Home / Governance, Risk & Compliance

Governance, Risk & Compliance

PCI DSS Consulting & QSA Assessment

Support merchants and service providers through PCI DSS scoping, readiness and the appropriate assessment process.

Start your enquiry
  • Scoping / Gap Assessment
  • ROC / AOC
  • SAQ
  • Merchant / Service Provider

SERVICE IN DETAIL

From the first assessment to practical outcomes

Who this service is for

Organisations building a management framework, preparing for customer requirements or improving an existing programme.

How we work

  1. Assessment & gap analysis

    Payment channels, cardholder data flows, third parties and assessment eligibility

    Interview process owners, examine the current documents and sample supporting records. Identify gaps against the agreed framework and distinguish missing controls from controls that lack operating evidence.

  2. Implementation roadmap

    In-scope controls, segmentation, operating records and technical testing evidence

    Prioritise actions by business risk and dependencies. Work with your owners on policies, procedures, responsibilities and practical evidence templates, then support adoption through agreed working sessions.

  3. Assessment & assurance reporting

    Appropriate ROC/AOC reporting or SAQ support, findings and corrective actions

    Present findings with risk, evidence and practical recommendations. Agree management responses, owners and target dates; review corrective evidence where follow-up is included. Any formal assurance conclusion depends on the applicable criteria and assessment results.

What you receive

  • Gap assessment and prioritised action register
  • Agreed policies, working templates and implementation roadmap
  • Assessment report, supporting evidence and corrective-action register appropriate to the agreed assurance route

Relevant frameworks and guidance

Before we begin

We confirm the scope, responsibilities, evidence, timetable and deliverables in the proposal. The activities above are tailored to the systems and objectives agreed with your organisation.

Discuss your scope

Specialist services

Approved Scanning Vendor Scan Coordination

Coordinate external vulnerability scans through an Approved Scanning Vendor, with support for findings review and rescanning.

View scope, process and deliverables

Who this service is for

IT and development teams preparing a release, validating security improvements or checking business-critical systems.

How we work

  1. Scope & rules of engagement

    External scanning scope and coordination with an Approved Scanning Vendor

    Agree the targets, access levels, test window, business constraints and stop conditions. Confirm written authorisation and prepare the accounts, network access or test data needed for the selected assessment.

  2. Testing & validation

    ASV scan scheduling, findings review, exceptions and remediation coordination

    Combine relevant tools with analyst review for the agreed test objectives. Validate findings, capture reproducible evidence and distinguish confirmed issues from results that need additional information or investigation.

  3. Remediation & retest

    Vendor-issued scan results and agreed rescan follow-up

    Explain business impact, affected components and actionable fixes in a technical report and management summary. Where agreed, retest corrected issues and record their status without treating untested systems as covered.

What you receive

  • Agreed scope and test plan
  • Technical findings with evidence and remediation priorities
  • Executive summary and agreed retest record

External ASV scan results are issued by the selected Approved Scanning Vendor. ALPHASEC coordinates scope, remediation and follow-up.

Relevant frameworks and guidance

Discuss this service
LET’S UNDERSTAND YOUR NEEDS

Tell us what
you need.

Answer the service-specific questions, review your summary, and send your request to our team.

A high-level summary is enough. Please do not include passwords, payment card data or confidential system evidence.

Read our privacy notice

For urgent matters, call 091 003 4852

Discuss your requirements directly with our team.

Contact our team

Related services

Governance, Risk & Compliance

ISO/IEC 27001 & ISMS Consulting

Build an information security management system that connects organisational context, risk and continual improvement.

↗