What we deliver
FF Tech helps technology and security teams organize scope, controls, evidence and an action plan before audits and reviews aligned with PCI DSS (the payments industry requirements for protecting cardholder data). The focus is on what has to be put into practice: defining the scope of the cardholder data environment, access controls, audit trails, hardening, monitoring, documentation and gap remediation. We do not replace the Qualified Security Assessor (QSA), but we lay the groundwork so the audit runs more smoothly, with fewer surprises and with traceable evidence.
The problem it solves
Organizations that process, store or transmit cardholder data and need to prepare for PCI DSS audits, but do not know where to start or have technical gaps to resolve.
CISOs, heads of security, compliance owners and technical teams involved in PCI DSS compliance.
Before PCI DSS audits, when there are known gaps in the controls, when the scope of the cardholder data environment needs to be defined or reviewed, or when the team needs technical help organizing evidence.
Scope of work
Deliverables
How the work happens, in practice
Scope first
PCI DSS applies to everything that stores, processes or transmits card data and to everything that connects to that environment or can affect its security. The first step is to map the flow of the card number (PAN) across systems, networks, people and vendors. Reducing the scope, through network segmentation, tokenization, point-to-point encryption or outsourcing payment to a compliant provider, is usually the most economical decision, because every system in scope needs controls and evidence. Segmentation, however, must be validated by testing, not just designed.
Requirements that demand the most work
Network controls (requirement 1), protection of stored data (3), secure configuration and vulnerability management, identification and authentication, including MFA (8), logging and monitoring of access (10) and security testing, such as scans and penetration tests (11). Common points of failure: PAN visible in logs, default passwords, shared accounts, logs without review and scans without treatment of the findings. The current version is 4.0.1, and the new 4.0 requirements that were considered best practices became mandatory on March 31, 2025.
Evidence and the assessor's role
An audit is about proof: each control needs evidence organized by requirement, such as configurations, records, policies and log samples, and it is not enough for the control to exist. The evidence must cover the entire assessed period, not just the day of the audit. The QSA (Qualified Security Assessor, the PCI-qualified assessor) is the one who validates compliance and issues the report (ROC); depending on the type of entity and the requirements of whoever enforces compliance, some organizations may use the self-assessment questionnaire (SAQ). Preparation exists to reach this stage without surprises and with an action plan, with owners, for the gaps.
What sets us apart
- A technical approach, not just paperwork
- Focus on real implementation of controls, not just checklists
- Experience in cloud and hybrid environments
Methodology
Definition of scope and the cardholder data environment
Gap analysis against the requirements
Prioritization and action plan
Implementation of controls
Organization of evidence
Final preparation and support for the qualified assessor
Highlights
Frequently asked questions
Ready to move forward?
Tell us about your context and challenges. We reply with a clear proposal.