programme
PCI DSS Managed
Assurance
An ongoing programme that keeps you compliant
between assessments.
Who it’s for
Organisations that have achieved compliance and need to
hold it, particularly where the environment changes regularly or the compliance workload sits with a small team.
At a glance
Service overview
Compliance is a point in
time. Staying compliant
is a programme.
Compliance is a point in time. Staying compliant is a programme. Following a successful assessment, PCI DSS Managed Assurance provides the ongoing oversight, evidence collection and advice needed to keep your controls
current, so the next assessment is a confirmation rather than a rebuild.
Our approach
Oversight through
the year, not just
at audit time.
Most findings at reassessment are not new risks,
they are controls that quietly drifted. This
programme catches that drift while it is still cheap
to fix.
01
Scheduled control reviews
Regular checkpoints through the year to confirm in-scope controls are still
operating as they were assessed, and to catch drift early.
02
Evidence management
We keep the required artefacts current as they are produced, so evidence
gathering is not a scramble in the weeks before your next assessment.
03
Change advisory
When your environment, payment channels or providers change, we tell you what
it does to your scope and your obligations before it becomes a finding.
04
Reassessment readiness
We track what your next assessment will ask for and confirm you can answer it,
so the formal assessment holds no surprises.
Why Confide
Why organisations
move to a programme
The same assessors who will validate you next year are
the ones watching the environment through the year.
Nothing has to be explained twice, and nothing is
discovered late.
Qualified Security Assessor, certified by
the PCI Security Standards Council.
No annual scramble
Evidence and controls stay current, so reassessment is
a confirmation.
Change handled early
Scope impact assessed as the environment changes,
not after.
A named assessor
Continuity of people who already know your environment.
Common questions
Straight answers, before
you commit.
Ask us anything you would rather not put in
an email.
Not necessarily, but most reassessment findings are controls that drifted rather than new risks. The programme exists to catch that while it is still inexpensive to correct.
No. Formal assessment and attestation still happen on their cycle. Managed Assurance keeps you ready for it.
Other services
Assurance across your whole programme.
-
Read More: Assessment & attestation
Assessment
Assessment & attestation
End-to-end support to achieve and validate PCI DSS compliance.
-
Read More: Managed Vulnerability Scanning
Scanning
Managed Vulnerability Scanning
End-to-end vulnerability scanning to meet PCI DSS requirements.
-
Read More: Cardholder data scanning
Discovery
Cardholder data scanning
Identifying and reducing cardholder data risk.
-
Read More: Policies, procedures & training
Capabilty
Policies, procedures & training
Building a strong compliance and security foundation.
-
Read More: Security consulting
ADVISORY
Security consulting
Expert guidance to strengthen your security posture.
Why Confide
Related reading.
Practical guidance from our assessors on what the Standard actually asks of you, written for New Zealand merchants and service providers.
Hosted checkout, iframe or direct post: what each does to your scope
Most organisations we assess have chosen their online payment integration for commercial…
Keep compliance current
between assessments.
Book a call with a Qualified Security Assessor. You will speak
to the person who would run your assessment, not an
account manager.