PCI DSS Assessments

Who comes to us for this

Merchants and service providers whose acquirer, scheme or customers ask for a Report on Compliance: payment platforms, e-commerce companies, processors, contact centres, and businesses whose transaction volume has just pushed them off the self-assessment path. Some have done this many times. Some are on their first, and the first is the one where who you choose matters most.

What we do

One QSA, from scope to signature

1. 01 · Prepare

   What are we assessing?

   1. Scoping

      Agree what is in scope, and why.

   2. Readiness

      Answer each requirement in plain language, with evidence.

   You describe, your QSA validates

2. 02 · Assess

   Where do we stand?

   1. Gap analysis

      Each requirement tested; gaps raised as findings.

   2. Remediation

      Findings worked to closure, together.

   Your QSA tests, you close the gaps

3. 03 · Report

   Write it up.

   1. Reporting and QA

      Report on Compliance and Attestation of Compliance, quality-reviewed before signature.

   Your QSA writes and signs

One continuous record

1. Answers
2. Evidence
3. Determinations
4. ROC & AOC

1. Scope first.

   Before any requirement is assessed, we confirm the scope with you: every system in one of three places, the data flows, the segmentation controls named as the console names them, and the third parties with their responsibilities written down. A scope you stand behind is the one the report is written on.

2. Evidence, asked once.

   Each piece of evidence is requested once, linked to every requirement it serves, with a one-line description of what good looks like. You submit it through the software we built for this, and we review it against the request, in minutes when it matches and with a precise note when it does not.

3. On site and remote.

   Interviews, observation and testing of the controls that cannot be read from a file: the physical controls, the administrators’ screens, the processes that are supposed to be known and in use.

4. Findings as they are confirmed.

   You hear about a finding when your QSA confirms it, with exactly what would close it, not in the report. Remediation rounds are agreed, with a cut-off. A concluded report with a clear plan is a better finish for both of us than another open round.

5. Quality review, then signature.

   Before issuing, the report goes through our pre-issue review, which can and does change determinations, sometimes against you. Then the QSA who scoped the engagement signs the Report on Compliance and the Attestation.

What we will not do