PCI and NIST Compliance

Help meeting PCI DSS and aligning with the NIST Cybersecurity Framework, from security reviews to the evidence behind your controls. If your organization accepts credit cards, you are required to understand and maintain PCI compliance. We help you meet PCI DSS and align with NIST, which reduces your risk and protects your customers.

Tell us about your project > All services
A dark computer screen showing a blue technical interface with circular diagrams and security data

PCI DSS

The standard in six goals

The PCI Data Security Standard has twelve requirements, grouped into six goals. This is what each one asks of you.

  • Build and maintain a secure network

    Install and maintain network security controls, and apply secure configurations to all system components.

  • Protect account data

    Protect stored account data, and protect cardholder data with strong cryptography during transmission.

  • Maintain a vulnerability management program

    Protect all systems and networks from malicious software, and develop and maintain secure systems and software.

  • Implement strong access control

    Restrict access by business need to know, identify users and authenticate access, and restrict physical access to cardholder data.

  • Monitor and test networks regularly

    Log and monitor all access to system components and cardholder data, and test security systems and networks regularly.

  • Maintain an information security policy

    Support information security with organizational policies and programs.

PCI DSS assessment

Assessment support for hosting clients

  • Self-assessment

    We assess the hosting environment we run against PCI DSS, as a self-assessment.

  • For hosting clients

    We offer that assessment to hosting clients, to support their own validation.

How we help

From review to evidence

  1. 01

    Review

    We look at your network and your application.

    What we do

    Review your network, and audit your web application to identify problems that hackers might exploit to compromise your application and your data.

    What you get

    A clear picture of where you stand.

  2. 02

    Plan

    We write the remediation plan.

    What we do

    Work with you to create a remediation plan, in an order that makes sense.

    What you get

    A plan with priorities, not a list of everything.

  3. 03

    Implement

    We work with your IT team.

    What we do

    Work with your IT team to implement the plan, or do the work ourselves on systems we run.

    What you get

    Fixes made, and understood by the people who keep them.

  4. 04

    Prove

    We keep the evidence.

    What we do

    Keep the change records, test results and documentation current as we go, so the evidence exists when someone asks for it.

    What you get

    Evidence you can hand to an assessor.

  5. 05

    Keep it

    Alignment is continuous.

    What we do

    Monitor, patch and review on an ongoing basis, because staying aligned is continuous work, not an annual event.

    What you get

    A system that stays aligned after the assessment.

NIST Cybersecurity Framework

Six functions for managing cybersecurity risk

The NIST Cybersecurity Framework (version 2.0) organizes cybersecurity outcomes into six functions. We design, build and run systems in alignment with all six.

  • Govern

    Set the strategy, expectations and policy for managing cybersecurity risk.

  • Identify

    Understand your assets, suppliers and risks, so effort goes where it matters.

  • Protect

    Use safeguards, such as access control, secure configuration and encryption, to manage the risk.

  • Detect

    Find possible attacks and compromises, through monitoring and log analysis.

  • Respond

    Take action on a detected incident: contain it and find out what happened.

  • Recover

    Restore the systems and data affected, and learn from it.

Questions we hear

Straight answers

Do we need to comply with PCI DSS?
If your organization accepts credit cards, you are required to understand and maintain PCI compliance. Merchants are becoming more and more liable for credit card data theft.
Does Inetz offer a PCI DSS assessment?
We offer hosting clients a PCI DSS assessment of the environment we run, completed as a self-assessment, to support their own validation. It is a self-assessment, not a certification or a third-party validation.
What is the difference between PCI DSS and the NIST Cybersecurity Framework?
PCI DSS is a specific standard for protecting payment card data, with twelve requirements. The NIST Cybersecurity Framework is a broader way to manage cybersecurity risk, organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Many organizations work to both.
Is NIST alignment the same as certification?
No. NIST does not certify organizations against the Cybersecurity Framework, so the right word is alignment: how closely your practices match its outcomes. We align the systems we build and run with it. PCI DSS is different. It is validated through a self-assessment or a Qualified Security Assessor, and we help you prepare the systems and the evidence for that review.
Can you review our network or our web application?
Yes. We review your network, work with you on a remediation plan and work with your IT team to implement it. We can also audit your web application to identify problems that hackers might exploit.
What if we have already had a breach?
Call us. We contain it, find out what happened and clean up, and where payment card data may be involved we work alongside your acquirer and any forensic investigator they require.

Let's Talk
About PCI and NIST Compliance

Start a conversation

Tell us about your project >

See everything we do

Services >