01
Cardholder data environment
Knowing exactly which systems store, process or transmit card data, and keeping that scope small.
PCI DSS
Prepare for PCI DSS with the evidence you already collect.
CyberPlug maps PCI DSS requirements to the same controls that serve ISO 27001 and the Bank of Ghana's directive, so shared evidence counts once and your card-data scope stays visible.
- Standard
- PCI DSS
- Issuer
- PCI Security Standards Council
- Principal requirements
- 12
What it is
What PCI DSS asks of you
PCI DSS is the security standard for any organisation that stores, processes or transmits payment card data. It sets technical and operational requirements to protect that data.
How you prove compliance depends on how much card data you handle: a self-assessment questionnaire for smaller scopes, or an assessment by a qualified assessor for larger ones.
Who needs it
- Card-accepting merchants, payment service providers, card issuers and acquirers.
- Institutions the Bank of Ghana expects to hold PCI DSS because they handle card data.
What it covers
Where the standard focuses
02
Network security
Controls that separate and protect those systems.
03
Access control
Who can reach card data, and how that access is granted, reviewed and removed.
04
How you prove it
A self-assessment questionnaire or a qualified assessor's report, depending on how much card data you handle.
The problem
Scope is the first argument
- Nobody agrees which systems are in scope until an assessor draws the boundary.
- Many PCI requirements repeat controls you already evidence for ISO 27001, and are collected again from scratch.
- Evidence expires, and the next assessment finds the gap.
How CyberPlug helps
Keep scope visible, reuse the evidence
- 01
PCI DSS requirements mapped to your controls
Requirements link to the same controls that serve ISO 27001 and the Bank of Ghana's directive, so one piece of work satisfies all three.
- 02
Describe your estate once
Record your infrastructure, software and the data you hold in Quickstart. Every framework you work in reads from that one description.
- 03
Evidence from your systems
Read-only connectors check access control, encryption and logging settings in AWS, GitHub, Google Workspace, Okta and PostgreSQL every 24 hours. Documents without an API are uploaded and reviewed the same way.
- 04
A person approves everything
A control passes only when its automated checks pass and its evidence is active and valid. Automation never approves a control.
- 05
Readiness you can see
A live readiness score shows which requirements still lack evidence and who owns each one. Your assessor can be given read-only access.
Path to ready
From scoping to validation
- 1
Define your scope
Write down which systems store, process or transmit card data.
- 2
Assign owners
Give every control and requirement a named owner.
- 3
Connect and upload evidence
Start collection from the systems you run and upload what has no API.
- 4
Close the gaps
Work the list of requirements still missing evidence.
- 5
Complete your validation
Submit your self-assessment questionnaire or work with a qualified assessor. CyberPlug prepares the evidence and does not validate or certify.
Which validation applies to you depends on how much card data you handle. Your acquirer or payment brands can tell you.
One control, many frameworks
Evidence you collect once counts across frameworks
Access control, encryption and logging appear in both ISO 27001 and PCI DSS, and the Bank of Ghana's directive asks institutions that handle card data to hold PCI DSS. One control, one owner, one piece of evidence.
FAQ
Questions we hear most
Does CyberPlug make us PCI DSS compliant?
No. CyberPlug organises your controls and evidence so that your validation goes faster. Compliance is confirmed by your self-assessment or a qualified assessor.
Which validation applies to us?
It depends on how much card data you handle. Your acquirer or payment brands can tell you whether it is a self-assessment questionnaire or an assessor's report.
Does the Bank of Ghana require PCI DSS?
The directive asks institutions that handle card data to hold it.
Does CyberPlug read our cardholder data?
No. Connectors read configuration metadata, such as whether encryption is on. They never read your data, and every connector is read-only.