In 2012 I accepted a role to manage a PCI DSS compliance program at a level 1 merchant. I said YES because the previous program leads said they operationalized the program.
In my mind that meant directions, instructions, and processes were in place.
The senior project manager and senior security architect in charge assured me that everything was in place for me to run the program.
Do you want to know what they handed off?
A SharePoint space with a dump of documentation, evidence, diagrams, multiple excel spreadsheets, etc.
- Zero organization.
- No requirement to evidence mapping.
- Six spreadsheets with subsets and duplicates of the asset inventory.
In short, they left a mess.
It became clear that it would be up to me to operationalize the PCI DSS Compliance program.
If You’re In Compliance Chaos – ORGANIZE
Have you ever spring cleaned your house? Or decluttered your garage?
When you organize your PCI DSS Compliance program, you’ll get some breathing space.
That dump of documentation and evidence won’t seem so overwhelming once you go through it.
- Delete or archive what you don’t need. Trust me, you will find duplicate or even triplicate documentation
- If you have SharePoint; create 13 folders (Requirement 1 – 12, and SCOPE)
- Create a word document or excel spreadsheet (ugh, I know. Excel. ugh.) to map each document and evidence to a PCI DSS requirement or requirements.
- File each document or evidence in the corresponding folder. If the document maps to multiple requirements, note that in the document and place it in the folder where it maps to first.
I organized over 500 pieces of documentation and evidence in a SharePoint file system.
It gave me the breathing space I needed.
And because it was the one tool I had access to.
How Can You Manage PCI DSS Compliance If You Don’t Know What’s In Scope?
Hands down, understanding the definition of scope and managing scope continue to be a thorn in many sides. It remains the achilles tendon of most PCI Compliance programs.
As a matter of fact, I spent at least 30% of my time educating everyone and anyone about PCI DSS Scope.
Unless you stop taking credit cards for goods and services, you can’t get away from PCI DSS.
- If you store, process, or transmit cardholder data, PCI DSS applies to your organization.
- If you have system components that are connected to your cardholder data environment, they’re in scope.
People are in scope for PCI DSS assessment.
- Do you have call center or customer service agents that process payments over the phone?
- What about system administrators with access to the cardholder data environment?
They’re in scope.
Processes are in scope for PCI DSS assessment.
In fact, your assessment is 70% process related documentation. Everything from vulnerability management processes to configuration management processes are in scope for assessment.
System components are in scope for PCI DSS assessment.
You can download our guide to the types of system components that may be in scope depending upon what you have in your environment.
Tip number 2 is all about educating yourself and your staff about Scope.
Why?
Getting your scope right is half the battle with managing your PCI DSS Compliance program.
If you need more help with managing your scope, you can download our on demand course and step-by-step guidebook.
Manage PCI DSS Compliance With Automation
If you’re stuck in compliance chaos, it may take time to move from beginner to intermediate.
There are a number of things you may need to get sorted before you think about automation:
- Get right with your scope
- Read through the PCI Data Security Standard (PCI DSS) until you’re comfortable with the WHAT of compliance
- Have a clear understanding of roles and responsibilities (all the x.1.2 requirements)
- Know what requirements your third party service providers are responsible for (and comply with requirements 12.8 -12.8.5)
- Stop treating PCI Compliance like the annual fire drill
- Know your critical controls and the controls that persist in giving system administrators the biggest headaches
When it comes to automation, here’s what you can do today:
Schedule a call with Payment Card Assessments to find out if PCI Compliance 365 is the right assessment tool for you.
- PCI Compliance 365 is not a GRC tool that comes with a hefty price tag or 6-12 month implementation timeline.
- If you have JIRA, ServiceNow, ClickUp or other project management workflow tool, we can implement PCI Compliance 365 in 3-4 weeks.
- Integrated knowledge base with over 20+years of combined PCI DSS Compliance management experience
- Workflow automation (saves so.much.time!)
- You’ll realize your ROI with your first Report on Compliance or SAQ-D.
There’s still time in 2025 to get set up for PCI Compliance success in 2026.
Ready?