An acquirer request, customer contract or new payment channel can expose gaps in scope and evidence. CyberVantage360 helps merchants and service providers plan remediation, assign control ownership and prepare the records needed for their required validation route.
Start with how payment data enters, moves through and leaves the business. Examine checkout integrations, terminals, telephone payments, administrative access, connected systems and outsourced services. Record the responsibilities retained by your organisation and the evidence available from each provider.
Confirm the required validation and reporting method with the compliance-accepting entity, typically a payment brand or acquirer. A Self-Assessment Questionnaire (SAQ) and a Report on Compliance (ROC) are different reporting routes; the appropriate route depends on the environment, eligibility and recipient instructions. Reference: PCI SSC guidance on validation responsibilities.
For organisations operating across countries, identify the relevant entities, acquiring relationships, payment channels and local system owners. A shared technology platform does not automatically make every submission or responsibility identical.
Read the PCI DSS compliance and validation guide ↗
Explore payment scope, remediation, evidence and validation, with practical retail and platform examples.
The engagement defines the work included, its acceptance criteria and the evidence your team will maintain. Depending on scope, deliverables can include:
A channel inventory, data-flow view, system boundary and provider responsibility record. Identify missing information, proposed exclusions and segmentation assumptions that require verification. Record the validation questions to resolve with the acquirer or other recipient before committing to a questionnaire or assessment plan.
Findings linked to the relevant requirements, affected systems and available evidence. Each action has an owner, dependency, target date and closure condition. Distinguish a missing document from a control that is absent, ineffective or operating without reliable records.
Practical responsibilities for access, secure configuration, software changes, vulnerability treatment, monitoring, incident response and supplier oversight, as applicable. Connect procedures to actual records and operating tasks. Identify technical changes and specialist testing that need separate delivery arrangements.
A review of completed actions, evidence quality and unresolved limitations. Organise the information needed for the selected reporting route and support responses to assessment queries within the agreed scope. Preserve the actual findings and dates; preparation cannot create missing historical control operation.
Set checkpoints around the evidence and decisions needed for your submission.
Review payment channels, providers, existing reports and the recipient’s request. Confirm responsibilities, assumptions and access to evidence. Agree the initial work package and the questions that could change its size.
Work through agreed actions with the people responsible for operating the systems. Check the implemented result, document exceptions accurately and resolve dependencies before treating an action as complete.
Review readiness for the required assessment or submission. Record outstanding work and establish ownership of recurring activities so the programme continues through new releases, personnel changes and supplier transitions.
Map recurring compliance actions and evidence workflows to Effivity’s available features during scoping. Agree configuration, ownership and access before implementation, including which records are suitable for the platform.
Connect learning to staff responsibilities for payment handling, secure administration and incident escalation. Review relevant Sterling Academy course coverage and delivery options as part of the engagement plan.
Where a Qualified Security Assessor (QSA) is required, verify the appointed company’s current qualification and clarify its assessment scope and independence arrangements. Required ASV external scans must use an Approved Scanning Vendor’s approved solution. These roles have distinct qualification requirements. References: PCI SSC QSA information; ASV information.
Our proposal identifies the consulting deliverables and any assessment, scanning or technical testing that must be commissioned separately. Management remains responsible for its environment and evidence. The relevant assessor evaluates its findings, and the compliance-accepting entity determines its reporting requirements.
These hypothetical scenarios illustrate scoping questions.
An outsourced web checkout does not describe staff taking payments by telephone. Discovery follows the new route, including workstations, recordings and any notes, then establishes responsibilities and reporting implications before extending the existing validation approach.
Replacing a redirect with an embedded payment experience changes the facts behind earlier scope decisions. Review the integration, page ownership, supplier evidence and applicable eligibility conditions before relying on the previous questionnaire selection.
PCI SSC does not recognise certificates as evidence of PCI DSS validation. Use the applicable official reporting documents, including the relevant SAQ or ROC and Attestation of Compliance. Confirm what the recipient requires. Reference: PCI SSC guidance on recognised documentation.
No. Establish what the provider covers and what your organisation retains. For example, PCI SSC confirms that SAQ A ASV scanning requirements apply to merchant webpages using redirects or embedded payment iframes. Reference: PCI SSC clarification for outsourced ecommerce.
A reliable selection needs the payment-channel facts and the questionnaire’s eligibility conditions. Confirm the reporting route with the relevant payment brand or acquirer. Transaction volume or use of a particular payment provider does not settle every eligibility question.
The required validation method is determined through the applicable payment-brand or acquirer programme. Confirm whether your route requires a QSA, self-assessment or another permitted arrangement. Consulting support does not itself establish a QSA qualification or replace required assessor work.
Review scope, current controls, remediation dependencies and the evidence required first. Agree a staged plan with owners and acceptance criteria. Assessment availability, technical fixes and supplier responses can affect delivery; an initial target date is not a validation guarantee.
Share a high-level payment-channel summary, provider list, available diagrams, previous validation documents and the recipient’s request or deadline. Keep cardholder data and credentials out of the initial enquiry; agree a secure method for any later evidence exchange.
Start with your payment environment and the decision your acquirer or customer needs. Agree scope, responsibilities, deliverables and assessment dependencies before committing to the programme.
