PCI DSS Gap Analysis
What is a Gap Analysis?
A PCI DSS gap analysis is usually the first step clients take to understand their compliance status. It provides a detailed comparison of what their business is currently doing against what it should be doing to be compliant with the PCI DSS.
It starts with a Qualified Security Assessor (QSA) mapping the critical information processes and technical infrastructure to determine where PCI controls have an impact on the business to:
- outline the most cost-effective approach to meeting PCI obligations; and
- assess readiness for an upcoming PCI audit and to identify deficient controls that could potentially cause an audit failure, with costly consequences for the organisation.
After the assessment, your QSA will prepare a full report that will provides an executive summary and detailed analysis of the status of controls and give high - level recommendations and options for remediation.
Our PCI consultants are ready to offer you practical advice about the best approach to help review your compliance and advise on areas that need attention.
Speak to an expert
Did you know?
Organisations are required not only to achieve 100% compliance with the PCI DSS, but also to maintain it. This means having all applicable security controls continuously in place. However, the Verizon 2018 Payment Security Report identifies that:
- Only 52.5% of organisations achieved full compliance at interim PCI DSS validation in 2017.
- Less than one in five organizations (18%) measure their DSS controls across their entire environment more frequently than the DSS requires.
Complacency leads to breaches, virtually all breached organisations were not compliant with the standard.
Benefits of a PCI DSS gap analysis:
By identifying your gap, you can:
- create a snapshot of PCI DSS compliance;
- identify areas requiring immediate attention, and cost-effective remediation, in prioritised terms;
- improve cost forecasting and budget justification for a PCI DSS compliance programme; and
- gain an awareness of your company’s ability to comply with any new release of the Standard, such as PCI DSS v3.2.
Is a PCI DSS gap analysis right for you?
If you are responsible for implementing the PCI DSS in your organisation, you should ask yourself:
- Do you need to establish the scope of the project?
- Are you undertaking a new programme or reviewing your existing status?
- Has your organisations’ method of taking payments evolved in response to business and customer demand?
- Has technology or processes to store, process or transmit card data changed?
- Have similar organisations suffered a breach of cardholder data?
Our engagement process
The service typically involves several days on-site for our QSAs to meet with the managers who oversee the PCI DSS programme; key staff involved in network administration and cardholder systems; and the individuals responsible for company procedures and policies.
1. Scoping:
A scoping exercise is performed by critically evaluating the CDE and the system components connected to it to determine the scope necessary for the PCI DSS requirements.
2. Pre-assessment information gathering:
During this step, we confirm that the correct scope has been identified for the people, processes and system components for PCI compliance.
3. Assessment and analysis:
A detailed assessment of the CDE is conducted, including: interviews with stakeholders, reviewing policy and procedure documentation and assessment of security controls.
4. Post assessment and report:
A plan to bridge the gap between your current security posture and full compliance with the Standard is provided, demonstrating the necessary corrective actions and enabling you to reduce the risk of a data breach.
How IT Governance can help you
Our services provide a tailored route to PCI compliance, scalable to your budget and needs.
We go further than a simple ‘yes/ no’ approach to understand better how security measures work.
We work in partnership to help you understand what is required and why giving you control.
We can offer expertise to vet compensating controls and determine whether they are acceptable.
Get a tailored quote for our PCI DSS gap analysis service
A PCI gap analysis conducted by an IT Governance QSA will map critical information processes and technical infrastructure. By assessing your current state of compliance, we can outline the most cost-effective approach to meeting the PCI DSS obligations. We have a team of account managers and Qualified Security Assessors to discuss your PCI DSS challenges. For more information, please contact us.
Speak to an expert
We have a team of account managers and security consultants to discuss your PCI DSS challenges. For more information, please contact us.