PCI DSS is the card industry's security standard for organisations that store, process, or transmit cardholder data, and it is enforced through the card networks and acquiring banks rather than a government regulator. Validation requirements scale with transaction volume and channel, from self assessment questionnaires to a full audit by a Qualified Security Assessor.
The most expensive mistake in a PCI DSS program happens before any control is built: scoping the cardholder data environment incorrectly. Scope drives the entire cost of the program, and our engagements begin by establishing exactly which systems, networks, and processes sit inside it, and which can be removed from it through segmentation.
