US (470) 948-0356 India +91 70321 51545

Tetra Connects

Cybersecurity

PCI DSS security support

Many PCI efforts fail on scoping: the cardholder data environment turns out to be bigger than anyone thought. We help you find the real boundary, shrink it where possible and fix the technical requirements that remain.

Speak with a security expert Plan an assessment

The problem this service solves

PCI DSS applies to any system that stores, processes or transmits cardholder data, and to systems that connect to them. A flat network, shared credentials or a forgotten log of card numbers can pull a large part of the organization into scope. Reducing scope through segmentation, tokenization or a hosted payment page is often the cheapest compliance step.

Penetration testing and segmentation testing are requirements that need qualified testers. Other requirements, such as vulnerability management, access control and logging, need working technical processes. We cover those.

What is in scope

  • Scoping

    Data flow mapping, CDE boundary, connected systems and options for scope reduction.

  • Segmentation validation

    Testing that network controls isolate the CDE as designed.

  • Penetration testing

    Internal and external testing of the CDE and critical systems, with methodology that satisfies the standard’s expectations.

  • Vulnerability management

    Internal and external scanning processes, with scan vendor requirements noted.

  • Access and authentication

    Multi-factor authentication, role-based access and account review.

  • Logging and monitoring

    Log collection, review and file integrity monitoring.

  • Secure development

    Web application security practices and script management for payment pages.

  • Evidence preparation

    Organize evidence for your QSA or self-assessment questionnaire.

How the work runs

Scope

Know the boundary.

  1. 1

    Data flow discovery

    Map where card data is stored, processed or transmitted.

  2. 2

    Scope reduction options

    Evaluate tokenization, hosted fields and segmentation.

Close gaps

Fix technical requirements.

  1. 3

    Gap analysis

    Compare current state with the technical requirements.

  2. 4

    Remediation support

    Implement fixes with your teams.

Validate

Test and prepare.

  1. 5

    Testing

    Penetration and segmentation tests.

  2. 6

    Evidence

    Prepare for your QSA or SAQ.

What you receive

  • Data flow diagrams and scope statement
  • Gap analysis
  • Scope reduction recommendations
  • Segmentation and penetration test reports
  • Technical control implementation support
  • Evidence index

Tooling and technique

Testing

  • Nmap
  • Burp Suite
  • Metasploit Framework

Scanning

  • Your approved scanning vendor
  • Internal scanners

Tool categories describe how we work. They are not a claim of vendor partnership or certification.

Standards we map to

Frameworks and references

  • PCI DSS v4.0.1
  • PCI SSC guidance on scoping and segmentation
  • PCI SSC penetration testing guidance

Mapping findings to a framework is not the same as certification against it.

Before we start

What we need from you

  • Current network and data flow diagrams
  • Payment provider details
  • Your QSA or acquirer contact, if any

What this service is not

  • Qualified Security Assessor work
  • Approved Scanning Vendor scans

What changes afterwards

  • A smaller, clearly defined CDE
  • Technical requirements implemented and evidenced
  • Fewer surprises during assessment

Questions people ask

Are you a QSA?

No. Validation of compliance is performed by a QSA or through the self-assessment route your acquirer allows. We prepare you and provide testing and engineering support.

Does a hosted payment page remove us from PCI?

It can reduce scope substantially, but you still have responsibilities, including protecting the page that embeds it. We help evaluate the options.

Related

  • Penetration testing

    Authorized, manual testing of applications, networks, cloud and identities to show what an attacker could reach and what to fix first.

  • Network penetration testing

    External and internal network testing: exposed services, weak authentication, segmentation gaps and lateral movement paths.

  • SOC 2 readiness

    Prepare for a SOC 2 examination: scope, control design, evidence collection, gap remediation and a mock walkthrough.

Need to understand your security exposure?

Speak with a security expert

Talk through your environment and goals. We reply to scope the work before anything is tested.

Speak with a security expert

Plan an assessment

Answer a few questions and get a structured preliminary scope you can send us.

Use the planner

Under attack right now?

Call the US office and tell us what you are seeing. Do not wait for a form reply.

Incident response

Phone, United States (470) 948-0356 Phone, India +91 70321 51545 Email info@tetraconnects.com