Resources
Plain-language guides to the standards our clients work with, readiness checklists, and a glossary of the terms auditors use.
Articles
Readiness checklists
A one-page checklist for each framework, ready to print. Tell us who you are and we will open it for you.
Glossary
- AOC
- Attestation of Compliance: the formal PCI DSS declaration of compliance status that accompanies a ROC or SAQ.
- ASV
- Approved Scanning Vendor: a company approved by the PCI SSC to run the quarterly external vulnerability scans PCI DSS requires.
- Attack surface
- Everything an attacker could try to reach: exposed services, applications, accounts, people and suppliers.
- CDE
- Cardholder data environment: the people, processes and systems that store, process or transmit card data, or can affect its security.
- CERT-In
- Indian Computer Emergency Response Team, the national agency for cyber incident response under MeitY.
- CVE
- Common Vulnerabilities and Exposures: a public identifier for a known vulnerability, such as CVE-2024-3094.
- CVSS
- Common Vulnerability Scoring System: a 0 to 10 scale for rating vulnerability severity.
- Defence in depth
- Layering independent controls so that one failure does not expose the whole system.
- EDR
- Endpoint detection and response: software that watches devices for malicious behaviour and can isolate them.
- Gap analysis
- A comparison of current controls against a standard, showing what is missing or weak.
- ISMS
- Information Security Management System: the policies, processes and controls that ISO/IEC 27001 certifies.
- Kill chain
- The stages an intrusion passes through, from reconnaissance to actions on objective. Breaking any stage stops the attack.
- MFA
- Multi-factor authentication: proving identity with two or more factors, such as a password plus a one-time code.
- Penetration test
- An authorised, simulated attack that proves which weaknesses can actually be exploited.
- Phishing
- Deceptive messages that trick people into revealing credentials, paying money or running malware.
- QSA
- Qualified Security Assessor: a company and staff qualified by the PCI SSC to perform PCI DSS assessments.
- Ransomware
- Malware that encrypts data and demands payment for the key, often after stealing a copy first.
- ROC
- Report on Compliance: the detailed PCI DSS assessment report, usually produced by a QSA.
- SAQ
- Self-Assessment Questionnaire: a PCI DSS self-assessment for eligible merchants and service providers.
- SIEM
- Security information and event management: collects and correlates logs to raise alerts.
- SoA
- Statement of Applicability: the ISO/IEC 27001 record of which Annex A controls apply and why.
- VAPT
- Vulnerability assessment and penetration testing, often delivered together.
- WAF
- Web application firewall: filters web traffic to block attacks such as SQL injection and XSS.
- Zero-day
- A vulnerability unknown to the vendor, so no patch or signature exists yet.