Articles on cybersecurity
12 Practices to Protect Card Data, and What PCI DSS v4.0.1 Asks for Each
The PCI Security Standards Council's twelve data security practices for small merchants, each set against the PCI DSS v4.0.1 requirements that make it specific: password length, patch deadlines, terminal inspections, scans and more.
Approved Scanning Vendors (ASVs): The Quarterly External Scan, Its Scope, and Choosing a Provider
What PCI DSS v4.0.1 Requirement 11.3.2 asks of external vulnerability scans, what the Approved Scanning Vendor decides and what stays with you, how to scope a scan, and what to ask an ASV before signing.
Do You Need a PCI DSS Audit? Here's How to Determine If and When
Who needs a formal PCI DSS assessment by a QSA and who can self-assess: what the SAQ instructions say, why merchant levels come from the payment brands, and what the standard asks for between assessments.
Using Network Segmentation to Reduce PCI DSS Scope
What network segmentation does under PCI DSS v4.0.1: why the standard does not require it but scope depends on it, what counts as isolated, and the testing and yearly scope confirmation that keep it counting.
PCI Compliance 101: What PCI DSS v4.0.1 Is and How You Meet It
The basics of PCI DSS v4.0.1 for a business that takes cards: who it applies to, what counts as in scope, which card data may be stored, how compliance is validated, what changed in v4.x, and what has to happen between assessments.
PCI DSS Requirement 5.4.1: Protecting Personnel Against Phishing
What PCI DSS v4.0.1 Requirement 5.4.1 asks for: processes and automated mechanisms against phishing, who they must protect, how they are tested, where DMARC, SPF and DKIM fit, and how it differs from the phishing training in 12.6.3.1.
QR Code Phishing and PCI DSS
How QR code phishing works, in messages and on printed codes, which PCI DSS v4.0.1 requirements it touches, and what a business that displays QR codes for payment can do about tampering.
How to Recognise and Avoid Phishing Attacks
The warning signs of a phishing message, the forms it takes, what to do if you have responded to one, and the PCI DSS v4.0.1 requirements that ask organisations handling card data to defend against it.
Understanding PCI DSS 11.6.1: Detecting Changes to Payment Pages
What PCI DSS v4.0.1 Requirement 11.6.1 asks for: a mechanism that alerts on unauthorised changes to a payment page's security-impacting HTTP headers and scripts as the browser receives them, how often it must run, who it applies to since SAQ A changed in January 2025, and the techniques the standard names.
HSTS and PCI DSS: What HTTP Strict Transport Security Does for a Payment Site
What HTTP Strict Transport Security protects against, how it relates to PCI DSS v4.0.1 Requirements 4.2.1 and 11.6.1 even though the standard does not name it, and how to deploy it and the preload list without breaking a site.
How to Select a Qualified Security Assessor (QSA) for PCI DSS
What a QSA does and does not do, how to confirm a company is on the PCI Security Standards Council's list, what to ask before engaging one, and where to send feedback about an assessor.
Should my Service Provider be PCI Compliant?
The PCI Security Standards Council's answer: Requirement 12.8 does not make your service providers validate as compliant, but any requirement a provider meets for you counts in your assessment. What to ask for, what the standard asks of them, and how to record who does what.
Storing CVV: What Merchants Need to Know
What PCI DSS v4.0.1 says about the card verification code: it may not be stored once authorisation completes, what is allowed before that, where it tends to hide, and what counts as a CVV and what does not.