PCI DSS readiness
If you take card payments, PCI DSS is the standard your acquirer expects you to meet. The useful first step is usually to shrink where card data is allowed to exist, then close the gaps that remain. We do that work in the application and the surrounding systems. A qualified security assessor issues a formal report of compliance when one is required. We do not.
Typical engagement
How it starts
A written scope
A formal report
Issued by a qualified assessor
What's included
6 capabilities
- Scoping of where cardholder data is stored, processed, or transmitted
- A plan to reduce that scope where the business allows it
- Gap assessment against the requirements that still apply
- Remediation: access, logging, encryption, segmentation, and change management
- Evidence collected for the assessment path your acquirer requires
- Coordination with your payment vendors where they sit in the flow
Every project ships with Gap report, Evidence index, A clear handover.
Scope first, then controls
PCI projects go wrong when every server is treated as in scope. We start by tracing where a card number can actually land. If a hosted checkout or tokenization can take your systems out of that path, that is the recommendation.
What remains gets the unglamorous work: who can reach it, whether the network is segmented, whether changes are tracked, and whether logs exist. The written scope says which of those apply before we start.
What you walk away with
You get a map of where card data can land, a written decision on what can be taken out of scope, a gap report for what remains, and the remediation that was finished. The evidence index matches the path your acquirer actually requires, whether that is a self-assessment or a formal report.
We do not copy card numbers into our environment. A formal report of compliance, when one is required, is issued by a qualified security assessor. We prepare the systems and sit with your team through that work. We do not issue the report.
Payment vendors stay in the picture when they sit in the flow. The scope names them. If a hosted checkout would do more than a control project, that is the recommendation, and we will say so before you spend the quarter on the wrong work.
Questions
Common questions
- Do you issue the PCI report?
- No. When a formal report of compliance is required, a qualified security assessor issues it. We prepare the systems and the evidence and coordinate the work.
- Can we get card data out of our systems?
- Often, yes. Using a hosted payment page or a tokenization setup can shrink the scope dramatically. We will say when that is the better project, and when you still have systems that must meet the requirements.
- Is this a self-assessment or a full audit?
- That depends on how many transactions you process and how your acquirer classifies you. We will not guess. The written scope names the path they are asking for.
- What do we get at handover?
- A gap report, the remediation that was completed, an evidence index, and documentation your team can keep. The assessor's report, if one is required, comes from the assessor.
- Do you store card numbers while you work?
- No. We do not copy cardholder data into our environment. Access to your systems is scoped, logged, and removed at handover.
Other services
Looking for something else? Each of these can stand alone, or combine with the work on this page.
- SOC 2 readinessWe prepare your application for a SOC 2 examination and stay on as the liaison. A licensed CPA firm issues the report.
- HIPAA readinessWe prepare the systems a small healthcare company needs ready for a HIPAA review: access, logging, backups, and the evidence to show it.
- ISO 27001 readinessWe prepare the security management system and the evidence. An accredited certification body issues the certificate, not us.
- Compliance readinessSOC 2, HIPAA, PCI DSS, and other frameworks. We prepare your application and coordinate the examination.
Your acquirer asking about PCI?
Tell us how you take cards, and we will outline what is in scope.