PCI DSS gap assessment

Who it’s for

Merchants and service providers that store, process, or transmit account data, and firms that need this work done under their own contract. We do it remotely anywhere in the U.S., and onsite in the Baltimore–DMV Metro corridor.

Scope is the biggest lever in PCI. We start by finding where account data really goes, which systems and people are in, and what can be taken out. A smaller environment means a smaller assessment.

Next comes the reporting path. If a Self-Assessment Questionnaire is right for you, we’ll say so. If you need a Report on Compliance with a QSA, we’ll say that too. We won’t steer you to a lighter SAQ just to make the scope look smaller than it is.

Then we compare the in-scope environment with the current standard and lay out the gaps in the order we’d close them. The evidence index is organized the way a QSA asks for it, so you aren’t assembling it during assessment week.

Nicholas learned PCI from the inside, as an employee: early healthcare IT and MSP work, then payments, banking, and retail security at Mastercard, Ally, and H-E-B, and PCI conformance guidance for privileged-access products at SecureLink.