PCI-DSS Compliance
PCI-DSS exists because card data is a specific, well-understood target, and the standard reflects that: it's detailed, prescriptive, and unforgiving about scope. Most of the PCI engagements I've worked on didn't fail because a control was impossible to implement — they struggled because nobody had correctly mapped where cardholder data actually flows, which means the scope of "what needs to comply" was either too broad to be practical or too narrow to be true.
Scope first, always
Before I talk about firewalls or encryption or logging, I want a real data flow diagram: where card data enters your environment, every system that touches it or could touch it, every third party in the chain, and every place segmentation is supposed to be keeping the cardholder data environment separate from everything else. Segmentation that looks good on a network diagram and segmentation that actually holds up under a penetration test are two different things, and PCI requires the second kind.
How I work through an assessment
Once scope is solid, I go through the twelve requirements against what's actually running — firewall and router configuration, default credentials, data encryption in transit and at rest, access control and least privilege, logging and monitoring, vulnerability management, and the policies that are supposed to tie it all together. I'm looking for the gaps that tend to hide in plain sight: a vendor-managed point-of-sale system nobody patches, a backup that stores card data unencrypted, log retention that doesn't actually meet the requirement, or access reviews that happen on paper but not in practice.
Whether you need a Self-Assessment Questionnaire or a full Report on Compliance with a Qualified Security Assessor, I help you get the environment into shape before the formal assessment starts, so the audit confirms what's already true rather than surfacing problems you're hearing about for the first time.
Who this is for
Merchants and service providers who process, store, or transmit cardholder data, companies that have grown past their original PCI scope without updating their compliance program to match, and anyone who's been told by an acquiring bank or payment processor that it's time to get serious about this.
If your scope diagram is out of date — or doesn't exist — that's the right place to start. Get in touch.