Insights
PCI DSS, Cyber Essentials and ISO 27001 Guides from Our Assessors
Our PCI compliance and cyber security blog: practical, plain-English guides on PCI DSS, Cyber Essentials, ISO 27001 and penetration testing, written by our assessors and penetration testers. Filter by topic below, or browse each topic's guides and services further down.
PCI DSSPCI Network Segmentation: How to Design and Test a Compliant NetworkHow PCI network segmentation works under v4.0.1: define the CDE, choose controls that isolate it, avoid VLAN pitfalls and prove it with segmentation tests.
PCI DSSPCI DSS Compliance Roadmap: A Five-Phase TemplateA free PCI DSS compliance roadmap template (Excel) in five phases, from scoping and gap analysis to remediation, assessment and BAU, with owners and timelines.
PCI DSSPCI DSS Business as Usual: How to Stay Compliant All YearWhat PCI DSS business as usual means under v4.0.1, with a year-round compliance calendar, change-control checks and the evidence your QSA will ask for.
PCI DSSPCI ROC vs AOC (Attestation of Compliance) vs SAQ ExplainedWhat a PCI Attestation of Compliance (AOC), Report on Compliance (ROC) and SAQ are, who needs which, who signs them and how long an AOC stays valid.
PCI DSSContact Centre PCI Compliance: Requirements for UK Call Centres (v4.0.1)Contact centre PCI compliance in the UK under PCI DSS v4.0.1: what is in scope, the requirements that matter, home agents, outsourced centres and assessment prep.
PCI DSSPCI Compliance for SaaS Companies: Scope, Cloud and Customer EvidencePCI compliance for SaaS explained: when a SaaS company is a merchant or a PCI DSS service provider, how to keep cloud scope small and what customers will ask for.
PCI DSSPCI DSS for E-commerce: Payment Page Scripts (6.4.3 & 11.6.1)What PCI DSS 6.4.3 and 11.6.1 require for payment page scripts, how they counter Magecart skimming, who they apply to after the SAQ A change and how to comply.
PCI DSSPCI SAQ A vs SAQ A-EP: Which Applies to Your Website After January 2025?PCI SAQ A explained: the January 2025 script-attack eligibility criterion, how your checkout decides between SAQ A and SAQ A-EP, and how to move to SAQ A.
PCI DSSHow to Fill Out a PCI SAQ Without the Common MistakesHow to fill out a PCI SAQ step by step, with a completion checklist and the eight mistakes a QSA sees most often, from the wrong SAQ type to bad N/A answers.
PCI DSSWhich PCI SAQ Do I Need? All SAQ Types Explained (v4.0.1)Which PCI SAQ do you need? Compare every PCI DSS v4.0.1 SAQ, check eligibility for SAQ B, B-IP, C and C-VT, find yours in a few questions and avoid common mistakes.
PCI DSSPCI DSS Risk Assessment: Targeted Risk Analysis Template and Worked ExamplesLooking for a PCI DSS risk assessment template? v4.0.1 replaced it with targeted risk analyses. Download a free TRA template, with examples and what QSAs check.
PCI DSSPCI DSS Compensating Controls Explained (With Worked Examples)What PCI DSS compensating controls are, when they are allowed, the four criteria, how to fill in the worksheet and how they differ from the customised approach.
PCI DSSCommon PCI Audit Failures: 12 Findings and How to Avoid ThemPCI audit failures that assessors find again and again under PCI DSS v4.0.1, from scope and MFA to scans and scripts, and how to fix each before fieldwork.
PCI DSSPCI Compliance Scope: How to Define and Reduce Your Cardholder Data EnvironmentPCI compliance scope under v4.0.1: what the cardholder data environment is, which systems are in scope, how often to confirm scope and how to reduce it.
PCI DSSHow to Prepare for a PCI Audit: A Step-by-Step Plan for PCI DSSHow to prepare for a PCI audit under PCI DSS v4.0.1: confirm ROC or SAQ, fix scope, close gaps, finish scans and tests, organise evidence and handle fieldwork.
PCI DSSPCI Compliance for Small Businesses: What You Need to DoPCI compliance for small businesses explained: what PCI Level 4 means, which SAQ you need, what you must submit each year and how to cut your scope.
Penetration TestingPenetration Testing Companies in the UK: How to Choose (2026 Shortlist)Penetration testing companies in the UK compared: how to shortlist pen testing firms, verify accreditations, judge scoping and spot a relabelled scan.
Security AwarenessWhat Is a Phishing Simulation? Examples and How to Run One FairlyWhat is a phishing simulation? A plain-English definition, seven phishing simulation examples from easy to hard, the metrics that matter and how to run one fairly.
Penetration TestingWireless Security Audit Checklist: 10 Checks for Your Wi-Fi NetworksA 10-point wireless security audit checklist (free Excel download) covering WPA3, 802.1X, rogue access points, guest isolation and what PCI DSS 11.2 requires.
Penetration TestingMobile App Security Testing Checklist for iOS and Android (OWASP MASVS)A mobile app security testing checklist for iOS and Android, built on the OWASP MASVS: storage, crypto, auth, network, platform, code, resilience and privacy.
Penetration TestingDoes AWS Allow Penetration Testing? AWS, Azure and Google Cloud RulesDoes AWS allow penetration testing? Yes, for listed services without pre-approval. See the AWS, Azure and Google Cloud rules, what is banned and how to scope.
Penetration TestingAPI Security Checklist: 20 Checks Mapped to the OWASP API Top 10A free 20-point API security checklist mapped to the OWASP API Security Top 10: authorisation, authentication, data exposure, rate limits and what a pen test adds.
Penetration TestingHow Often Should Penetration Testing Be Done? PCI DSS, ISO 27001 and Insurance RulesHow often should penetration testing be done? Yearly and after significant change. See which standards require it, from PCI DSS to UK GDPR, and what insurers ask.
Penetration TestingPenetration Test Remediation: What to Do When the Report ArrivesPenetration test remediation step by step: triage the report, prioritise vulnerability remediation by real risk, fix or mitigate, meet PCI DSS deadlines and retest.
PCI DSSPCI DSS Gap Analysis: What It Covers, How It Works and What You GetWhat a PCI DSS gap analysis covers under v4.0.1, how it works step by step, how long it takes, what you get and how it differs from a readiness review.
Penetration TestingPenetration Test Report: What It Contains and How to Read ItWhat a penetration test report contains, with a report template and an example finding: how to read the scope, summary and risk ratings, then turn them into fixes.
Penetration TestingHow to Prepare for a Penetration Test: A Checklist for Your TeamHow to prepare for a penetration test: set objectives, agree scope and rules of engagement, brief your people and get systems and accounts ready for day one.
PCI DSSPCI DSS 4.0.1: What Changed, Key Dates & Future-Dated RequirementsPCI compliance 4.0 explained: what PCI DSS 4.0 changed from v3.2.1, what v4.0.1 corrected, the key dates and a tracker of the future-dated requirements.
PCI DSSPCI 3DS Explained: The 3DS Core Security Standard and Who Needs ItWhat PCI 3DS is, who must comply with the 3DS Core Security Standard, how Part 1 and Part 2 work, how it differs from PCI DSS and how to prepare for it.
PCI DSSPCI PIN Security Requirements: What PCI PIN Compliance Means and Who Needs ItThe PCI PIN Security Requirements explained: who must comply, the seven control objectives, how PIN security differs from PCI DSS and what a QPA checks.
Penetration TestingActive Directory Penetration Testing: Common Attack Paths and How to Close ThemActive Directory penetration testing explained: the common attack paths from a standard user to Domain Admin, how testers chain them, and the fixes that work.
ISO 27001How to Choose an ISO 27001 Consultant in the UKHow to choose an ISO 27001 consultant in the UK: what to look for, red flags, consultant vs certification body, published day rates and questions to ask first.
Cyber EssentialsWhat Happens in a Cyber Essentials Assessment? An Assessor's ViewWhat happens in a Cyber Essentials assessment, explained by an assessor: each step, how answers are marked, the automatic fails and the answers that often fail.
Penetration TestingInternal vs External Penetration Testing: Differences and When You Need EachInternal vs external penetration testing compared: what each simulates and finds, what PCI DSS requires, how cost differs and which test to run first.
Security AwarenessCyber Security Awareness Training: How to Build a Programme That WorksHow to build cyber security awareness training for employees: free courses, what to cover, how often to train, how to measure it and what PCI DSS and ISO 27001 need.
ISO 27001Information Security Management Systems (ISMS): A Practical GuideISMS meaning explained: what an information security management system is, what ISO 27001:2022 requires of one, and how to build, audit and certify it.
Cyber EssentialsThe 5 Cyber Essentials Controls: What Each One InvolvesCyber Essentials controls explained by a certification body: the five technical controls of the Cyber Essentials framework, what each needs and where firms fail.
Security Awareness13 Types of Social Engineering Attacks and How to Test Your DefencesTypes of social engineering attacks explained: phishing, vishing, pretexting, tailgating and nine more, with examples, defences and how to test them.
Penetration TestingPenetration Testing vs Vulnerability Scanning: What's the Difference?Penetration testing vs vulnerability scanning: how they differ in depth, frequency and cost, automated vs manual testing, what PCI DSS requires and which you need.
PCI DSSWhat Is P2PE? Point-to-Point Encryption, Validated Solutions & SAQ P2PEWhat is P2PE? How PCI point-to-point encryption works, P2PE vs E2EE, how to check a solution is PCI-listed and what SAQ P2PE still asks of merchants.
PCI DSSPCI PIN Assessment in Dubai: A Qualified PIN Assessor (QPA) Guide for UAE FirmsPCI PIN assessment in Dubai and the UAE: which banks, processors and key injection facilities need one, how it fits UAE regulation and how to choose a QPA.
PCI DSSHow to Choose the Best PCI QSA Company in the UK (and Verify One)How to choose the best PCI QSA company in the UK: verify an assessor on the PCI SSC list, compare firms, check independence and ask these questions first.
PCI DSSPCI Firewall Requirements: PCI DSS Requirement 1 and Network Security ControlsPCI firewall rules explained: do you need a firewall for PCI compliance, what Requirement 1 asks of network security controls and how six-monthly reviews work.
ISO 27001The Benefits of ISO 27001: Commercial, Operational and RegulatoryThe benefits of ISO 27001 for UK organisations: winning contracts, fewer security questionnaires, better risk decisions, and whether it is worth the cost.
Cyber EssentialsCyber Essentials vs Cyber Essentials Plus: What's the Difference?Cyber Essentials vs Cyber Essentials Plus compared by a certification body: how each is assessed, typical UK prices, timescales and which one you need.
PCI DSSHow to Pass a PCI Compliance Scan: The ASV Scan Guide (Requirement 11.3.2)How to pass a PCI compliance scan (ASV) first time: what Requirement 11.3.2 asks for, why scans fail, how to fix or dispute findings and plan each quarter.
Data ProtectionGDPR Compliance Audits: A Practical Guide for UK OrganisationsHow to plan and run a UK GDPR compliance audit: what it covers, a step-by-step method, internal or independent review, and reusing ISO 27001 and PCI DSS work.
Cyber EssentialsCyber Essentials Changes 2026: The Danzell (v3.3) Update ExplainedCyber Essentials changes 2026 explained: the Danzell question set, v3.3 requirements, new automatic-fail questions, scope rules and stricter CE+ retests.
PCI DSSPCI Compliance Requirements: The 12 PCI DSS Requirements Explained (v4.0.1)PCI compliance requirements explained: the 12 PCI DSS v4.0.1 requirements in plain English, the six goals behind them and the evidence a QSA will want.
PCI DSS guides
PCI DSS requirements, SAQs, scoping, ASV scans and assessments, explained by a PCI SSC Qualified Security Assessor (QSA) company. Start with the basics or go straight to the service.
Penetration Testing guides
How penetration tests are scoped, run and reported, and what PCI DSS, Cyber Essentials Plus and ISO 27001 expect from them. Read the overview or see what we test.
Cyber Essentials guides
The five controls, the Danzell question set and what assessors look for, from an IASME-licensed certification body. Quick answers are in our FAQs.
ISO 27001 guides
Information security management systems, the benefits of certification and how to choose a consultant. Learn what the standard asks for, then how we help you meet it.
Security Awareness guides
Phishing, social engineering and awareness training: how attacks on people work and how to measure your defences. Our testing pages explain how a fair test is run.
Data Protection guides
UK GDPR audits and how data protection law fits with security standards. See how GDPR overlaps with the certifications your customers ask for.
Free consultation
Prefer to talk it through?
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“We would happily recommend them to any company in need of the services mentioned.”
Call +44 161 523 5276
Email [email protected]