ISO Lead Auditors · PCI QSA & 3DS Assessor · SOC & government assessors — conflict-free, across NZ & AU.
Practical PCI DSS guidance from Cianaa’s QSA team: v4.0.1 requirements, SAQ selection, scoping, client-side security, ASV scanning and assessment preparation for businesses in New Zealand, Australia and beyond.
Merchants often assume redirecting to a payment provider removes the need for vulnerability scans. PCI SSC FAQ 1604 says otherwise: SAQ A includes ASV scanning under Requirements 11.3.2 and 11.3.2.1.
AI is entering payment environments fast. How PCI DSS applies to AI and LLM systems, where cardholder data leaks, and how to keep it safe.
PCI DSS applies to any New Zealand business that takes card payments. A plain-language guide to merchant levels, SAQs, reducing scope, and v4.0.1.
The Targeted Risk Analysis is the connective tissue of PCI DSS v4.x. What a 12.3.1 TRA must document, how it differs from 12.3.2, with a worked example and template.
Since 31 March 2025, PCI DSS Requirements 6.4.3 and 11.6.1 are mandatory. How to manage payment page scripts, detect tampering, and stop digital skimming.
Since 31 March 2025 the 51 future-dated PCI DSS v4.0.1 requirements are mandatory. A QSA’s guide to what is now enforced, grouped so you can turn it into a work list.
Companies routinely hand auditors a vulnerability scan and call it a penetration test. They are not the same, and PCI DSS, SOC 2 and ISO 27001 each treat them differently. An auditor’s guide to the difference, with the five questions that reveal what you actually bought.
Golomb’s three randomness postulates provide a foundational mathematical framework for detecting dangerous patterns in pseudorandom sequences used in encryption — helping cryptographers identify weak ciphers before attackers do.
This blog outlines essential strategies and best practices to safeguard credit card transactions, ensuring secure payment processing and compliance with industry standards such as PCI DSS
Introduction In today’s digital payment ecosystem, every credit card transaction carries risk. As cardholder data travels across networks, it becomes vulnerable to interception, manipulation, and theft. To mitigate these risks, the Payment Card Industry Data Security Standard (PCI DSS) mandates the use of strong cryptography, particularly through secure protocols and cipher suites, to protect cardholder…
We use essential cookies to run this site and, with your consent, analytics & tools (e.g. Google Analytics, HubSpot) to improve it. See our Cookies & Privacy Policy.