Case study: Tamar Crossings and Securious

September 11, 2024

Securious has been working with Tamar Crossings since June 2023 to help them achieve compliance with PCI DSS v4.0.

About Tamar Crossings 

Tamar Crossings is responsible for managing the Tamar Bridge and the Torpoint Ferry, critical infrastructures that facilitate transportation between Devon and Cornwall in the United Kingdom. The Tamar Bridge, a suspension bridge, and the Torpoint Ferry, a chain ferry service, are essential components of the region’s transport network, providing a vital link for commuters, tourists, and commercial traffic.

About Securious 

Securious is the South West’s leading Payment Card Industry Qualified Security Assessor and cyber security company. We help clients with Governance, Risk and Compliance (PCI DSS, ISO 27001, PCI 3DS, Cyber Essentials and Cyber Essentials Plus); we offer a Managed Detection and Response service (helping clients stay secure with live 24/7 monitoring and visibility of their environments, threat detection and automated alerts, which are overseen by our analysts), and penetration testing services. 

The objective 

The primary objective of Securious’ engagement with Tamar Crossings was to help them achieve compliance with PCI DSS v4.0. This involved addressing requirements set by key stakeholders and ensuring the security of cardholder data (CHD) processed through their various payment channels.

The challenge 

Tamar Crossings’s environment was complex due to multiple payment methods, including contactless payments, cash, credit, and debit card transactions. They also offer a tag system, which allows for automated toll payments.

All activity to enable compliance with PCI DSS had to work around the need to keep the Tamar Bridge and Torpoint ferry services open and running. Taking payment lanes offline – even for a short while – would have disrupted traffic flow and caused significant issues for both Tamar Crossings and those needing to use the bridge and ferries. 

The solution 

Securious approached the project with a structured plan:

  • Scope and gap analysis: Securious conducted an initial scope and gap analysis to understand the existing environment, systems, and controls.
  • Segmentation: Tamar Crossings performed network segmentation to reduce the scope of PCI compliance, including re-IP addressing their environment.
  • Collaboration with third parties: Securious worked closely with Tamar Crossings’ IT providers and stakeholders to ensure all requirements were understood and delivered against 
  • Comprehensive assessment: Securious assessed the environment against PCI DSS v4.0 requirements, focusing on systems critical to payment processing and ensuring they met the requirements of the PCI DSS standard.

The results 

The engagement resulted in Tamar Crossings achieving PCI DSS v4.0 compliance within eight months. The project involved a review of their network segmentation and payment processing systems, ensuring robust security measures were in place. Tamar Crossings now boasts a secure, well-managed environment that complies with PCI standards, enhancing their overall security posture and operational efficiency.

Pete Woodward, Securious Cofounder and CEO, comments:   

“The engagement with Tamar Crossings was really effective. They were highly responsive and committed to implementing the necessary changes. Despite the complexities, we managed to guide them through the process swiftly, and they achieved compliance with PCI DSS v4.0 in less than a year, which is no small feat.”

Rob Woodhall, Tamar Crossings, comments:

“Securious’ support was invaluable. They made the compliance process clear and manageable, providing the necessary guidance and attending meetings with key stakeholders. Their local presence and expertise were crucial in helping us navigate this challenge successfully.”