PCI DSS preparation
Reduce and control the cardholder-data scope before piling up controls.
IKNSA maps the payment flows, responsibilities and dependencies to qualify the scope, the gaps and the appropriate validation mode.
Evidence chainObserve · qualify · prioritise
- Scope
- Findings
- Risks
- Trajectory
The decision point
The first measure of control is knowing where card data passes, rests or can be influenced.
The audit follows the payment journeys, the pages, terminals, applications, networks, providers and administrative access. It identifies scope-reduction opportunities, verifies segmentation and organises the evidence according to the role and the validation mode.
Working scope
The dimensions examined together.
The framing avoids treating separately subjects that condition one another. The final scope remains adapted to the organisation and its priorities.
- Card data flows and storage
- Payment pages, scripts and terminals
- Network segmentation and connected components
- Identities, access and logging
- Providers, responsibilities and attestations
- Tests, scans, evidence and validation mode
A usable result
A defensible scope and organised evidence.
The read-out distinguishes the controls that apply directly, the dependencies on providers and the architecture decisions capable of durably reducing the scope and the validation effort.
- 01Flow map and proposed scope
- 02Responsibility and provider matrix
- 03Technical, organisational and documentary gaps
- 04Preparation plan, tests and evidence
Method
An engagement that stays readable from scope to decision.
Scope
Fix the entities, services, assets, periods and frameworks actually examined.
Observe
Cross-check interviews, documents, configurations and operational results without relying on declarations alone.
Prioritise
Connect each finding to its business impact, its likelihood and the controls already in place.
Decide
Produce a costed trajectory with owners, deadlines, dependencies and expected evidence.
Point of vigilance
What the engagement must make explicit.
The final qualification and the validation mode depend on the contractual context, the volume, the journeys and the authorised actors. The preparation engagement must not be confused with an attestation issued outside its mandate.
The first conversation verifies the context, the level of urgency, the stakeholders and the output genuinely expected.
Frame this engagement See Audit & compliance Start with a guided assessmentFirst conversation
Let’s discuss the next point of control for your information system.
A project to frame, operations to take over, compliance to demonstrate? Describe the context. You will get a first considered reading — not a generic brochure.