Assessment
PCI Gap Assessments
Find the gaps while they are cheap, from the same QSA who would assess you afterwards.
Who comes to us for this
Organisations facing their first Report on Compliance. Teams that inherited an environment, a questionnaire or a provider’s promise and want to know what is true. Companies that have been self-assessing for years and suspect the questionnaire no longer describes them. And anyone who would rather hear “fifteen things, here they are” from us in spring than from an assessor in autumn.
What we do
Scope, before anything else.
The same exercise as in a formal assessment: every system in one of three places, the flows, the segmentation controls, the third parties. Most of the findings in a first assessment are scope findings, and they are the cheapest to fix early.
Requirement by requirement, against evidence.
Not a questionnaire you fill in. We look at the configuration, the records and the people, the way an assessor would, and we write each gap as the assessor would write it: what is missing, what good looks like, what closes it.
A plan ordered by what matters.
Findings grouped by what changes them, a firewall rule, a process, a document, an owner, and ordered by risk and effort, so that the first month of remediation closes the most.
The calendar.
The periodic activities the standard expects, with owners and dates, so that by the time of the formal assessment there are months of records rather than weeks.
What you do
Give us access to the systems and the people, not a folder of policies. Own the findings by name. Start the calendar the day you receive the plan.
What you receive
A scope document you can reuse. A findings register written in assessment language, with what closes each. A remediation plan with order and effort. The evidence list for the formal assessment, with what good looks like against each line.
What we will not do
- Tell you that you are ready when you are not.
- Soften a gap because the formal assessment is also ours.
- Write the gap assessment as a sales document for the next engagement.
Keep reading
Related knowledge
PCI DSS3 min read
The findings we raise most often, and what closes each
Twelve findings from real assessments, none of them exotic. For each one, what it looks like in the room and the one thing that closes it.
Security in practice3 min read
Scope and inventory come first
Nothing can be assessed or protected until you know what is in scope. Three engagements, three different ways to get that wrong.
Compliance Operations3 min read
Audit-ready is a state: the PCI DSS calendar
The assessment looks at the last twelve months, not at the last six weeks. The organisations that find it calm are the ones with a calendar of every periodic requirement, an owner per line, and a record produced each time. Here is the calendar.
Where it starts
Start with where you are.
A conversation with a QSA about where you are, what is asking for the report and when. Then a proposal scoped to your environment, not to a template.
Talk to a QSAOr reach us directly
- +353 1 691 79 38
Dublin
- info@247cyberlabs.com
Read and answered by a QSA, not by a sales desk.