PCI DSS compliance
Card payments on a secure footing
If your website or server is involved in taking card payments, PCI DSS applies. I do the technical work on your websites and servers to meet its requirements and keep them met.
Technical compliance work
The hands-on security work
Most PCI DSS failures on small business systems come down to a handful of technical gaps. I find them and fix them.
- Fixing issues found by quarterly external (ASV) vulnerability scans
- Strong TLS settings, with old protocols and weak ciphers switched off
- Regular patching of WordPress, plugins, PHP and server software
- Firewall rules that only allow the traffic you need
- Access control: unique logins, strong passwords and multi-factor authentication
- Logging and monitoring so suspicious activity is spotted
- Malware scanning and file integrity monitoring
How I help
From scan report to compliant
Scope review
Working out which websites, servers and systems touch card data, and how to keep that scope as small as possible.
Payment page security
Checking the scripts on your checkout pages, as PCI DSS v4 now requires, and keeping a record of what is allowed to run.
SAQ support
Providing the technical evidence you need for your Self-Assessment Questionnaire.
Ongoing compliance
Patching, scans and reviews on a schedule, so you stay compliant all year, not just at renewal.
Working with your acquirer or QSA
I handle the technical side of compliance on your websites and servers. Your formal assessment is still signed off through your payment provider, bank or a Qualified Security Assessor, and I can work alongside them to close any gaps they find.
Failed a PCI vulnerability scan?
Send me the scan report and I’ll tell you what needs fixing and how long it will take.