Skip to content

QSA · QPA · 3DS Assessor

SearchFrançais

Security consultants · PCI QSA Company · Dublin and Paris

PCI assessors who have done the job, not just the paperwork.

247 CyberLabs is a PCI QSA Company built by security practitioners. We tell you where you really stand, we help you fix it, and the QSA who scopes your assessment is the one who signs it.

Talk to a QSAWhat we do

Qualified by the PCI Security Standards Council, and listed there under our name.

  • QSA

    PCI DSS assessor

  • QPA

    Qualified PIN Assessor

  • 3DS Assessor

    3-D Secure

  • Europe & CEMEA

    authorised to assess

Our QSAs also hold: CISSP · CISA · CISM

Verify with the PCI SSC →

What you get from us

Real consultants, not a report factory.

PCI created a generation of assessors who have never defended a network, and firms whose product is a report delivered as fast as possible. We are not one of them.

  1. 01

    We tell it like it is.

    If a control does not hold, you hear it from us first, in plain words, with what to do about it.

  2. 02

    We don’t tick boxes.

    A Report on Compliance is the output of an assessment, not its purpose. We look at how your environment actually runs.

  3. 03

    We don’t bend the rules for a quick buck.

    A compliant report that is not true is worth nothing to you or to us. We would rather lose an engagement than sign one.

  4. 04

    We’ve done the job.

    We came to assessment from running security: firewalls, operations, incident response. We judge what we have built and defended ourselves.

  5. 05

    We build what we need.

    When the tools did not exist, we wrote our own software. We use it on every engagement.

What we do

Accredited PCI assessments, and the advice around them.

The QSA who scopes your assessment is the one who signs it — accredited assessors working on one method, one quality system and software we built for the job.

View all services →
AssessmentPCI DSS AssessmentsA Report on Compliance that describes something real, led and signed by the same QSA, with no late surprises and no bending of the rules.AssessmentPCI PIN AssessmentsA PIN assessment led and signed by the Qualified PIN Assessor who scoped it. Keys, devices and the ceremonies between them, looked at as they run.AssessmentPCI 3DS AssessmentsA PCI 3DS assessment of your access control server, directory server or 3DS Server, led and signed by the 3DS Assessor who scoped it, with the HSMs and the protocol looked at as they run.AssessmentPCI Gap AssessmentsWhere you actually stand against PCI DSS, before anyone has to sign anything, with a remediation plan ordered by what matters.AdvisoryPCI AdvisoryA QSA on call for the questions that do not have a textbook answer, with answers you can put in front of your acquirer, in writing, with the reasoning.ConsultingCompliance ConsultingA PCI programme that runs all year, built from your scope and the way you actually operate, and the same expertise applied beyond the card brands when that is what you need.

Security testing, read by people who know what it should find.

Penetration and segmentation testing scoped by our QSAs against the requirements your evidence depends on, executed with specialist testing partners where we do not test ourselves, and read by the assessor who will rely on it.

Security testing →

Beyond the ROC.

The same expertise takes us past the card brands: cryptographic architecture, PIN and key management, strong customer authentication under PSD2, payment security design for organisations that will never file a Report on Compliance.

Compliance consulting →

Built, not bought

We wrote our own software because the market’s didn’t fit.

Spreadsheets, portals and generic GRC tools made assessments slower and vaguer. So we built software for the job: evidence asked for once and linked to every requirement it serves, findings tracked to closure, reports drafted from the work itself. We use it on every engagement, so your QSA spends the time on judgement, not paperwork.

See what it does →

How it runs

One QSA, from the first scoping call to the signature.

Three acts, five phases, no handover. You always know what happens next, and who is doing it.

One QSA, from scope to signature

  1. 01 · Prepare

    What are we assessing?

    1. Scoping

      Agree what is in scope, and why.

    2. Readiness

      Answer each requirement in plain language, with evidence.

    You describe, your QSA validates

  2. 02 · Assess

    Where do we stand?

    1. Gap analysis

      Each requirement tested; gaps raised as findings.

    2. Remediation

      Findings worked to closure, together.

    Your QSA tests, you close the gaps

  3. 03 · Report

    Write it up.

    1. Reporting and QA

      Report on Compliance and Attestation of Compliance, quality-reviewed before signature.

    Your QSA writes and signs

One continuous record

  1. Answers
  2. Evidence
  3. Determinations
  4. ROC & AOC
Every answer you give is carried forward into the report. Nothing is typed twice.
How we work, step by step →

Real engagements. Real outcomes.

Most of our work is under NDA, so these are anonymised, but the situations, decisions and results are real.

View all case studies →

Manufacturing

Ransomware night, and three weeks back to work

A European manufacturing group, 20+ plants, around 10,000 endpoints

Links cut within hours, business as usual in three weeks, every customer reconnected within three months, and a security programme the group still runs.

3 weeks

from the cut links to business as usual

Payments

What a first PCI 3DS assessment actually looks like

A card-payment processor running 3DS services for its banks

From 41 requirements with open points to a signed Report on Compliance, Attestation and certificate in two months, with a status letter for the processor's partners along the way.

41

requirements open after the on-site days, 6 five weeks later, 0 at signature

Knowledge Base

What we know, written down.

Opinions from the assessment table, not summaries of the standard. Bylined and reviewed by our QSAs.

Browse the Knowledge Base →

Security Testing4 min read

A segmentation test from one jumpbox is not a segmentation test

Segmentation takes networks out of scope, so the test that proves it carries the whole assessment. Three ways we have seen it fail, and one ending where it was not our call.

Compliance Operations3 min read

Ask once: an evidence process that runs all year

One firewall export serves four requirements. One review record serves three. The evidence process that turns the yearly scramble into a routine is mostly a matter of linking each piece of evidence to everything it proves, and giving it an owner and a date.

Compliance Operations3 min read

Audit-ready is a state: the PCI DSS calendar

The assessment looks at the last twelve months, not at the last six weeks. The organisations that find it calm are the ones with a calendar of every periodic requirement, an owner per line, and a record produced each time. Here is the calendar.

Europe & CEMEA

Talk to the QSA, not a salesperson.

Your first conversation is with a QSA who can tell you what your assessment really involves, and who would lead and sign it. Authorised by the PCI Security Standards Council across Europe and CEMEA, from Dublin and Paris.

Talk to a QSAHow we work, step by step

  • Dublin

    Registered office and PCI SSC registration

  • Paris

    Our French company, for French-speaking clients

DublinParis