Skip to the main content.
Contact
Contact

1 min read

Non-Compliance Lesson No. 1: Wait until your assessment to validate scope

Non-Compliance Lesson No. 1: Wait until your assessment to validate scope

PCI DSS can be hard and not preparing for it just makes things harder. Following this advice is guaranteed to make it both more exciting and painful.

  • Ignore your “connected-to” systems.
  • Forget that PCI also includes processing and transmission as well as security impacting systems.
  • Leave troublesome special cases and infrequently used processes until your assessment date nears due.
  • Figure this out at the last minute during your assessment to keep things exciting.

Learn More

Seriously, if you want your assessment to be smooth and boring you may find these articles useful.

Original Publication: 2021-10-07
Updated PCI FAQ & Learn More links: 2023-06-16

If You Need Help

Compliance can seem as dry as toast. Normally, it only gets exciting when things go wrong like when you find problems during an annual assessment, facing a looming deadline, with senior management breathing down your neck expecting a pass. Last minute discovery of problems gets extremely stressful. Failure becomes an option. Remediation is not guaranteed and can often be risky, sub-optimal, and expensive.

PCI DSS has 12 high-level requirements and over 250 sub-requirements each of which is an opportunity for failure. The kinds of challenges we describe are often avoidable and manageable. After all, PCI is an open book exam and there should be no excuse for not being prepared. If you are struggling with business-as-usual compliance, or have challenges, we can help.

PCI Compliance V4.0: Is your Business Ready?

PCI Compliance V4.0: Is your Business Ready?

Control Gap's Robert Spivak had a follow up session with David Goodale from www.merchant-accounts.ca to talk about some of the major impacts that PCI...

Read More
Access Control Facades and Hardcoded Secrets: A Sage 300 Case Study (Part 3)

Access Control Facades and Hardcoded Secrets: A Sage 300 Case Study (Part 3)

This is a continuation of the Sage 300 case study series where we explore the process of discovering and developing exploits for six (6) different...

Read More
Access Control Facades and Hardcoded Secrets: A Sage 300 Case Study (Part 2)

Access Control Facades and Hardcoded Secrets: A Sage 300 Case Study (Part 2)

This is a continuation of the Sage 300 case study series where we explore the process of discovering and developing exploits for six (6) different...

Read More