Mon – Fri: 08:00 – 18:00 02 8883 3377
Client support portal

PCI DSS

Take card payments without taking chances.

If your organisation accepts card payments, from donation pages to EFTPOS terminals, PCI DSS applies to you. We help you shrink the scope of what's in play, put the required technical controls in place and prepare the evidence for your self-assessment questionnaire or assessor, so compliance is manageable rather than overwhelming.

Talk to us 02 8883 3377

What's included

PCI DSS Compliance Support

  • Scope reduction

    Card data flows mapped and redesigned so as few systems as possible ever touch it.

  • The right questionnaire

    Help identifying which self-assessment questionnaire applies to the way you take payments.

  • Technical controls

    Network segmentation, MFA, logging, patching and hardening to the requirements of PCI DSS v4.0.1.

  • Vulnerability scanning

    Internal scans run by us, and quarterly external scans coordinated with an Approved Scanning Vendor.

  • Policies and records

    The written policies, inventories and records the standard requires, kept current.

  • Support for your assessor

    We work alongside your QSA or acquiring bank, answering technical questions and supplying evidence.

The outcome

What changes for you.

  • A smaller compliance scope
  • The right questionnaire, completed accurately
  • Controls that satisfy your bank
  • Less risk of card data theft

FAQ

Common questions.

Something else on your mind? Call us and talk to an engineer, not a salesperson.

02 8883 3377
Does PCI DSS apply if we use a payment provider?

Yes, although outsourcing payments usually reduces your obligations a great deal. Even with hosted payment pages or EFTPOS terminals, you'll typically complete a shorter self-assessment questionnaire each year.

Are you a QSA?

No. We're your technical partner: we implement and maintain the controls and prepare the evidence, while assessments are completed by you, your bank or an independent Qualified Security Assessor.

What changed with PCI DSS version 4?

Version 4 brought in requirements such as wider use of MFA, stronger password rules and controls on scripts in payment pages. Its future-dated requirements became mandatory on 31 March 2025, and version 4.0.1 is the release in force.

Related services

Security review

Let's talk about your IT and security.

Our security review assesses your environment against the Essential Eight and best practice, ranks the biggest risks and gives you a practical, costed plan to fix them, in plain English.

Book a review 02 8883 3377