PCI DSS requires organizations to protect account data through technical and operational controls across the cardholder data environment (CDE), as well as additional connected-to and security-impacting systems. Thoropass helps your team understand what applies, put the right controls in place, collect evidence, address gaps, and prepare for assessment without managing the process across spreadsheets, disconnected tools, and separate providers.
Your compliance work and audit stay connected in the Thoropass Audit Lifecycle Platform, giving your readiness team and auditor shared visibility into requirements, evidence, findings, and progress.
Thoropass is a Qualified Security Assessor Company (QSAC), with Qualified Security Assessors (QSAs) who can evaluate organizations against PCI DSS requirements.
Your PCI readiness team helps establish the appropriate scope, understand your cardholder data environment, clarify evidence requests, and identify issues before they slow down the assessment. For organizations that require an independent PCI DSS assessment, your assessment QSA stays involved throughout the process so audit questions can be resolved with the right context. The assessment is performed independently of the readiness work.
PCI DSS v4.0.1 is the active version of the Payment Card Industry Data Security Standard, published on June 11, 2024 as a limited revision to v4.0. It establishes technical and operational requirements for organizations that store, process, or transmit cardholder data, as well as organizations that can affect the security of the cardholder data environment.
Thoropass helps translate those requirements into clear controls, evidence requests, and assigned work. Teams can see what has been completed, what still needs attention, and where auditor input is required, helping PCI DSS compliance become an ongoing operating process instead of a last-minute audit exercise.
PCI DSS assessments can require significant amounts of technical evidence across systems, applications, infrastructure, access controls, and security processes within and connected to the CDE.
Thoropass uses integrations and AI-powered workflows to reduce repetitive evidence collection and organize supporting documentation around your PCI DSS requirements. Evidence, requests, reviews, and findings stay connected inside the Audit Lifecycle Platform, giving your team a clearer view of assessment status while reducing manual coordination.
All organizations within PCI DSS scope must complete external vulnerability scans through a PCI Security Standards Council Approved Scanning Vendor (ASV), although some SAQ types (A, B, C-VT, P2PE) don’t include requirement 11.3.2.
Thoropass is a PCI SSC Approved Scanning Vendor and performs external vulnerability scans in accordance with the ASV Program Guide Scan results can stay connected to your compliance and assessment work, making it easier to understand findings, complete remediation, and maintain the evidence needed for validation.
PCI DSS includes penetration testing requirements for applicable environments. Reqs. 11.4.2 and 11.4.3 require internal and external penetration testing at least once every 12 months and after any significant infrastructure or application change. Thoropass combines penetration testing services with the context of your PCI program, so testing findings can be connected directly to relevant controls, remediation work, and assessment requirements.
Your readiness team gets a clearer path from finding to resolution without coordinating separate testing and audit workflows.
Organizations pursuing PCI DSS often have additional security and compliance obligations, including SOC 2, ISO 27001, HIPAA, or HITRUST.
Thoropass lets teams reuse applicable controls, policies, and evidence across frameworks instead of rebuilding the same compliance work for each assessment. A shared system of record also gives security and compliance teams a consistent view of requirements across their broader audit program.
Your PCI readiness team works with you to understand your payment environment, cardholder data flows, CDE, annual transaction volume, and other factors that affect your PCI DSS scope and validation requirements.
Thoropass translates your requirements into organized controls, tasks, and evidence requests. Your readiness team gets visibility into what needs to be completed and guidance when a requirement needs additional context.
Integrations and AI-powered workflows help collect and organize evidence while your readiness team completes applicable security activities such as ASV scans and penetration testing. Your PCI readiness team reviews progress and helps identify gaps before assessment.
When an independent assessment is required, your assessment QSA evaluates the applicable PCI DSS requirements and supporting evidence. The compliance and assessment processes remain connected, reducing handoffs and giving both teams a shared view of the work.
We’re here to help cut through endless audit overhead. Let’s connect to discuss your needs and see how Thoropass can help streamline your audit process.
The Payment Card Industry Data Security Standard, or PCI DSS, is a global information security standard designed to protect account data. It applies to organizations that store, process, or transmit cardholder data or sensitive authentication data, as well as organizations that can affect the security of the cardholder data environment.
PCI DSS establishes a baseline of technical and operational security requirements covering areas such as network security, account data protection, vulnerability management, access controls, monitoring, testing, and security policies.
PCI DSS v4.0.1 is the current version of the PCI Data Security Standard. The PCI Security Standards Council published it as a limited revision to PCI DSS v4.0, incorporating clarifications and corrections while maintaining the standard's overall structure and intent.
Organizations subject to PCI DSS should evaluate their environments against the applicable PCI DSS v4.0.1 requirements and current validation documentation.
PCI DSS applies to entities that store, process, or transmit cardholder data or sensitive authentication data, including merchants, processors, acquirers, issuers, and service providers. It can also apply to organizations whose systems could affect the security of a cardholder data environment.
The specific validation requirements depend on factors such as the organization's role, payment environment, transaction volume, payment brands, and acquiring bank requirements. It's important to note that PCI SSC maintains the standard but does not set validation levels or reporting requirements — the individual payment brands and your acquirer do.
A Qualified Security Assessor (QSA) is a security professional qualified through the PCI Security Standards Council's QSA program to perform PCI DSS assessments. QSAs work for Qualified Security Assessor Companies and evaluate whether applicable PCI DSS requirements have been met.
Organizations that require a formal PCI DSS assessment may work with a QSA to complete their assessment and applicable reporting documentation.
A Qualified Security Assessor Company, or QSAC, is an independent security organization qualified by the PCI Security Standards Council to perform PCI DSS assessments. Thoropass is a QSAC and provides QSA-led PCI DSS assessment services as part of its end-to-end PCI capabilities.
An Approved Scanning Vendor, or ASV, is an organization approved by the PCI Security Standards Council to perform external vulnerability scans in accordance with applicable PCI DSS requirements.
Organizations that are required to complete ASV scans generally perform them at defined intervals and after certain significant changes. Req. 11.3.2 requires external scans at least once every three months by a PCI SSC ASV, with rescans as needed until a passing scan is achieved under the ASV Program Guide. And Req. 11.3.2.1 — external scans after a significant change — explicitly states they're performed by qualified personnel with organizational independence and are NOT required to be run by a QSA or ASV. Thoropass provides PCI SSC-approved ASV scanning within its PCI DSS offering.
A Self-Assessment Questionnaire (SAQ) is a PCI DSS validation tool used by eligible organizations to evaluate and report their compliance with applicable requirements.
A Report on Compliance (ROC) documents the results of a formal PCI DSS assessment performed by a QSA or, where permitted, an ISA, for organizations required to undergo that type of validation. The appropriate validation method depends on the organization's circumstances and requirements from payment brands or acquiring institutions. An Attestation of Compliance (AOC) accompanies both routes and is typically what is submitted to the acquirer.
PCI DSS includes penetration testing requirements for applicable environments. The frequency for this should be: internal and external penetration tests at least every 12 months and after significant change (11.4.2, 11.4.3); segmentation testing at least every 12 months generally (11.4.5) and at least every six months for service providers (11.4.6).
Thoropass provides penetration testing services that can be coordinated with the broader PCI DSS compliance and assessment process, helping teams connect findings, remediation, controls, and audit evidence.
PCI DSS compliance software can help teams organize controls, collect evidence, monitor progress, document remediation, and maintain visibility across an assessment.
Thoropass connects that work directly with PCI experts, ASV scanning, penetration testing, and audit workflows. This gives organizations one place to manage both the operational work of PCI DSS compliance and the independent validation process.
Close
Leith Khanafseh
Audit Managing Partner, Thoropass Assurance
Leith founded and leads Thoropass’s Assurance practice, bringing 15 years of audit experience to the role. At Thoropass, he oversees the audit and assessment offerings, shapes product direction, and drives innovation that modernizes traditionally outdated audit practices.
Matt Udicious
Director of Infosec Assurance
Matt is a seasoned InfoSec assurance professional with over a decade of experience in cybersecurity, specializing in security, auditing, and compliance.
Matt’s career has included roles, across security, auditing, and compliance. He gained invaluable insights during his tenure as a former auditor, concentrating on SOC 2 compliance for technology companies within the prestigious Big 4 consulting firms. His meticulous approach and deep understanding of industry standards have made him a trusted authority in information security.
Bruce Edwards
Senior Manager, PCI Assurance
Bruce has more than 15 years of experience in security and risk management, both as an external consultant and an internal practitioner. His experience includes penetration testing, PCI QSA, ASV, and cloud security, and in his previous role as a security director, Bruce led PCI DSS assessments for Fortune 500 companies in the fintech and healthcare sectors, both in the U.S. and around the world.
.avif)
Lucas Baiocchi
Senior Manager, HITRUST InfoSec Assurance
Lucas has more than eight years of experience in information security audits and assessments. As Thoropass’ HITRUST InfoSec Assurance Senior Manager, he leads and executes HITRUST assessments, working closely with organizations to evaluate their security posture, validate control effectiveness, and deliver clear, actionable insights that align compliance objectives with broader business goals. His approach ensures not only regulatory and standards-based compliance, but also the adoption of efficient, scalable, and realistic security solutions.
Tom Miller
Senior Manager, Enterprise Team, InfoSec Solutions
Tom is an information security and technology audit leader with more than a decade of experience delivering assurance engagements for organizations ranging from large public corporations to high-growth startups. He owns Thoropass’ largest and most strategic client portfolio, leading complex multi-framework audits and serving as a trusted advisor to executive stakeholders on control design, security requirements, and remediation strategy.
Chris Beiro
Senior Director, InfoSec Solutions
Chris is a seasoned cybersecurity executive with over 15 years’ experience in compliance and audit. He has helped hundreds of organizations – from high-growth startups to Fortune 500 enterprises - strengthen their cybersecurity programs, meet rigorous compliance standards, and mitigate risk. Prior to joining Thoropass, he spent more than 13 years in cybersecurity and audit leadership roles at KPMG and Coalfire.
Austin Newcomer
Senior Manager, InfoSec Assurance
Austin is a Senior Information Assurance leader with more than eight years of experience and expert-level command of AICPA attestation standards. Prior to joining Thoropass, he spent three years at IT auditor Coalfire, where he supported clients ranging from Silicon Valley startups to Fortune 100 corporations.
Today, he leads more than 40 concurrent SOC 1, SOC 2, and HIPAA audits for emerging, mid-market, and enterprise technology companies, with particular depth in healthcare compliance and complex cloud environments across AWS, Azure, and GCP. His work spans the full audit lifecycle — assessing security procedures, reviewing configurations, interviewing control owners, and documenting results — including combined assessments across multiple compliance frameworks.
Emmanuel Amos-Abanyie
Head of Quality Assurance, InfoSec Solutions
As Head of Quality Assurance for InfoSec Solutions, Emmanuel leads the firm’s quality assurance program, driving consistency, technical excellence, and standardization across every audit engagement. He works closely with audit teams to strengthen audit methodologies, enhance reporting quality, and promote continuous improvement, helping clients receive accurate, rigorous, and reliable audit deliverables.
