PCI DSS Compliance: Implement the Controls That Protect Cardholder Data.

Not in the way the word is often used. PCI DSS compliance is validated each year, not awarded as a permanent certificate. Most merchants complete a Self-Assessment Questionnaire and an Attestation of Compliance; the largest merchants have a Qualified Security Assessor prepare a Report on Compliance. People sometimes say PCI certified, but the accurate framing is that you validate compliance annually and maintain the controls continuously. Cyber One Solutions implements and operates those controls and prepares the evidence behind whichever validation your merchant level requires.

Any organization that stores, processes, or transmits cardholder data. That includes merchants of every size that accept payment cards and the service providers that handle card transactions or cardholder data on behalf of others. Compliance is required by the card brands and your acquiring bank as a condition of accepting cards, regardless of how many transactions you run. The amount of validation work scales with your transaction volume and how you handle card data, but the obligation itself applies as soon as card data touches your business.

The card brands define four merchant levels based mainly on annual transaction volume, and your acquirer assigns yours. Level 1 covers the largest merchants, generally those above six million card transactions a year, and any merchant that has suffered a breach; they validate with an annual Report on Compliance from a Qualified Security Assessor. Level 2 generally covers one to six million transactions a year, Level 3 covers mid-range e-commerce volumes, and Level 4 covers the smallest merchants; these levels validate with the appropriate annual Self-Assessment Questionnaire. Exact thresholds vary slightly by card brand, so your acquirer is the authority on your level and your validation requirements.

A Self-Assessment Questionnaire is a validation tool that lets eligible merchants and service providers assess and attest to their own PCI DSS compliance, with the questionnaire type matched to how they handle card payments. It is how most merchants, Levels 2 through 4, validate each year. A Report on Compliance is a formal assessment performed by a Qualified Security Assessor, an independent assessor accredited by the PCI Security Standards Council, and is required for Level 1 merchants. The Report on Compliance involves the assessor examining and testing your controls directly. Cyber One Solutions prepares you for either path, completing the Self-Assessment Questionnaire with you or supporting the Qualified Security Assessor through a Report on Compliance, but we are not a Qualified Security Assessor and do not issue the report ourselves.

Cyber One Solutions implements and operates the security controls PCI DSS requires: network security controls and segmentation to reduce scope, encryption of stored and transmitted cardholder data, anti-malware and patch management, access control with multi-factor authentication, centralized logging and monitoring, and a tested incident response plan.

We run the readiness and gap assessment, map where card data flows, help you scope the cardholder data environment and select the correct Self-Assessment Questionnaire, coordinate the quarterly Approved Scanning Vendor scans, and maintain the evidence behind your validation.

A Qualified Security Assessor, when one is required, independently assesses your controls and prepares the Report on Compliance; an Approved Scanning Vendor runs the external scans; and your acquirer and the card brands set your merchant level and accept your validation. We prepare and support those processes; we are not a QSA or an ASV. We serve merchants and service organizations across Texas, Tennessee, and the United States.