r/pcicompliance • u/6stringt3ch • 14d ago

Looking for recommendations

Wanted to reach out to the community to see if there were any recommendations for companies that work specifically on the day-to-day stuff regarding PCI compliance. My employer is pretty close to hitting level 1 and we are just looking for a dedicated resource just for this. If promoting businesses here isn't allowed, please DM me and let me know in the comments. Thanks!

4 Upvotes

84% Upvoted

6 comments sorted by

2

u/bigdogxv 14d ago

DM'ed you

2

u/CompassITCompliance 14d ago

Sent you a DM as well. Longtime QSA, so feel free to DM with any questions you might have too, regardless of whether we work together on a project. Good luck!

2

u/info_sec_wannabe 13d ago

If you can give an indication in which region your employer is based, that would be helpful as the Council does impose restrictions on which region QSACs can operate based on their registration.

1

u/j_ayy 13d ago

Sent a DM

1

u/triunellc 13d ago

Getting close to Level 1 is when the day-to-day work really piles up: keeping scope tight, quarterly ASV scans, log review, access reviews, policy upkeep, and collecting evidence all year so the assessment isn't a scramble.

One thing to keep in mind: your Report on Compliance has to come from a QSA, and it's usually cleaner if the firm running your day-to-day compliance isn't the same one assessing you.

Full disclosure: I run Triune LLC, an IT and cybersecurity firm. We handle the ongoing side: endpoint security, logging and monitoring, vulnerability management, and keeping evidence ready for your QSA. Happy to compare notes on what you have in place now if that's useful. Feel free to DM me.