PCI DSS consulting & implementation

Has your payment provider requested PCI DSS evidence? Are you building a checkout or running a platform that accepts card payments? We identify the systems, processes and providers involved and the work your business needs to do. Our IT consulting connects the requirements to your existing architecture.

PCI DSS protects payment card data. It applies to businesses that store, process or transmit that data, as well as systems and providers that can affect its security. Its twelve requirement areas cover network security, access controls, secure software development, monitoring, testing and security processes.

• Review payment flows, your business model and existing validation requirements.
• Clarify responsibilities across your team, hosting and payment providers.
• Define priorities, owners and verifiable outcomes for the next steps.

We start with the actual path of card data: from the browser through interfaces and servers to logs, backups and external providers. We document the Cardholder Data Environment (CDE) and review connected systems that can affect its security.

We then assess gaps against the applicable requirements of PCI DSS v4.0.1. You receive an overview of existing controls, open issues and missing evidence. Where changes to payment flows or tokenisation could keep card data out of your own systems, we evaluate the implementation and its effect on scope.

• Document data flows, system boundaries, access and service providers.
• Assess technical and organisational gaps with your team.
• Create an action plan that identifies effort, dependencies and owners.

Whether you run an online shop, booking platform or custom application, the integration method affects your PCI DSS workload. We review redirects, embedded payment forms, hosted payment pages and direct connections to payment providers.

We implement the agreed integration and check where sensitive data might inadvertently enter your own systems, including error logs, analytics tools and support workflows. We also review APIs, webhooks and administrative access in the context of your payment flow. For Shopify or WooCommerce, we also review how themes, plugins and tracking affect the payment page.

• Review payment architecture and integrations for unnecessary exposure to card data.
• Implement and test checkout, interfaces and error handling.
• Document provider responsibilities and the obligations that remain with the merchant.

Third-party scripts, tag managers and dynamically loaded content can affect checkout security. We review which scripts run on relevant pages, why they are needed and how changes are detected. We focus on requirements 6.4.3 and 11.6.1 where they apply to your environment.

The revised SAQ A removed these two requirements from the questionnaire in 2025. Merchants with embedded payment forms must still meet an eligibility criterion addressing script attacks. That specific criterion does not apply to pages that only redirect customers to the payment provider. We therefore assess the actual integration and help agree the appropriate validation route with the responsible parties.

• Establish an inventory, authorisations and justifications for relevant payment scripts.
• Support integrity checks and detection of unauthorised changes with suitable controls.
• Define alerting, responsibilities and evidence for ongoing operations.

An action plan becomes useful when the controls work in day-to-day operations. We make the agreed changes in your web development and work with your IT team on configurations, access paths and operating processes.

Depending on scope, this includes system hardening, patch management, roles and permissions, multi-factor authentication, logging and secure development practices. Encrypted transmission using TLS/HTTPS is one component. We also review vulnerability management, change management and incident response.

• Implement and document technical controls suited to your systems.
• Make security tasks part of development, release and operations.
• Coordinate required tests and external assessments with the responsible providers.

We help you assemble technical answers and evidence for a Self-Assessment Questionnaire (SAQ) or prepare for an assessment. Confirm the accepted questionnaire and evidence with your acquirer or the relevant payment brand. We support the technical discussions.

Depending on your classification, validation may involve an SAQ with an Attestation of Compliance (AOC), a Report on Compliance (ROC) or other evidence. We prepare system descriptions, configuration evidence and remediation records. Required QSA assessments are performed by a Qualified Security Assessor; required ASV scans by an Approved Scanning Vendor.

• Translate requirements into specific questions for development and operations.
• Organise evidence and address open issues before submission.
• Support technical responses to your acquirer, payment brand or external assessors.

IVIS MEDIA has delivered PCI DSS projects for American Express (AMEX). We bring that experience to consulting and implementation for your business: understanding requirements, turning them into practical tasks and working through them with the teams involved.

In the initial discussion, we review your payment processes, existing systems and any documents your provider has requested. This defines the engagement. You can then decide whether to start with an assessment of the current setup, changes to your integration or preparation of evidence.

• Consulting and implementation by a web and software agency based in Berlin.
• Collaboration with internal teams and existing payment providers.
• An agreed scope for analysis, development and ongoing support.

A new payment provider, a plugin update or additional scripts can change your previous assessment. We help you identify relevant changes early and keep controls, evidence and responsibilities up to date.

Our technical references include information from the PCI Security Standards Council, the official SAQ A eligibility guidance and the payment page security guidance. We agree the level of ongoing support based on your systems and internal resources.

• Review checkout, infrastructure and provider changes for their effect on scope.
• Plan recurring tasks and tests with the responsible teams.
• Maintain documentation for subsequent validation and technical questions.