Consulting
Compliance Consulting
The calendar, the evidence process, the owners and the policies that make every assessment calmer than the last. And the work PCI taught us to do that has nothing to do with a ROC.
Who comes to us for this
Organisations that have passed an assessment and never want the last six weeks of it again. Teams whose evidence lives in a mailbox and whose controls decay between audits. Companies writing a policy framework for a regulator, a scheme or a large customer. And organisations that will never file a Report on Compliance but need the kind of judgement PCI taught us: a payment system’s cryptographic architecture, a PIN and key-management design, a regulator’s reading of strong customer authentication.
What we do
The programme.
Starting from your scope and how your organisation actually runs, not from a template: a calendar of every periodic activity with an owner and a record per line; an evidence process where each item is asked once and linked to every requirement it serves; one named owner per control; the targeted risk analyses that set your frequencies; a change process that defines “significant” in advance.
Policies you will be able to evidence.
Short, specific and boring: patch timelines by severity with an exception process, a scanning schedule with a rescan after change, review dates that are kept. Written to pass an assessor, a customer and a regulator, because all three ask the same question in the end.
Governance.
Where risk decisions are taken, who signs an exception, how sites or subsidiaries are given a role and the credit for it. Most open findings are about ownership, not technology, and this is where ownership is decided.
Beyond the card brands.
The same expertise applied further, for organisations that are not in PCI scope at all: cryptographic architecture for a payment or ticketing system, PIN and key-management design, a written opinion on strong customer authentication under PSD2, an independent assessment under SWIFT’s customer security framework. Described in anonymised terms, and we claim no second accreditation for it.
What you do
Give the programme an executive owner. Name the people who will own the controls. Run the calendar. We design it with you and hand it over; we do not run it for you.
What you receive
A programme you can run without us: the calendar, the evidence list, the owners, the policies, the risk analyses. For the work beyond PCI, a written opinion or design review with the reasoning, revised when we find we were too generous.
What we will not do
- Sell you a policy pack with the logo changed.
- Design a programme whose timelines you cannot meet.
- Claim an accreditation we do not hold.
Keep reading
Related knowledge
Compliance Operations3 min read
Audit-ready is a state: the PCI DSS calendar
The assessment looks at the last twelve months, not at the last six weeks. The organisations that find it calm are the ones with a calendar of every periodic requirement, an owner per line, and a record produced each time. Here is the calendar.
Compliance Operations3 min read
Ask once: an evidence process that runs all year
One firewall export serves four requirements. One review record serves three. The evidence process that turns the yearly scramble into a routine is mostly a matter of linking each piece of evidence to everything it proves, and giving it an owner and a date.
Security in practice5 min read
Security is a governance decision
The turning point in a two-year security programme was not a product. It was the day risk decisions moved to the executive committee. Why most open findings are about ownership, not technology.
Where it starts
Start with what hurts most.
A conversation with a QSA about the assessment, the evidence, the policies, or a question nobody in your organisation can answer. Then a proposal scoped to that.
Talk to a QSAOr reach us directly
- +353 1 691 79 38
Dublin
- info@247cyberlabs.com
Read and answered by a QSA, not by a sales desk.