PCI DSS Gap Analysis

Reuqest a quote

A PCI gap analysis conducted by an IT Governance QSA will map critical information processes and technical infrastructure. By assessing your current state of compliance, we can outline the most cost-effective approach to meeting the PCI DSS obligations. We have a team of account managers and Qualified Security Assessors to discuss your PCI DSS challenges. For more information, please contact us.

What is a PCI gap analysis?

A PCI DSS Gap Analysis reviews an organization’s cardholder data environment (CDE) against the latest version of the Payment Card Industry Data Security Standard (PCI DSS). In-scope systems and networks are reviewed and a detailed report is compiled, showing areas that need attention.

A PCI compliance gap analysis starts with a Qualified Security Assessor (QSA) mapping the critical information processes and technical infrastructure to determine where PCI controls have an impact on the business to:

Outline the most cost-effective approach to meeting PCI obligations
Assess readiness for an upcoming PCI audit and identify deficient controls that could potentially cause an audit failure, with costly consequences for the organization

After the assessment, your QSA will prepare a full report that will provide an executive summary and detailed analysis of the status of controls and give high-level recommendations and options for remediation.

Did you know?

Organizations are required to achieve compliance with the PCI DSSand maintain their compliance status.

This means having all applicable security controls continuously in place. However, the Verizon 2018 Payment Security Report identifies that:

Only 52.5% of organizations achieved full compliance at interim PCI DSS validation in 2017
Less than one in five organizations (18%) measure their DSS controls across their entire environment more frequently than the DSS requires.

Complacency leads to breaches; virtually all breached organizations were not compliant with the standard.

Benefits of a PCI DSS gap analysis

By identifying your gaps, you can:

Create a snapshot of PCI DSS compliance
Identify areas requiring immediate attention and cost-effective remediation in prioritized terms
Improve cost forecasting and budget justification for a PCI DSS compliance program
Gain an awareness of your company’s ability to comply with any new release of the Standard, such as PCI DSS v3.2

Is a PCI DSS gap analysis right for you?

If you are responsible for implementing the PCI DSS in your organization, you should ask yourself:

Do you need to establish the scope of the project?
Are you undertaking a new program or reviewing your existing status?
Has your organizations’ method of taking payments evolved in response to business and customer demand?
Has technology or processes to store, process, or transmit card data changed?
Have similar organizations suffered a breach of cardholder data?

Our engagement process

The PCI gap assessment service typically involves several days on-site for our security consultants to meet with the managers who oversee the PCI DSS program, key staff involved in network administration and cardholder systems, and the individuals responsible for company procedures and policies.

Scoping: A scoping exercise is performed by critically evaluating the CDE and the system components connected to it to determine the scope necessary for the PCI DSS requirements.
Pre-assessment information gathering: During this step, we confirm that the correct scope has been identified for the people, processes, and system components for PCI compliance.
Assessment and analysis: A detailed assessment of the CDE is conducted, including: interviews with stakeholders, reviewing policy and procedure documentation, and assessing security controls.
Post assessment and report: A plan to bridge the gap between your current security posture and full compliance with the Standard is provided, demonstrating the necessary corrective actions and enabling you to reduce the risk of a data breach.

Find out more about our PCI DSS Gap Analysis >>

How IT Governance can help you get PCI DSS compliant

Our services provide a tailored route to PCI compliance, scalable to your budget and need.

We go further than a simple ‘yes/ no’ approach to understand better how security measures work.

We work in partnership to help you understand what is required and why giving you control.

We can offer expertise to vet compensating controls and determine whether they are acceptable.

Companies using our PCI DSS products and services:

"IT Governance were very professional and pragmatic in their approach, and displayed a level of understanding of our business that we found unique and refreshing.”

Damien Everard, COO of Appletree.