Automate
Software built for the job, used on every engagement.
We built software to take the busywork out of compliance — structured questionnaires, evidence collection, policy management and AI assistance — and we use it on every engagement, so your QSA spends the time on judgement, not paperwork.
What it does
Questionnaires
Every requirement restated as a plain-language task: what good looks like, and exactly which evidence to provide. Questions that do not apply to your scope are left out.
Network security controls
In progressRequirements this task serves — PCI DSS
1.2.31.2.71.3.11.3.2
Step 2 — Upload supporting evidence
2/3 uploadedFirewall ruleset export Required
fw-rulesets-2026-09.pdfEvidence for: 1.3.1, 1.3.2 + 1 more
Last six-monthly ruleset review Required
ruleset-review-sep.pdfEvidence for: 1.2.7
- Upload
Network diagram showing CDE boundaries Required
What “good” looks like
- Every rule has a documented business justification
- The last review is dated within six months
Evidence collection
Evidence is requested once and linked to every requirement it supports, then reused across cycles instead of rebuilt for every assessment.
Requested once
Requirements it supports
Firewall rulesets and their last review
1.2.7Network security controls reviewed every six months
1.3.1Inbound traffic to the CDE restricted
1.3.2Outbound traffic from the CDE restricted
System hardening standard
2.2.1Configuration standards maintained
2.2.2Vendor default accounts managed
2.2.4Only necessary services enabled
Signed-off access review
7.2.4User access reviewed every six months
8.2.6Inactive accounts disabled within 90 days
3 requests to your team. 8 requirements supported.
Findings
Each gap is a specific finding tied to its testing procedures. You see exactly what is still needed, and every submission goes straight back to your QSA.
MFA not enforced on all access into the CDE
Assessor’s feedback
Changes requestedWhat’s still needed
1 open · 1 addressed
- 8.4.2.aMFA configuration for every access path into the CDE
- 8.4.2.bLogin records showing MFA prompted for each session
Updated automatically as your assessor re-reviews your submission.
Report readiness
The report is built from the same record, so you can see what is still needed before it is written, quality-reviewed and signed.
3 inputs still needed
14 of 17 ready
On your plate
Entity profile
Partial
With your assessor
Requirements
Partial238 of 251 requirements have a determination (95%)
QA sign-off
Missing
14 inputs ready
ReviewAlso part of every engagement
Policy management
Keep policies and documentation current, versioned and ready for review.
AI assistance
Practical assistance that drafts, checks and explains — reviewed by a QSA, never left to run alone.
The software is part of every engagement we deliver. To see how it would work on yours, start a conversation.
Want a straight answer about your PCI scope?
Talk to a QSA, not a salesperson. First conversation, real answers.
Talk to a QSAOr reach us directly
- +353 1 691 79 38
Dublin
- info@247cyberlabs.com
Read and answered by a QSA, not by a sales desk.