.webp?width=2169&height=526&name=Compass%20regular%20transparent%20website%20(1).webp "Compass IT Compliance Logo")
-1.webp?width=2169&height=620&name=Compass%20regular%20transparent%20website%20smaller%20(1)-1.webp "Compass IT Compliance")
What Is a PCI DSS Gap Analysis & What Should You Expect to Find?
by Patrick Hughes on August 20, 2026 at 1:00 PM
Before an organization commits to a full PCI DSS assessment, most experienced QSAs recommend starting with a gap analysis. It is a lower-pressure, exploratory step that tells you where you actually stand before the clock starts on a formal engagement. Here is what a PCI gap analysis i …
Do You Need a QSA? How to Choose the Right Assessor for Your Firm
by Patrick Hughes on August 11, 2026 at 12:15 PM
If your business stores, processes, or transmits cardholder data, you have almost certainly come across the term QSA. But whether you actually need to hire one, and how to pick a good one if you do, is not always clear. This guide breaks down what a Qualified Security Assessor does, w …
SAQ A, Requirements 6.4.3 & 11.6.1: What the Eligibility Change Means
by Kyle Daun on July 29, 2026 at 4:14 PM
A question has been coming up recently among people who work with e-commerce merchants, and it can be a real head-scratcher the first time you hit it. A small merchant qualifies for SAQ A and notices that Requirements 6.4.3 and 11.6.1 are simply gone from the form. A larger merchant w …
How to Define Your Cardholder Data Environment (CDE) Under PCI DSS
by Patrick Hughes on June 28, 2026 at 1:30 PM
%20Under%20PCI%20DSS.jpg)
Before an organization can implement Payment Card Industry Data Security Standard (PCI DSS) controls, it must answer a foundational question: what is in scope? The answer lies in the definition of the Cardholder Data Environment (CDE). Get it wrong, and everything built on top of it i …
When to Hire a PCI Compliance Consultant (and What They Actually Do)
by Patrick Hughes on June 25, 2026 at 4:17 PM
.jpg)
If your business stores, processes, or transmits cardholder data, PCI DSS compliance isn't optional. But knowing that you need to comply is a very different thing from knowing how to actually get there. Somewhere between your first self-assessment questionnaire and your first failed s …
PCI DSS Compensating Controls: When & How to Use Them
by Kelly O’Brien on June 17, 2026 at 4:42 PM
Every organization that stores, processes, or transmits payment card data eventually runs into the same wall. The Payment Card Industry Data Security Standard (PCI DSS) sets a clear bar, but a legacy system, a vendor limitation, or a business reality can make a specific requirement im …