PCI DSS Compliance Consultants

PCI DSS compliance can quickly become complex. Most payment environments involve e-commerce platforms, point-of-sale systems, payment processors, cloud services, employees, third-party vendors, applications, networks, and other systems that handle payment data.

Tanner Security offers PCI DSS compliance consulting to help businesses understand their requirements, define their Cardholder Data Environment (CDE), identify security gaps, remediate weaknesses, and prepare for PCI validation.

We focus on practical PCI compliance. Rather than simply checking boxes, we help companies understand the security risks behind each requirement and determine which actions are truly necessary for your business.

PCI DSS v4.0.1 is the current version of the standard. The PCI Security Standards Council (PCI SSC) published v4.0.1, a limited revision to v4.0 that clarified requirements and corrected errors. PCI DSS v4.0 retired on December 31, 2024.

The Payment Card Industry Data Security Standard (PCI DSS) establishes technical and operational requirements designed to protect payment card account data.

PCI DSS applies to businesses that store, process, or transmit payment account data and to businesses that can affect the security of the Cardholder Data Environment. PCI SSC describes the standard as a baseline of technical and operational requirements for protecting payment account data.

PCI compliance involves more than protecting a database containing credit card numbers. Your company’s responsibilities can involve network security, access control, authentication, vulnerability management, secure software development, logging and monitoring, security testing, policies, employee awareness, third-party relationships, and incident response.

The appropriate compliance process depends on how your company handles payment information and the validation requirements established by the applicable payment brands, acquirer, or other compliance-accepting entity. PCI SSC explains that compliance-accepting entities determine the applicable validation and reporting methods, such as a Report on Compliance (ROC) or Self-Assessment Questionnaire (SAQ).

That is where experienced PCI consulting can provide significant value.

PCI DSS v4.0.1 is the current version. PCI SSC describes the update as a limited revision that provides corrections and clarifications rather than adding or deleting requirements.

PCI DSS v4.x also emphasizes greater flexibility, targeted risk analysis, stronger authentication, ongoing security practices, and greater attention to evolving payment threats.

For companies moving from older PCI practices, the main question isn’t just, “What changed?”

A better question is:

“How do these requirements apply to our actual payment environment?”

Tanner Security can help your team understand the requirements, review your current controls, identify gaps, and develop a practical plan to address them.

One of the first steps in PCI compliance involves defining the Cardholder Data Environment (CDE).

The CDE includes systems and components that store, process, or transmit payment card account data, along with other systems and components that can affect the security of that environment.

The exact scope varies for each company.

A retailer may have POS systems and payment terminals. An e-commerce business may have web applications, APIs, databases, cloud infrastructure, and payment-page integrations. A service provider may have administrative access to customer environments that creates PCI considerations even when the provider does not directly store payment card information.

Tanner Security helps companies document payment flows, identify connected systems, evaluate security boundaries, and determine where PCI responsibilities apply.

Proper scoping makes compliance more efficient and lowers the risk of missing important security control during the assessment.

Our PCI consulting services support your company from the initial scoping steps through compliance.

PCI 4.0 Consulting: We provide expert guidance on navigating the new requirements and changes introduced in PCI DSS 4.0. Our consultants help you understand and implement these updates to ensure continued compliance and security.

PCI Gap Assessments: A PCI gap assessment compares your current security controls and practices against the PCI DSS requirements that apply to your environment. We find gaps, explain why they matter, help you set priorities, and work with your team to create a practical plan that addresses the most serious issues first. A gap assessment is especially helpful if your company is preparing for its first PCI assessment, moving to PCI DSS v4.0.1, changing payment platforms, expanding its payment environment, or responding to past assessment findings.

PCI DSS Compliance Assessments: A PCI compliance assessment provides a wider review of your security controls against applicable PCI DSS requirements. Tanner Security evaluates areas such as access control, authentication, vulnerability management, network security, security policies, logging, monitoring, incident response, and security testing. The goal goes beyond simply answering “yes” or “no.” We want your leadership team to understand where risks exist, why the controls matter, and what your company should do next.

PCI Policy Consulting: PCI DSS requires more than technical controls. Your company also needs policies and procedures that support the security of payment card data. Tanner Security can review and develop policies covering information security, acceptable use, access management, vulnerability management, incident response, third-party risk, security awareness, data retention, and other areas relevant to your PCI program. We focus on practical policies your employees can use, not just generic documents that get ignored.

PCI CDE Penetration Testing: Penetration testing goes beyond identifying possible vulnerabilities. It attempts to determine whether an attacker can exploit weaknesses and what access that attacker could obtain. Tanner Security performs PCI CDE penetration testing to evaluate the security of systems and networks that support payment card processing. Our testing can include vulnerability identification, manual validation, exploitation, privilege escalation, lateral movement, and other techniques that fit the approved scope.

PCI DSS organizes its requirements to protect payment account data at every stage of the payment account lifecycle.

The requirements address areas such as network security controls, secure configurations, account data protection, encryption, malware protection, secure application development, access control, authentication, physical security, logging and monitoring, security testing, and information security policies.

The specific requirements that apply to your company depend on your payment environment and assessment method.

Tanner Security helps translate the standard into practical security controls, rather than expecting executives and IT teams to interpret hundreds of pages of requirements on their own.

Many businesses assume that outsourcing payment processing eliminates their PCI responsibilities.

That’s not always the case.

A third-party payment processor may take responsibility for specific payment functions, but your company still needs to understand your specific security responsibilities.

Your payment environment may include your website, payment page, cloud systems, employee endpoints, network infrastructure, administrative access, APIs, or other systems that can affect payment security.

PCI SSC also emphasizes the importance of a clear understanding of service-provider relationships and responsibilities. Compliance-accepting entities determine the applicable validation and reporting requirements, so companies should confirm those requirements rather than if a particular SAQ or assessment method applies.

Tanner Security can help document these responsibilities and recognize areas that require additional security controls or evidence.

E-commerce businesses have unique payment-security issues because payment pages often interact with third-party scripts, payment processors, APIs, web applications, and customer browsers.

PCI DSS v4.0.1 includes specific requirements for payment-page scripts, and the PCI SSC continues to guide e-commerce payment security. For example, PCI SSC recently clarified the eligibility criteria for SAQ A scripts.

So, a business shouldn’t assume that outsourcing payment processing makes its website irrelevant to PCI scope.

Tanner Security can evaluate the architecture surrounding your online payment process and help determine which security controls and validation requirements apply.

Step 1: Understand Your Payment Environment: We begin by learning how your business accepts and processes payment card data. We review systems, applications, networks, payment providers, workflows, and relevant third-party relationships.

Step 2: Define PCI Scope: We help identify the Cardholder Data Environment and the systems and controls that can affect its security.

Step 3: Assess Current Controls: We compare your current security practices with the applicable PCI DSS requirements and document areas that require attention.

Step 4: Prioritize Gaps: We help your team prioritize remediation according to security risk, business impact, compliance requirements, and available resources.

Step 5: Remediate: Your team addresses identified deficiencies. Tanner Security can provide guidance with security controls, policies, technical remediation, vulnerability management, penetration testing, and other related activities.

Step 6: Prepare for Validation: We help your team prepare the evidence, documentation, testing results, and other materials required by your applicable PCI assessment process.

Step 7: Maintain Compliance: PCI compliance does not end when the assessment is complete. Updates to payment applications, infrastructure, vendors, networks, and security controls can all impact your PCI environment.

We help businesses view PCI compliance as an ongoing security process rather than just an annual paperwork task.

PCI compliance should do more than help you pass an assessment. It should help your business lower the risk of payment card compromise and show where weaknesses could impact your customers, operations, and revenue.

Tanner Security brings together PCI consulting and hands-on cybersecurity experience to help companies define scope, identify gaps, strengthen controls, and prepare for PCI validation.