More information

Undocumented information system

In many of our clients, we have encountered a situation when, due to the fact that various parts of the system were historically created over many years and their development was not properly documented, the client was often unable to explain to us what specific data actually passes through the various parts of the information system.

Storage of sensitive post-authorization payment transactions

Under no circumstances may merchants store sensitive data (such as the full card number) after a payment transaction has been authorised, for example in event logs, backups or directly in the database.

Information security compliance issues

PCI DSS is an information security standard and requires a comprehensive solution to this issue within an organisation. However, we often encounter a situation with our clients where information security is not adequately addressed. Typical examples may include missing or inadequate event logging (logging and monitoring), lack of a process for regularly updating security patches, inadequate control over change management, or lack of security awareness among company employees.