PCI DSS Consultants Explain: Your Card Data Is Somewhere You Haven’t Looked

Every PCI project starts with a scope definition, and most of them are wrong at the first attempt. The cause isn’t carelessness. Card data spreads through channels nobody designed and nobody documented.

That’s the first thing PCI DSS consultants find in a new client. It’s true from Lagos to Manila, and the fix starts the same way.

Why are most PCI DSS scopes wrong the first time?

Card data spreads through channels nobody designed or documented: call recordings, email, logs, test copies, spreadsheets and backups. A scope drawn from the system diagram misses all of them. PCI DSS expects you to identify every location and flow of account data, so a scope built on assumption is only a hypothesis.

Requirement 12.5.2 asks you to confirm scope by identifying all locations and flows of account data. Scope must be documented and confirmed at least every 12 months, every six months for service providers, and after any significant change. 

The rules are also stricter now. PCI DSS v4.0.1 has been the only active version since 31 December 2024, and the 51 future-dated requirements became mandatory on 31 March 2025. PCI DSS is enforced by contract, not statute. The PCI Security Standards Council says compliance validation programmes are run by the payment brands, and advises entities to ask their acquirer. 

Where does card data turn up outside your defined environment?

It turns up in call recordings, email, application logs, error reports, test environments, spreadsheets, paper and backups. Each is a place card data was never designed to be. Backups preserve everything else on the list, so one stray copy multiplies.

Call recordings. A contact centre where customers read card numbers aloud has card data in the recording platform, its storage, backups and often a third-party transcription service. Pause-and-resume controls exist and are frequently misconfigured or bypassed by agents under time pressure. PCI SSC FAQ 1210 says Requirement 3.3.1 prohibits storing sensitive authentication data, such as card validation codes, after authorization, even if encrypted. 

Email. Customers email card details despite being told not to. Those emails sit in mailboxes, mail servers, archives and backups, and forwarding spreads them further. PCI DSS doesn’t ban email for receiving card data, but the channel must meet Requirements 4.2.1 and 4.2.2, and the email servers are in scope. 

Logs, error reports and crash dumps. Applications that log full request payloads capture card numbers when a payment passes through. It’s common, unintentional and invisible until somebody searches. Error reports often ship to a third-party tracking service outside your environment.

Test environments. Production data copied to test is straightforward, common and a clear failure. Requirement 6.5.5 bars live PANs from pre-production unless those environments are part of the cardholder data environment and fully protected. 

Spreadsheets and paper. Someone in finance keeps a file for reconciliation or chargebacks because the system doesn’t support the process. Add order forms, receipts showing more than they should, and a drawer nobody has opened in years.

How do you actually find hidden card data?

Run discovery scanning, follow the payment flow, ask the people doing the work, and search your own logs for card number patterns. Assessors do this, so doing it first is sensible. Discovery tools search file systems, databases and mail stores for card number patterns.

Follow the flow rather than the systems. Trace a payment from the customer’s first entry of the card number to authorisation and settlement, and ask at each hop where it goes, what stores it, what logs it and what forwards it.

Ask the people handling payments and disputes daily, not the process owners. They know about the spreadsheet, because they built it to fill a gap. Then search your own logs for card number patterns. It takes ten minutes and is frequently unpleasant.

What should you do with the card data you find?

Most of it needs eliminating, not securing. Stop logging payloads, fix pause-and-resume or stop taking card numbers by phone, purge emailed card details through a defined process, remove production data from test, and replace the spreadsheet by fixing the process behind it. Each removal takes a location out of scope.

That’s worth more than any control you could apply to it. PCI DSS 3.2.1 already asks you to retain only the minimum account data you need. 

How do PCI DSS and ISO 27001 controls line up here?

ISO/IEC 27001:2022 has Annex A controls that map to the same fixes: information deletion (8.10), data masking (8.11), logging (8.15) and test information (8.33). A company with an ISMS finds these easier to run. But ISO 27001 certification isn’t PCI DSS compliance, and neither replaces the other.

The 2022 edition lists information deletion as A.8.10, data masking as A.8.11 and logging as A.8.15. Test information is A.8.33. Good ISO consultant services help you run both without duplicating effort. Each still has its own audit and its own evidence. 

Which industries need PCI DSS consultants most?

Any business that takes, stores or passes on card payments needs them: e-commerce and online payment platforms, banks and fintech, contact centres, hotels and travel, retail, schools and colleges collecting fees, and software providers that touch payments. Startups need help early, because changing a payment flow later costs more.

PCI DSS applies from the moment you accept your first card, not once you reach some revenue threshold. A PCI DSS consultant in Singapore faces the same scoping problem as a team in New Zealand or the USA. The tools differ. The hidden spreadsheet doesn’t. 

How do PCI DSS consultants play a main role?

PCI DSS consultants scope the environment, run or oversee discovery, shrink scope by removing card data, close control gaps and prepare evidence for the assessor. They don’t perform the validation itself. Their value is finding problems before the assessor does.

Assessors know scope is a hypothesis. Finding card data outside the defined environment changes the whole tenor of an assessment, so it’s far better to find it yourself. That’s the main benefit of PCI DSS consultancy services: a smaller scope means fewer systems to secure, test and evidence.

What advice do MSCi’s PCI DSS consultants give?

Our advice is practical. Most scope failures start with a diagram that nobody checked against reality.

• Run discovery before you define scope. Don’t wait for the assessor.

• Draw the payment flow with the people who handle disputes.

• Fix pause-and-resume or stop taking card numbers by phone.

• Purge emailed card details through a defined process. A policy alone won’t stop customers.

• Confirm scope every year. Requirement 12.5.2 requires it at least every 12 months. 

• Eliminate before you encrypt.

PCI DSS consultants in Oman and elsewhere will recognise the list. It doesn’t change by region.

How can PCI DSS consultancy services help your business?

MSC Incorporation (MSCi) is an ISO consultancy with 40+ years of experience in ISO consultation. Our PCI DSS consultancy services cover scoping, data flow mapping, discovery support, gap analysis and audit preparation. We prepare your company for the audit. An independent assessor or accredited certification body validates the result, not MSCi.

5. FAQ

What do PCI DSS consultants do?

They define your scope, find card data you didn’t know about, remove or secure it, and prepare evidence for the assessment. A good consultant starts with discovery, not a policy template.

Do PCI DSS consultants perform the assessment?

No. Compliance validation follows your acquirer’s and card brand’s programme, usually with a qualified assessor. MSCi prepares you for that audit but doesn’t perform it.

How do I choose PCI DSS consultancy services?

Ask whether they’ll run discovery on your systems, who does the work, and whether they say plainly that they don’t validate compliance. Be careful with anyone who promises a passed assessment.

Is ISO 27001 enough for PCI DSS?

No. ISO certification consultants can build a strong information security system, but PCI DSS has its own requirements and validation. They work well together without replacing each other.

Is PCI DSS a law in Kenya or Singapore?

PCI DSS is enforced mainly through card brand and acquirer agreements, not one global law. A PCI DSS consultant in Singapore or PCI DSS consultancy services in Kenya can confirm which acquirer and local rules apply to you.

What’s the difference between ISO consultant services and PCI DSS consultancy?

ISO consultant services prepare you for an ISO audit run by an accredited certification body. PCI DSS consultancy prepares you for a payment card assessment. MSCi works on both but doesn’t issue certificates or validate PCI DSS.