PCI DSS

What the new mapping actually buys you, where teams misread it as control equivalence, and how much rework that mistake creates.

The Council named future technology and AI innovation in its request for comments. Here’s how the RFC process works and what happens next.

Blockchain C2 removes the domain you’d normally report. Why that pushes defense to exactly where PCI DSS 6.4.3 and 11.6.1 already point.

Two weeks after writing about the structural problems with compliance platforms, the allegations landed. What assessors already knew.

If the AppsFlyer script loads on your payment pages, you may have been serving malicious code. What the requirements actually ask you to do.

A reality check on compliance automation platforms, the gap between generated evidence and assessed controls, and the questions to ask.

PCI DSS v4.x wasn’t written with AI in mind. Here’s where the framework holds up, where there’s room to grow, and how the Council is engaging.

Twenty years of standards, assessor programs, and a global ecosystem. What the Council’s inaugural annual report says about where it’s heading.

Read-only evidence collection for assessor review: FortiGate, Palo Alto, Cisco, Azure, AWS, and OS-level configuration exports.

Stolen card data is sold at industrial scale. What the carding economy means for your PCI DSS scoping, and why many programs frame it wrong.