PCI DSS compliance
Take card payments without expanding your scope
Define the cardholder data environment, keep the boundary evidenced, and prove the controls inside it.
What PCI DSS is
PCI DSS is a security standard maintained by the payment card brands. It applies to any organization that stores, processes, or transmits cardholder data.
The requirements apply to the cardholder data environment: the systems that touch card data and anything connected to them. Everything outside that boundary is out of scope.
How you validate depends on transaction volume and how you accept payments. Most software companies validate by self-assessment questionnaire rather than a full audit by a Qualified Security Assessor.
Who needs PCI DSS
You accept card payments, or you build software that stores, processes, or transmits cardholder data on behalf of someone who does.
How TrustLynce helps with PCI DSS
Define the environment
Record which systems are in the cardholder data environment and which are deliberately outside it.
Evidence the boundary
The segmentation that keeps systems out of scope is itself a control, and it needs evidence like any other.
Prove the controls inside
Access, encryption, logging, and change management across the systems that remain in scope.
Track validation
Keep the self-assessment questionnaire and supporting evidence current between validations.
PCI DSS questions
It depends on how you accept payments, whether card data reaches your systems at all, and through what channel. Your acquirer or payment provider confirms which applies.
By keeping card data out of your systems where possible, and segmenting what remains. A hosted payment page or tokenising provider removes most systems from scope entirely.
Only at higher validation levels. Most software companies self-assess. Volume and your acquirer determine which applies to you.
No. Validation is done by you through a self-assessment questionnaire, or by a Qualified Security Assessor. We prepare and maintain the evidence behind it.
Validation is periodic, but the requirements apply continuously. Controls that only hold at validation time are the ones that fail between them.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.