when the page changes.
10. The provider’s attestation does not cover what you buy
An attestation that lists every call-centre site but yours. An acquirer whose attestation excludes the terminals it leases you. What closes it: read the scope section, match it to the contract, and agree a responsibility matrix in writing.
11. Secrets sent over chat
VPN certificates and their private keys sent to users in a chat channel, where they stay forever. What closes it: a secure channel for secrets, and a check that the chat history has been cleaned.
12. Default passwords in the supplier’s manual
An installation manual that prints the terminals’ administrator password and the download password. What closes it: change them on day one, and ask the supplier, one requirement at a time, what its attestation actually covers.
What people get wrong
They treat each finding as a technical surprise. Almost every one of these is about ownership, recurrence or a document that nobody compared with reality.
They remediate and document in the same week, then wonder why the assessor asks for history.