PCI DSS Compliance and Cardholder Data Security

Flow chart of the PCI DSS engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Cardholder Data Flow. We map how card data moves through your environment and define the systems in scope. Reducing scope is the fastest way to cut effort. Activities: Trace cardholder data flows end to end; Identify systems that store, process, or transmit card data; Assess segmentation and tokenisation options; Confirm your merchant or service provider level. Hands over Scope Definition and Cardholder Data Flow Diagram. Phase 2, Gap Assessment. We measure your environment against the PCI DSS requirements and give you a prioritised remediation list. Activities: Assess controls against the 12 PCI DSS requirements; Review firewall rules, encryption, and logging; Check authentication against version 4.0 changes; Rank gaps by remediation effort and audit risk. Hands over PCI DSS Gap Assessment Report. Phase 3, Control Remediation. We help you implement the missing controls, from network segmentation to strong authentication and logging. Activities: Implement network segmentation around card data; Roll out multi-factor authentication; Configure logging and file integrity monitoring; Schedule quarterly ASV scans and penetration tests. Hands over Remediated Control Environment. Phase 4, Evidence Collection. We gather the evidence each requirement needs, so the assessment is a review, not a scramble. Activities: Map each requirement to its evidence artefacts; Collect scan results, configs, and policy records; Verify evidence covers the assessment period; Index the package for the assessor. Hands over Evidence Package Indexed by Requirement. Phase 5, Assessment Preparation. We prepare you for the SAQ or the QSA-led Report on Compliance, depending on your level. Activities: Select the correct SAQ type or ROC path; Run a dry-run walkthrough of assessor questions; Brief control owners on interview expectations; Fix last-mile issues before the assessment. Hands over Completed SAQ or Assessment Readiness Pack. Phase 6, Attestation and Maintenance. We support the attestation of compliance and help you keep controls running between assessments. Activities: Support QSA fieldwork and finding resolution; Finalise the attestation of compliance; Set the quarterly scan and review calendar; Monitor control drift between assessments. Hands over Attestation of Compliance. Each phase begins from the artefact the phase before it produced.