insights
What the Standard asks
of you, in plain language.
Guidance from our assessors on scoping, validation and the things that go
wrong in practice. Written for New Zealand merchants and service
providers, whether you take payments online, in store, by phone or
through a platform.
What is PCI DSS, and who
does it apply to?
Do we need an SAQ or a full assessment?
What counts as
cardholder data?
Who decides our
merchant level?
Does PCI DSS apply if we only sell online?
All articles
Written from assessment
work, not a slide library.
-
Diagram Your Processes
When you think of PCI DSS, you probably don’t automatically think of drawing diagrams. But…
Read more: Diagram Your Processes5 min read
-
Secure Your Online Store
More and more stores are moving online. Whether that was part of your plan or…
Read more: Secure Your Online Store12 min read
-
Hosted checkout, iframe or direct post: what each does to your scope
Most organisations we assess have chosen their online payment integration for commercial reasons: what the…
-
CCWs, Custom Testing, and INFIs – Oh My!
In June 2023, the PCI Security Standards Council introduced a new document that you’ll need…
-
The Risk Assessment is Dead, Long Live the Risk Assessment
PCI DSS has recently changed the way that we have to do risk assessments. You…
-
Version 4 SAQs are Out – What’s New
It’s finally happened – on April 1st NZ time, PCI DSS v4.0 was released, and…
-
Service Providers – What is Changing in PCI DSS v4.0?
Service providers have always had a slightly different focus in PCI DSS because as a…
-
Rapid Requirements: Responsibility Matrix
Supporting Your Customers As a service provider, your customers are always looking for more information…
-
PCI v4.0 by the Numbers
What’s New in Version 4? There’s a lot of new things in version 4. In…
Read more: PCI v4.0 by the Numbers2 min read