PCI DSS Readiness

Part of Security Risk, Compliance and Advisory

The Payment Card Industry Data Security Standard asks a lot of organizations that handle card data. We help you work out what applies to you, find the gaps and fix them in a sensible order.

What readiness support covers

Scoping. Where card data is stored, processed and transmitted, what connects to it, and what can be taken out of scope.
Control review. Comparing your controls with the PCI DSS v4.0.1 requirements that apply to you and noting where evidence is missing.
Testing support. External, internal and segmentation penetration testing under requirement 11.4. See PCI DSS 11.4 Penetration Testing.
Logging and monitoring. Helping you collect and keep the evidence the requirements expect. See CMDR.
Remediation roadmap. A practical order of work, so effort goes where it closes the most risk.

How it works

Scope. Map the cardholder data environment and its connections.
Review. Assess controls and evidence against the applicable requirements.
Test. Run the penetration and segmentation testing that requirement 11.4 asks for.
Remediate. Fix gaps with guidance from our team.
Prepare. Organize evidence so you are ready when your assessor or acquirer asks.

What you receive

A scope summary you can share with your acquirer or assessor
A gap list tied to the requirements that apply to you
Testing reports with findings ranked by risk
A remediation plan in priority order

What we do and do not do

Core-Infosec provides penetration testing and PCI readiness support. We do not perform PCI validation assessments. Your acquirer, card brand or assessor decides how you validate and which version of the standard applies to you. Our job is to make that process shorter and less surprising.

Who it fits

Merchants that accept card payments, and service providers that handle, host or can affect the security of card data. Our team has delivered hundreds of assessments, has worked with large enterprises including Fortune 50 organizations, and has experience with HIPAA, FISMA and ISO frameworks and with nation-state and APT-level threat actors.

Get in touch

Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day. Ask us about incident response retainers as well.