ISO Lead Auditors · PCI QSA & 3DS Assessor · SOC & government assessors — conflict-free, across NZ & AU.
Practical PCI DSS guidance from Cianaa’s QSA team: v4.0.1 requirements, SAQ selection, scoping, client-side security, ASV scanning and assessment preparation for businesses in New Zealand, Australia and beyond.
Can you use SAQ eligibility criteria to decide which PCI DSS requirements apply in a Report on Compliance? PCI SSC FAQ 1331 says no, unless your acquirer has approved it. Here is what that means.
New Cianaa research systematically reviewed 81 studies comparing FIDO2/WebAuthn against SMS, TOTP and push MFA. The security gap is roughly fourfold, and it matters for PCI DSS Requirement 8.5.1.
Most breached organisations believed they were compliant. A PCI QSA closes the gap between compliant on paper and genuinely secure, reducing both compliance-failure and breach risk.
Generative AI removed every tell that phishing training taught. A cybersecurity assessor explains why user detection can no longer be your primary defence, and what replaces it.
Australia’s card fraud hit A$762m even as 90% of large merchants pass PCI DSS. A QSA explains the card-not-present gap and why compliance and fraud detection have drifted apart.
Since 31 March 2025, MFA is required for everyone accessing the CDE, and the standard now tests how well it is implemented. The three scenarios in 8.4, the 8.5.1 quality rules, and the failure patterns assessors find.
Your cloud provider’s PCI attestation does not make your workload compliant. How responsibility really divides across IaaS, PaaS and SaaS, the documents to collect under 12.8.5, and the cloud pitfalls assessors keep finding.
Scope is where PCI programmes go wrong and where the money is. How scoping works under v4.0.1, the annual confirmation Requirement 12.5.2 demands, segmentation testing under 11.4.5, and the places cardholder data hides.
A plain-language walkthrough of a QSA assessment: the six phases, what a ROC and AoC actually are, realistic first-year timelines, and the factors that genuinely drive cost.
PCI DSS v4.0.1 lets you meet requirements the defined way or with your own customized controls. A QSA’s honest guide to what the Customized Approach really costs, its restrictions, and when it genuinely makes sense.
We use essential cookies to run this site and, with your consent, analytics & tools (e.g. Google Analytics, HubSpot) to improve it. See our Cookies & Privacy Policy.