PCI Forensic Investigator (PFI)
PCIComplianceHubLast updated
A company qualified by the PCI Security Standards Council to investigate suspected payment card data compromises. After a breach, a payment brand or acquirer typically requires the affected entity to engage a PFI, which determines how the compromise occurred, what account data was exposed, and whether the entity was compliant at the time. The resulting report goes to the payment brands and the acquirer, not only to the entity that commissioned it.
Applies to. No PCI DSS v4.0.1 requirement names the PFI; engaging one after a suspected compromise is a payment brand rule, not a control in the standard. What the standard asks is in Requirement 12: an incident response plan that is in place, tested at least annually and covers notification of the payment brands and acquirers, and that notification is what usually triggers the brand's demand for a PFI. The PFI is chosen from the Council's list, works under the brands' forensic programme and reports to the brands and acquirer as well as to the entity; the entity's contract, evidence preservation and cooperation are its own concern and are not assessed under PCI DSS.