Advisory
PCI Advisory
Scope, the right questionnaire, a provider's attestation, a payment flow nobody has seen before. Ask the person who would have to sign it.
Who comes to us for this
A compliance manager whose payment provider has just asked for a questionnaire that does not seem to fit. A merchant whose provider suspended card payments after a breach and wants them back. A Level 1 merchant with a small scope who suspects the full standard is not the right depth. An architect designing a payment flow and wanting to know, before building it, what it will mean for scope. Anyone who has been told something by a provider, an acquirer or a previous assessor and wants to know whether it is true.
What we do
Answer in writing, with the reasoning.
Every question gets a written answer that says what the standard asks, how it applies to your case, and why. If the standard leaves room, we say so and show how we read it. The answer is one you can put in front of your acquirer or your next assessor.
Scope and questionnaire decisions.
Which of the three places each system is in. Which questionnaire fits, in what capacity, channel by channel. Whether a Report on Compliance can focus on the requirements that actually apply, and how to ask the acquirer.
Provider attestations and responsibility matrices.
What a provider’s attestation actually covers, read against the service you buy. The letter of questions to the provider, one requirement at a time. The responsibility matrix, agreed in writing before the first assessment.
After a breach.
For merchants whose provider has cut them off: the minimum set of controls to put in place, the rebuild, the verification, the questionnaire released only when it is true, and help getting the hosting provider to do its part.
Before a design.
The scope consequences of a payment flow, an integration or a cloud architecture, before it is built, when they are cheap to change.
What you do
Ask the question with the facts: how you take payments, who is asking, what the provider said. Decide. We advise; we do not make the decision for you, and we do not implement it.
What you receive
A written answer you can forward. Where it applies, a scope note, a questionnaire recommendation with the reasoning, a letter to the provider, or a responsibility matrix.
What we will not do
- Sign a questionnaire that does not describe what you do.
- Tell you what you want to hear because the provider is in a hurry.
- Pretend the standard is clear-cut where it is not.
Keep reading
Related knowledge
PCI DSS4 min read
Choosing the right SAQ
Ask two questions before you pick a questionnaire. In what capacity do you handle the payment, and what actually touches the card? Four engagements where the obvious answer was the wrong one, in both directions.
PCI DSS5 min read
Your provider's AOC is not your compliance
An Attestation of Compliance that covers every call centre except yours. An acquirer whose AOC excludes the terminals it leases you. A request for "an AOC for the vendor's domain". Why the annual AOC chase goes wrong, and what to check instead.
PCI DSS4 min read
Where the standard isn't clear-cut: requirement 3.4.2
Administrators reach card-data databases over SSH, and the standard says they must not be able to copy card numbers out, unless they are authorised. We have used that exception, and we are not comfortable with it. Here is our reasoning, and where we are unsure.
PCI DSS4 min read
When your payment provider cuts you off
Three online shops, all legitimately on SAQ A, all skimmed. The provider sees transactions drop, suspends card payments and sends the merchant to a QSA. What happens next, and why an upgrade is usually the whole fix.
Where it starts
A QSA on the phone, usually the same week.
Advisory is priced by the question or by the month, in writing, after we understand what is being asked.
Talk to a QSAOr reach us directly
- +353 1 691 79 38
Dublin
- info@247cyberlabs.com
Read and answered by a QSA, not by a sales desk.