PCI DSS engineering for payment teams: we build the controls, your assessor validates them

Requirement 1 covers network security controls, 1.2.4 asks for an accurate data-flow diagram, and 12.5.2 for documented scope confirmed at least every 12 months. The engineering: infrastructure defined as code, so that the network is the diagram; default-deny paths between segments; and a data-flow map kept in the repository next to the code that changes it.

3.3.1 asks that sensitive authentication data is not stored after authorization, even if encrypted, and 3.5.1 that the PAN is rendered unreadable wherever it is stored. 4.2.1 asks for strong cryptography and security protocols when the PAN crosses open, public networks. The engineering: store only what you need, tokenize or truncate the rest, managed keys, TLS on every path and private network paths to data stores.

No fixed package covers cryptography and data protection on their own. We scope them in Discovery or with engineers by the hour.

6.2.1 and 6.2.4 ask for secure development and for techniques that prevent common software attacks, 6.3.2 for an inventory of custom software and its third-party components, and 6.5.1 for changes made with a reason, a security impact, approval and testing. 6.4.3 asks that every script loaded on a payment page is authorized, integrity-checked and inventoried, and 11.6.1 for change and tamper detection on payment pages. The engineering: a pipeline whose gates can stop a release, dependency and script inventories, and releases that are traceable.

Requirement 7 restricts access by business need to know, and Requirement 8 asks for identification and authentication, including 8.4.2, MFA for all non-console access into the cardholder data environment. The engineering: identities on your SSO, MFA, least privilege, secrets in a managed store and workload identity for services. Our own engineers use your accounts, and access is revoked when the engagement ends.

No fixed package covers access control on its own. We scope it in Discovery or with engineers by the hour.

10.2.1 asks that audit logs are enabled and active for all system components and cardholder data, and 10.5.1 that history is kept for at least 12 months with the latest three months immediately available for analysis. The engineering: logs from every component in one place, designed so that card numbers never land in a log line, alerts tested until they fire, and a runbook.

11.3.1 asks for internal vulnerability scans at least every three months with rescans until high-risk and critical findings are resolved, 11.4.1 for a defined penetration testing methodology, and 12.10.1 for an incident response plan that includes notifying the payment brands and acquirers and covers recovery and data backup. The engineering: scans in the pipeline on every change with suppressions that expire, and a runbook that names who decides and who is told.

Penetration tests and the quarterly external scans come from independent, qualified parties. We build the scans that run in your pipeline.

A 2-week build or re-architecture of your CI/CD pipelines and your infrastructure as code. The gates that go into the pipeline, such as a vulnerability scan, are agreed in the SOW.

Metrics, logs and traces wired, 3 SLOs defined, alerts tested until they fire, and a runbook.

A Playwright suite for your 5 critical flows, running in your CI, with accessibility checks.

Discovery understands your product and its configuration end to end and delivers a roadmap with a backlog, roles, critical changes and needs. Bring your scope diagram, the assessor's findings or the gaps from your self-assessment, and we turn them into engineering work.

For the work that continues after a package: Senior USD 45–⁠50 an hour, Lead or Architect USD 55–⁠60, with a 6-month minimum, billed per hour worked. You interview the engineer who will do the work.

• How staff augmentation works
• Security and procurement