02 / Compliance and certification
PCI DSS, starting with where the card data actually goes
We help you find the real cardholder data environment, shrink it where you can, and prepare the controls, tests and evidence your assessment will ask for.
Overview
What PCI DSS asks of you
The Payment Card Industry Data Security Standard (PCI DSS) is maintained by the PCI Security Standards Council. It applies to entities that store, process or transmit cardholder data, and to systems that can affect the security of that data. Its requirements cover networks, configuration, data protection, access, logging, testing and policy.
Scope decides the size of the job. Every system in or connected to the cardholder data environment is in scope unless segmentation keeps it out, and segmentation only counts if it is tested. Getting the data flows right first is cheaper than remediating systems that never needed to be in scope.
Black Fox is not a Qualified Security Assessor (QSA) or an Approved Scanning Vendor (ASV). We prepare you, test what the standard requires to be tested, and help you assemble evidence. The formal assessment is done by a QSA or, where your acquirer or the card brands allow it, through a Self-Assessment Questionnaire (SAQ). We work with long-standing partners and coordinate the assessment with a QSA from among them or one of your choice.
Who it is for
Merchants, payment service providers and other service providers that touch card data or can affect its security, teams whose acquirer has asked for a Report on Compliance or an SAQ, and organisations that need the penetration and segmentation tests the standard calls for.
The work, from scoping to evidence.
What we do
Scoping and data flows
We trace where cardholder data enters, moves, is stored and leaves, and document the cardholder data environment and connected systems.
Segmentation
Advice on reducing scope through network segmentation, tokenisation or outsourced payment pages, with the trade-offs stated plainly.
Gap assessment
A requirement-by-requirement review of where you stand, with findings ranked by risk and effort.
SAQ support
Help choosing the questionnaire that fits your payment channels and answering it with evidence behind each response.
Penetration and segmentation testing
Internal and external penetration tests and segmentation tests as the standard requires, following recognised methods such as the PCI penetration testing guidance.
Hardening and evidence
Configuration standards, access reviews, logging and the records your assessor will sample.
How the engagement runs
Kickoff
We agree your payment channels, the people involved and your assessment date, and sign an NDA first if you need one.
Scoping
Data flow mapping and a scope statement you can defend in front of an assessor.
Gap assessment
Interviews, configuration review and sampling, ending in a prioritised gap report.
Remediation and testing
We work with your teams on the gaps and run the penetration and segmentation tests in scope.
Assessment support
We coordinate the QSA's assessment, with one of our long-standing partners or a QSA of your choice, or help you complete your SAQ, and help with any findings that follow.
What you receive
- Cardholder data flow diagrams and scope statement
- Gap assessment report with a prioritised action plan
- Segmentation recommendations and test results
- Penetration test reports with proofs of concept
- SAQ working file with evidence references
- Evidence index for your assessor
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Are you a QSA?
No. Black Fox is not a Qualified Security Assessor or an Approved Scanning Vendor. We prepare you and run the tests that can be done by a qualified internal or third party tester. A QSA performs the formal assessment and an ASV runs the external vulnerability scans that must come from an ASV. We coordinate that assessment with one of our long-standing partners or a QSA of your choice.
Do we need a QSA or can we use an SAQ?
That depends on your role, your transaction volume and what your acquirer or the card brands require. Ask your acquirer first. We can help you understand which SAQ type matches your payment channels.
Does segmentation take systems out of scope?
It can, if it actually isolates the cardholder data environment and is tested to prove it. Untested segmentation does not reduce scope.
Does outsourcing payments remove PCI DSS?
It reduces scope, often a lot, but rarely to zero. The pages, scripts and systems that send customers to the payment provider usually remain your responsibility.
Related services
- Managed securityVulnerability managementRecurring vulnerability reviews from Black Fox Security: scanning, triage, prioritisation by exploitability and exposure, fix tracking and trend reporting.
- Managed securitySecurity hardeningSecurity hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security.
Find the edges of your card data environment
Tell us how you take payments. We will show you what is in scope and what does not need to be.