PCI DSS Breach? Everything you need to know and what to do next

A practical guide for organisations responding to a suspected or confirmed PCI DSS breach.

If you’ve found your way to this page, chances are something has happened.

Perhaps you’ve discovered a vulnerability in your payment environment. Alternatively, your acquiring bank may have contacted you about suspicious activity linked to your organisation. You might have already begun investigating an incident and want to understand what happens next.

Whatever your situation, having questions is completely natural:

• What does this actually mean?
• Is it necessary to stop taking card payments?
• Will we require a formal forensic investigation?
• How do we become fully compliant again?

Fortunately, a well-established process exists for responding to PCI DSS security incidents. While every breach is different, understanding the typical journey helps you make informed decisions, avoid common mistakes, and achieve a secure, compliant outcome.

Consequently, this guide explains each stage of that journey, from the first suspicion through investigation, remediation, and regaining PCI DSS compliance.

Which best describes your situation?

Not every organisation arrives here at the same stage. Therefore, you can jump directly to the section that best matches where you are today.

We think we may have had a breach

Perhaps your team identified suspicious activity, discovered a security issue, or has reason to believe that attackers compromised payment card data.

Jump to: I think we’ve had a PCI DSS breach. What should we do?

We’ve received a PCI DSS breach notification

Recently, your acquiring bank, payment processor, or another partner contacted you regarding suspicious activity linked to your business.

Jump to: We’ve received a PCI DSS breach notification.

We’ve been told we need a PCI Forensic Investigation (PFI)

In this case, you need to understand what a PFI is, why your bank requires it, and what happens next.

Jump to: We’ve been told we need a PCI Forensic Investigation (PFI)

We’re recovering from a PCI DSS breach

Your team has already contained the immediate incident, and investigators established what happened. Now you must turn those findings into a prioritised remediation plan, address identified vulnerabilities, and prepare for subsequent PCI DSS validation.

Jump to: We’re recovering from a PCI DSS breach

We need to regain PCI DSS compliance

Recovering from a breach does not automatically restore your PCI DSS compliance. Depending on the circumstances, you may need to complete additional validation, demonstrate that your payment environment meets PCI DSS requirements once more, and satisfy additional rules from your acquiring bank.

Jump to: We need to regain PCI DSS compliance. What’s involved?

First things first: What is a PCI DSS breach?

One common misconception is that every cyber security incident constitutes a PCI DSS breach.

Specifically, a PCI DSS breach involves the suspected or confirmed compromise of Cardholder Data (CHD) – such as the Primary Account Number (PAN), cardholder name, or expiration date – or the systems that store, process, or transmit it.

Examples include:

• Unauthorised access to cardholder data (CHD) or account numbers (PAN).
• Malicious software installed on payment systems.
• E-commerce websites compromised by payment skimming (often called Magecart attacks).
• Internal databases containing payment information exposed to the internet.
• Compromised administrator credentials providing access to payment environments.
• External attackers exploiting software vulnerabilities to gain access to cardholder data.

In addition, distinguishing between a suspected breach and a confirmed breach is critical.

Many organisations first discover an issue when their acquiring bank reaches out after identifying unusual fraud patterns. At that point, an ongoing investigation may still be underway, and investigators may not yet know whether your systems caused the compromise.

Consequently, understanding that distinction prevents panic while ensuring your team treats the situation with appropriate urgency.

Understanding breaches caused by third-party suppliers

Not every PCI DSS breach originates within your internal infrastructure. In some cases, a compromise occurs within a third-party service provider, such as a payment processor, payment gateway, or external vendor that stores, processes, or transmits payment card data.

Even if the root cause lies with an external supplier, your acquiring bank may still contact you during its investigation. This typically happens if transaction monitoring highlights your organisation as a common point of compromise. Therefore, cooperate fully with the bank’s enquiry while collaborating with your service providers to establish the facts.

I think we’ve had a PCI DSS breach. What should we do?

At a glance: If you suspect a PCI DSS breach, focus on confirming whether payment card data could be affected, containing any active threat while preserving evidence, and alerting key stakeholders. Avoid modifying affected systems before specialists examine the incident, and work alongside your acquiring bank to agree on subsequent steps.

Whether you spotted unusual activity internally, identified a vulnerability, or received an internal alert, respond calmly and methodically.

Not every cyber security incident is a PCI DSS breach. However, if attackers could have accessed payment card data – or the systems supporting card processing – do not delay your response.

Ultimately, the decisions you make during the first few hours directly affect both the forensic investigation and your recovery timeline.

1. Determine whether payment card data could be affected

Your immediate priority isn’t definitively proving a breach occurred. Instead, determine whether attackers could have reached payment card data or systems supporting card processing. That finding dictates your response strategy.

Key assessment questions include:

• Does this incident involve systems that store, process, or transmit payment card data (CHD)?
• Is the issue isolated to one system, or could it affect the wider cardholder data environment?
• Did internal monitoring detect the activity, or did an external party report it?
• Does any concrete evidence show that unauthorised parties accessed, stole, or exposed card data?

You may not have every answer immediately. However, your goal is simply to confirm whether a realistic risk of compromise exists so that you can react proportionally.

2. Contain the immediate threat while preserving evidence

If you suspect active attacker access, your priority is preventing further compromise while safeguarding payment systems and cardholder data.

However, handle containment with care. Organisations often rush to repair systems immediately, inadvertently destroying critical evidence needed to establish what occurred.

For example, deleting logs, rebuilding servers, wiping devices, deleting malware files, or reconfiguring affected infrastructure can severely obstruct forensic analysis.

Containment vs evidence preservation

If an active incident is underway, engage an incident response specialist promptly. These professionals contain live threats – cutting off attacker access and securing systems – while carefully preserving forensic artifacts.

Preserved evidence helps investigators determine:

• The methods attackers used to gain access
• Which specific systems were affected
• Whether payment card data was compromised
• The full duration of the compromise
• What unauthorised activity took place within the environment

If your team must make emergency changes to stop active data exfiltration, record exactly what you altered, when, and why.

Furthermore, your response depends on the incident’s specifics. If you are unsure how to proceed safely, seek specialist advice before attempting independent containment.

Common mistakes to avoid

• Rebuilding or wiping affected systems before you preserve evidence.
• Erasing system logs or potentially valuable audit trails.
• Deleting malware without capturing necessary forensic memory dumps.
• Assuming an incident affects only a single system without completing a wider investigation.
• Prioritising operational uptime over determining compromise scope.

3. Notify the right people

Managing a suspected PCI DSS breach requires a coordinated cross-functional response.

Therefore, inform senior leadership, IT management, cyber security personnel, legal counsel, and your PCI DSS compliance leads immediately.

If evidence indicates card data compromise, notify your acquiring bank without delay. Your acquiring bank acts as your primary liaison throughout the PCI DSS breach process, specifying required details, outlining whether investigations must take place, and setting subsequent milestones.

Depending on your technical architecture, inform your payment gateway or processor as well.

In addition, check your cyber insurance policy for specific notification timeframes. Late reporting can jeopardise your coverage and access to incident support.

Consider broader regulatory obligations too. Specifically, if attackers have compromised personal data, you may need to satisfy mandatory UK GDPR breach reporting deadlines.

4. Understand who is likely to become involved

PCI DSS breach responses involve distinct specialist parties, each handling specific responsibilities:

• Your acquiring bank coordinates the PCI DSS process, sets reporting conditions, and decides if forensic escalations are required.
• Incident response specialists contain active threats, assess compromise depth, and protect evidence for forensic analysis.
• PCI Forensic Investigators (PFIs) conduct mandated forensic investigations when required by acquiring banks or payment card brands.
• Qualified Security Assessors (QSAs) like Securious guide post-incident compliance. Rather than providing live containment, QSAs help you interpret bank mandates, evaluate your PCI DSS compliance position, identify control gaps, and map your path back to compliant processing. Acquiring banks frequently mandate QSA-led validation following breaches.

Not every breach involves every party, but understanding these distinct roles helps you manage expectations.

5. Keep a record of decisions

Maintain an accurate chronological log of all observations, consultations, external advice, and remedial actions throughout the incident.

Documenting technical changes, timestamps, and impacted assets provides vital evidence during forensic reviews and proves due diligence to your acquiring bank.

Similarly, this audit log provides an invaluable reference when refining future incident response playbooks.

What might happen next?

Once you contain the initial threat, your focus shifts from emergency response to comprehensive analysis.

This next phase establishes how the event occurred, whether attackers stole card data, and what remediation is required before you can demonstrate full compliance.

Your acquiring bank may require you to:

• Supply accurate information about your payment environment and current compliance status.
• Collaborate with the bank to establish the scope of the incident and agree on subsequent actions.
• Contract cyber security or forensic specialists to investigate the compromise mechanism.
• Preserve operational systems, logs, and other digital evidence during investigations.
• Appoint an accredited PCI Forensic Investigator (PFI) where a formal forensic review is required.
• Remediate identified vulnerabilities and address wider security weaknesses.
• Perform technical security testing to validate that remediation has been effective.
• Work with a Qualified Security Assessor (QSA) to resolve compliance gaps.
• Complete any additional PCI DSS assessment or validation required by your acquiring bank.

If attackers accessed cardholder data, your acquiring bank will issue specific instructions. These instructions often mandate appointing a PFI for formal forensics or working with a QSA to validate compliance.

Remember that data protection rules apply in parallel. As a result, if the incident compromised personal data, you may need to notify the Information Commissioner’s Office (ICO) under UK GDPR within 72 hours.

Take a methodical approach: review all external requests carefully, work with accredited partners, and avoid unplanned system modifications until investigators finish gathering data.

In summary

When responding to a suspected PCI DSS breach:

• Verify whether payment card data or payment systems face exposure.
• Isolate active threats while safeguarding forensic evidence.
• Contact your acquiring bank promptly to clarify required actions.
• Engage external incident response or forensic specialists when necessary.
• Document all actions, technical findings, and operational decisions.
• Prepare for subsequent investigation, technical remediation, and compliance validation.

If your organisation must demonstrate compliance after an incident, a Qualified Security Assessor (QSA) like Securious will help you interpret bank mandates, structure remediation, and validate your environment.

To evaluate your circumstances with an expert, arrange a call with one of our PCI DSS QSAs.

What next?

After executing initial containment, you can begin planning your recovery path.

The following sections outline what to expect across subsequent stages:

• We’ve been told we need a PCI Forensic Investigation (PFI). What does this mean? – When banks mandate PFIs and how the process works.
• We’re recovering from a PCI DSS breach. What should we focus on? – Turning forensic findings into durable remediation and strengthening defenses.
• We need to regain PCI DSS compliance. What’s involved? – Navigating post-breach assessment levels and validation milestones.

We’ve received a PCI DSS breach notification

At a glance: A breach notification from your acquiring bank does not immediately prove that your systems leaked cardholder data. Instead, it indicates that bank fraud analysis flagged your organisation during an investigation, requiring a formal review of your environment.

For many merchants, the first warning arrives unexpectedly via a phone call or formal letter from their acquiring bank.

Treat this notification seriously, but recognize that it represents the opening of an inquiry rather than a definitive finding of fault.

Consequently, this inquiry begins a structured fact-finding process to determine whether your cardholder data environment suffered a compromise and what corrective steps are required.

Why has our organisation been contacted?

Financial institutions and payment schemes monitor transaction feeds continuously to detect fraud trends.

When multiple defrauded cardholders share recent transaction history at your business prior to fraudulent charges appearing elsewhere, investigators register your business as a potential Common Point of Purchase (CPP) or Common Point of Compromise (CPC).

In simple terms, this classification means transaction data links your business to several compromised accounts. It does not prove that attackers breached your network or stole payment data from your database.

Scheme investigators analyze broad fraud patterns rather than assigning blame prematurely.

Your organisation may represent one of several merchants under review, and investigators require technical verification before drawing definitive conclusions.

What information will our acquiring bank need?

While every inquiry varies, acquiring banks begin by analyzing your payment processing architecture.

Preparing accurate documentation in advance streamlines the initial review and prevents procedural delays.

Your bank may request:

• Documentation regarding your current PCI DSS compliance status.
• Architecture overviews of how you accept card payments.
• Details of your Cardholder Data Environment (CDE), including connected systems and personnel.
• Inventory lists of payment applications, gateways, or third-party service providers.
• Historical records of any recent cyber security incidents.
• Evidence of recent vulnerability scanning or penetration testing.
• Contact details for the internal personnel responsible for PCI DSS compliance.

These requests help the bank determine the risk profile of your cardholder data environment and evaluate if further technical reviews are needed.

Should we stop accepting card payments?

Merchants often wonder whether they must halt card transactions immediately upon receiving a notification.

Unfortunately, there is no universal answer to this question.

Many businesses continue processing payments without interruption, whereas others introduce temporary safeguards or process adjustments.

Therefore, follow the direct instructions of your acquiring bank and security advisors rather than making unverified operational assumptions.

What should we do now?

Following a breach notification, your goals are assisting bank inquiries, preserving forensic evidence, and avoiding disruptive changes to your payment infrastructure.

Focus on these practical priorities:

• Replying promptly to all requests from your acquiring bank.
• Supplying accurate technical information regarding your payment environment.
• Preserving system logs and forensic evidence wherever possible.
• Avoiding significant changes to affected infrastructure until you obtain specialist advice.
• Engaging accredited technical and PCI DSS specialists where required.
• Deploying incident response specialists immediately if active threats persist.

Avoid ignoring or postponing bank communications. Engaging quickly helps confirm facts and ensures investigation workflows remain on schedule. If technical monitoring suggests an ongoing threat, deploy incident responders immediately.

Depending on infrastructure complexity, this initial stage can take days or several weeks. Your acquiring bank will communicate progress and advise on required actions.

What might happen next?

After reviewing submitted data, acquiring banks choose between several formal outcomes.

In some situations, initial evidence satisfies the bank, concluding the matter without further action.

In other scenarios, unresolved questions require formal forensic or compliance evaluations.

Potential next steps include:

• Deeper technical investigations across network segments.
• Formal incident response and comprehensive technical remediation.
• Mandated PCI DSS validation activities.
• Appointment of an accredited PCI Forensic Investigator (PFI) where necessary.
• Engaging a Qualified Security Assessor (QSA) like Securious to identify gaps, plan remediation, and audit the environment.

Your bank’s post-breach instructions reflect both the severity of the incident and specific payment scheme rules from Visa or Mastercard.

Post-breach processes are tailored to each case. While one merchant might only provide updated network diagrams, another may face mandatory Level 1 audits with an accredited QSA. Your bank will specify deliverables and mandatory deadlines.

Treat bank deadlines as firm operational requirements. If instructions are ambiguous, seek clarification immediately. A QSA can help you understand the requirements and map out necessary steps.

Acquiring banks often accept formal proof of QSA engagement as confirmation that corrective actions are underway while technical remediation continues. Keep communication channels transparent throughout the process.

In summary

Receiving a notification means your acquiring bank requires verification regarding potential cardholder exposure, not that liability has been established.

When notified by your acquiring bank:

• Reply quickly and completely to all information requests.
• Provide verified architecture data regarding payment workflows.
• Safeguard logs and ensure incident responders isolate active threats.
• Adhere strictly to bank directives and specialist guidance.
• Anticipate potential remediation and validation mandates.

If your bank requires remediation or higher-tier validation, a Qualified Security Assessor (QSA) will help you navigate scheme rules and restore compliant operations.

Need help understanding the PCI DSS requirements following a breach notification? Our QSAs can help you understand what’s being asked of you, identify any compliance gaps and plan your route back to PCI DSS compliance.

What next?

Investigations frequently transition into detailed technical phases. The following guides cover subsequent stages:

• We’ve been told we need a PCI Forensic Investigation (PFI). What does this mean? – Understanding formal scheme investigations and investigator remits.
• We’re recovering from a PCI DSS breach. What should we focus on? – Structuring remediation effectively.
• We need to regain PCI DSS compliance. What’s involved? – Completing mandated post-breach validation.

We’ve been told we need a PCI Forensic Investigation (PFI). What does this mean?

At a glance: A PCI Forensic Investigation (PFI) is an official inquiry performed by a certified forensic investigator to determine how a breach happened, identify exposed card data, and outline required remediation. While not mandatory for every incident, PFIs provide the factual baseline required by payment schemes.

Receiving a PFI mandate can feel daunting.

Most organisations have never undergone a forensic audit and feel uncertain about what to expect.

However, a PFI is not a disciplinary hearing. Its objective is establishing technical facts, identifying the breach mechanism, and confirming what controls are necessary to restore secure processing.

Why have we been asked to undertake a PFI?

Payment schemes do not mandate PFIs for every security event.

Instead, your acquiring bank mandates a PFI in consultation with payment schemes (such as Visa and Mastercard) based on the risk profile of the suspected incident.

Schemes require PFIs when credible evidence suggests payment card data compromise and only an accredited forensic review can confirm the root cause.

Consequently, a PFI mandate simply reflects that scheme rules require formal forensic verification before your organisation can safely move forward.

What is the PFI trying to establish?

While every review is bespoke, forensic investigators focus on answering key technical questions:

• How did attackers gain access to the payment environment?
• Which specific systems were affected?
• Was cardholder data exposed or stolen?
• How long did the compromise remain active?
• Have internal teams resolved the underlying vulnerabilities?
• What controls are needed before the organisation can safely process payments?

The resulting forensic conclusions allow your acquiring bank and payment schemes to evaluate residual risk and determine post-breach compliance obligations.

What will the PFI investigators actually do?

Investigators gather verifiable digital evidence to reconstruct the timeline of events.

Standard PFI activities include:

• Examining affected payment infrastructure and servers.
• Reviewing firewall logs, system events, and authentication records.
• Analysing the initial intrusion vectors used by attackers.
• Determining whether cardholder data was extracted.
• Calculating the total duration of the compromise.
• Identifying configuration flaws and software vulnerabilities.

In addition, the investigation team will audit architectural diagrams, network configurations, and existing PCI DSS compliance records.

Ultimately, all conclusions in the final report must rely on concrete technical proof.

What information will we need to provide for the PFI?

Requested materials depend on your architecture, but investigators routinely ask for:

• Network topologies and payment data flow diagrams.
• Inventories of payment applications and third-party services.
• Firewall rulebases and core system configuration files.
• Centralised security logs and SIEM monitoring data.
• Historical vulnerability scan results and penetration test reports.
• Previous PCI DSS Reports on Compliance or SAQ documentation.
• Formal information security policies and operational procedures.

Providing structured, comprehensive data promptly accelerates the investigation timeline.

How do we appoint a PCI Forensic Investigator?

When an acquiring bank mandates a PFI, merchants generally source and contract an accredited PFI firm directly from the PCI SSC approved registry.

Standard cyber forensics vendors cannot deliver these audits; only certified PFI companies meet scheme reporting criteria.

Therefore, confirm all contractual parameters, scoping requirements, and reporting deadlines with your bank before executing an agreement.

Once contracted, the PFI firm will initiate evidence preservation, establish testing scope, and begin technical analysis.

Who pays for a PCI Forensic Investigation?

Merchants often ask who carries the financial cost of a forensic investigation.

Liability for PFI fees depends on merchant service agreements, acquiring bank policies, and payment brand operating regulations.

Your acquiring bank will clarify payment terms, billing responsibilities, and procedural requirements for commissioning the investigation.

While commercial costs are significant, resolving data risks and stopping ongoing exposure remain the urgent operational priorities.

What should we be doing while the investigation is underway?

Your internal team plays a vital role throughout the forensic audit.

Support the inquiry by:

• Responding promptly to requests for technical information.
• Safeguarding all relevant forensic evidence.
• Avoiding unapproved changes to affected production systems.
• Maintaining open communication with your acquiring bank and specialists.
• Logging every internal action taken during the investigation.

Open collaboration helps forensic analysts finish their work efficiently without administrative friction.

How long will a PFI take?

Forensic timelines vary according to environmental complexity.

Straightforward investigations may conclude within weeks, whereas distributed, enterprise networks can require several months.

Key timing variables include:

• The complexity of your payment architecture.
• The overall scope of in-scope systems.
• The availability and retention of system logs.
• The sophistication of the compromise.
• Any urgent remediation required during active testing.

Your bank and PFI partner will provide regular milestone updates throughout the review.

Will we be able to continue taking card payments?

Card processing continuity is a primary operational concern for merchants.

Continued payment acceptance depends entirely on your bank’s assessment of active transaction risk.

While some businesses continue transacting under heightened monitoring, others must adopt segregated channels or temporary processing workarounds.

Therefore, adhere strictly to bank directives before making infrastructure changes.

What happens once the PFI is complete?

Upon concluding technical analysis, the investigator delivers a formal PFI Final Report.

This report establishes official findings and guides the remediation, architectural improvements, and validation standards mandated by card schemes.

For merchants, the PFI report marks the transition into formal recovery.

Your focus moves toward patching vulnerabilities, upgrading controls, and proving sustainable security improvements.

This is where a Qualified Security Assessor (QSA) steps in. Your acquiring bank may require you to appoint a QSA to audit your environment post-breach. Engaging a QSA early ensures your technical remediation aligns directly with subsequent PCI DSS audit criteria.

In summary

A PCI Forensic Investigation is an evidence-based inquiry designed to establish root cause and define necessary remediation.

When undergoing a PFI:

• Maintain active transparency with your bank and forensic team.
• Deliver requested data files and configurations without delay.
• Protect evidence integrity across all in-scope systems.
• Use forensic findings to structure long-term system remediation.
• Begin planning for the additional PCI DSS validation that may follow.

Once the investigation has concluded, many organisations require support to interpret the findings, remediate identified issues and demonstrate that they once again meet PCI DSS requirements. A Qualified Security Assessor (QSA) like Securious can help you understand those requirements and support your organisation through the next stage of the process.

Need QSA support during or after a forensic investigation? Arrange a call with one of our PCI DSS QSAs.

What next?

Once investigators clarify how the breach occurred, attention turns toward environmental remediation.

The following sections outline post-investigation priorities:

• We’re recovering from a PCI DSS breach. What should we focus on? – Developing structured remediation programs.
• We need to regain PCI DSS compliance. What’s involved? – Completing mandatory compliance assessments.

We’re recovering from a PCI DSS breach. What should we focus on?

At a glance: Once investigators contain the incident and deliver their findings, focus shifts toward remediation. This requires re-validating entity scope, fixing root vulnerabilities, validating control effectiveness, hardening architectures, and preparing for post-breach compliance audits.

For most organisations, remediation requires the greatest operational effort.

Lasting recovery requires more than simply deploying a quick software patch. Your objective is eliminating the weaknesses that enabled the attack and building a more resilient processing environment.

Investing in comprehensive remediation significantly reduces the probability of repeat incidents.

Where should we start?

Remediation takes forensic findings and translates them into actionable engineering tasks. One of the essential first steps in recovery – ideally supported by a PCI QSA – is confirming and re-validating your entity and Cardholder Data Environment (CDE) scope to ensure no affected systems or data flows are omitted before designing and implementing new controls.

Your team must balance internal technical fixes against specific bank deadlines and QSA validation mandates.

A typical recovery workflow involves:

• Confirming and re-validating your overall PCI DSS entity scope and data flows with your QSA.
• Reviewing forensic findings alongside requirements set by your acquiring bank.
• Developing a prioritised remediation roadmap with specialist QSA input.
• Remediating technical vulnerabilities and addressing wider control gaps.
• Validating that implemented controls function effectively.
• Gathering comprehensive evidence of all completed engineering tasks.
• Preparing for post-breach PCI DSS assessments and formal audit sign-off.

Turn the findings into a prioritised remediation plan

Your forensic report documents exploited attack vectors, affected workloads, and control failures.

Convert these findings into a structured remediation plan defining specific deliverables, technical owners, and target completion dates.

Prioritise tasks based on threat severity, data exposure risk, and acquiring bank deadlines.

PFI recommendations and incident response findings should form the foundation of your engineering roadmap.

If your acquiring bank requires a QSA assessment, involve your assessor during remediation planning rather than waiting until engineering work ends.

While QSAs do not deploy technical patches, they ensure your remediation aligns with PCI DSS controls, preventing costly rework during final validation audits.

Clarify any ambiguous bank deadlines early to ensure your engineering milestones meet acquiring requirements.

Remediate the underlying weaknesses, not just the immediate breach

Emergency containment stops active data theft, but it does not always fix systemic environmental flaws.

For instance, removing malware resolves the symptom, but recovery must eliminate the unpatched vulnerability or weak credential that allowed access in the first place.

Standard remediation programs address:

• Deploying critical security patches across all systems.
• Upgrading or replacing unsupported legacy software.
• Disabling unnecessary administrative accounts and services.
• Strengthening multi-factor authentication (MFA) enforcement.
• Enhancing network segmentation around cardholder environments.
• Tightening firewall configurations and ingress rules.
• Restricting access privileges across the Cardholder Data Environment.
• Updating, documenting, and testing formal incident response procedures to meet PCI DSS Requirement 12.10.x.

Top tip: Resist the temptation to rebuild your payment architecture exactly as it was. Recovery offers an ideal opportunity to descope cardholder data environments, eliminate legacy systems, and implement robust security controls.

Strengthen your payment environment

Breach investigations frequently reveal architectural weaknesses beyond the initial entry vector.

Take this opportunity to audit your security posture:

• Determine whether you store more cardholder data than operationally necessary.
• Evaluate options to shrink your active Cardholder Data Environment scope.
• Decommission legacy or unmaintained operating systems.
• Enforce strict least-privilege access across internal teams.
• Establish systematic vulnerability management and testing schedules.
• Ensure your team is monitoring their payment environment effectively.

Consequently, descoping and simplifying your payment network improves security while significantly reducing ongoing compliance overhead.

Work with the right people

Executing a successful recovery demands diverse technical and compliance skill sets.

Stakeholders typically include:

• Internal IT engineering and infrastructure teams.
• Specialist cyber security and incident response consultants.
• External managed service and cloud hosting providers.
• Payment application vendors and gateway partners.
• Third-party software providers.
• Liaison officers from your acquiring bank.
• An accredited Qualified Security Assessor (QSA).

Internal IT and managed service providers deploy infrastructure fixes, whereas your acquiring bank establishes validation criteria.

A QSA provides independent compliance guidance, confirming that technical remediations satisfy specific PCI DSS requirements ahead of the final audit.

Therefore, coordinating engineering efforts with compliance requirements prevents wasted effort and project delays.

Validate that your remediation has worked

Implementing security fixes is only half the battle; you must verify that new controls perform as intended.

Under modern PCI DSS standards, organisations must conduct regular Targeted Risk Assessments (TRAs) and maintain a formal risk register to define the necessary scope, frequency, and rigor of ongoing security testing.

Depending on your architecture and risk assessment outcomes, validation requires:

• Conducting regular Targeted Risk Assessments (TRAs) to guide testing scope and maintain your risk register.
• Performing scheduled vulnerability scanning across network assets.
• Executing quarterly ASV scanning for external IP addresses.
• Commissioning rigorous penetration testing against CDE boundaries.
• Completing supplementary security reviews and control checks.
• Verifying that discovered technical vulnerabilities have been resolved.
• Confirming that all payment workflows operate securely.

Ultimately, formal validation testing produces the concrete proof required by your acquiring bank and QSA.

Keep evidence of your recovery

Post-breach remediation often spans several months across multiple technical teams.

Maintaining organised audit trails throughout this period simplifies subsequent compliance validation.

Retain clear records of:

• Technical summaries of all completed remediation tasks.
• Firewall rule change logs and architecture revisions.
• Inventories of affected production systems.
• Formal vulnerability re-test reports and penetration test certificates.
• Signed confirmation that vulnerabilities were resolved.
• Official adjustments to CDE scope or segmentation boundaries.

Thorough documentation demonstrates governance and provides necessary evidence during formal assessments.

How will we know when recovery is complete?

Recovery completion depends on satisfying both technical objectives and your acquiring bank’s milestones.

In general, your team is ready for formal validation once:

• Engineers have remediated all vulnerabilities identified during the investigation.
• Broader security improvements from your roadmap have been completed.
• Technical testing confirms that new security controls operate effectively.
• Comprehensive audit documentation has been compiled.
• Any remaining PCI DSS compliance gaps are understood.
• Your team is prepared to complete the post-breach QSA assessment.

At this milestone, operational priorities shift from engineering repairs to formal compliance certification.

In summary

Recovery is the structured process of re-validating entity scope, eliminating root vulnerabilities, and strengthening your broader card processing environment.

Key recovery practices:

• Re-validate entity scope to ensure no cardholder data flows are overlooked.
• Translate investigation findings into a prioritised remediation roadmap.
• Engage a QSA early when post-breach validation audits are mandated.
• Fix underlying architectural flaws alongside initial attack vectors.
• Perform Targeted Risk Assessments and technical testing to validate control effectiveness.
• Organise detailed change documentation for assessors.
• Prepare for formal post-breach PCI DSS validation assessments.

A Qualified Security Assessor (QSA) like Securious ensures your technical remediation satisfies compliance criteria from day one, avoiding redundant effort.

Need help making sure your post-breach remediation supports your return to PCI DSS compliance? Arrange a call with one of our PCI DSS QSAs.

What next?

With remediation complete, you can begin the formal process of restoring certified compliance.

The following sections outline post-breach compliance validation:

• We need to regain PCI DSS compliance. What’s involved? – Navigating required validation assessments.
• Frequently Asked Questions – Answers to common post-breach scenarios.

We need to regain PCI DSS compliance. What’s involved?

At a glance: Technical remediation and formal PCI DSS compliance validation are related but distinct milestones. Once you fix vulnerabilities and verify controls, you must formally prove that your environment satisfies PCI DSS requirements and bank mandates.

During this final phase, emphasis moves from engineering fixes to formal control validation.

Exact compliance requirements depend on your incident history and acquiring bank directives.

Why isn’t recovering from the breach enough?

Merchants often ask why technical remediation alone does not automatically restore compliant status.

Remediation and compliance validation serve different functions.

Specifically, remediation repairs the flaws exposed by an incident, whereas PCI DSS validation provides formal verification across all security requirements.

Furthermore, acquiring banks frequently elevate merchant validation levels following confirmed breaches.

Who decides what PCI DSS validation we need after a breach?

Your acquiring bank establishes your post-breach validation tier, reflecting card scheme rules from Visa and Mastercard.

Never assume you can automatically revert to your pre-breach validation method.

Depending on incident severity, banks often require enhanced testing, continuous monitoring evidence, or comprehensive onsite QSA assessments.

Review bank instructions carefully and confirm all audit deadlines in writing.

Could we be required to complete a Level 1 PCI DSS assessment?

Yes, acquiring banks frequently elevate breached merchants to Level 1 validation requirements.

In our experience at Securious, organisations that previously completed Self-Assessment Questionnaires (SAQs) are frequently required to undergo formal Level 1 audits conducted by a Qualified Security Assessor (QSA).

This requirement provides payment schemes with independent assurance regarding your control environment.

Elevated validation may be temporary or ongoing, depending on bank and scheme risk assessments.

Could we be required to appoint a QSA?

Yes, acquiring banks routinely make QSA appointment a mandatory contractual requirement.

If mandated to engage a QSA, secure your assessor promptly to meet bank deadlines.

Banks often request a signed Letter of Engagement from your QSA as proof that formal compliance assessments are underway.

Your QSA evaluates scope, performs audit testing, and issues the formal Report on Compliance (RoC) required by schemes.

What happens once we’ve appointed a QSA?

Your QSA begins by reviewing your network architecture, breach findings, completed remediation, and current control environment.

Assessing these inputs allows the QSA to identify any outstanding compliance gaps ahead of final auditing.

If gaps remain, your QSA will help structure a prioritized remediation plan with realistic milestones. Assessors often use the PCI SSC Prioritised Approach to communicate progress to acquiring banks.

This structured reporting helps your acquiring bank monitor risk reduction while complex engineering items wrap up.

Your assessor will supply interim progress updates to the bank when requested.

What evidence might we need?

Documentation gathered during technical recovery serves as key audit evidence for your assessment.

Assessors typically examine:

• Records of completed technical remediation tasks.
• Formal vulnerability scans and penetration test attestations.
• Documentation proving that security flaws have been resolved.
• Updated network diagrams and payment flow maps.
• Approved information security policies and operating procedures.
• System configuration standards and baseline audit records.
• Logs confirming that security monitoring tools operate continuously.
• All supporting evidence required by the formal PCI DSS standard.

Retaining organised records simplifies the validation process and proves controls operate effectively.

What if our acquiring bank has given us a deadline?

Treat all bank deadlines with urgency and verify the exact milestone required by each date.

Deadlines often apply to specific stages, such as appointing a QSA, submitting remediation plans, completing penetration testing, or delivering a final Attestation of Compliance (AoC).

Do not assume deadlines can be extended without formal agreement. If a deadline appears unachievable, contact your bank immediately to discuss realistic project milestones.

Your QSA can help demonstrate progress and provide formal status reports to support deadline negotiations.

Proactive communication with your bank prevents escalations and processing penalties.

When are we PCI DSS compliant again?

Completing technical fixes does not by itself re-establish formal compliance.

Compliance is restored once you complete the mandated validation assessment and your acquiring bank formally accepts your Attestation of Compliance (AoC).

Your bank confirms when post-breach requirements are fully satisfied.

Your QSA guides you through the final assessment and issues the necessary validation certificates.

Will we always have to complete this higher level of PCI DSS assessment?

Not necessarily.

An elevated validation mandate following an incident does not permanently lock you into that assessment tier.

Once you demonstrate sustained security controls and satisfy your bank’s post-breach monitoring terms, your acquiring bank may permit a return to standard validation tiers, including self-assessments where applicable.

Ongoing validation terms remain at your bank’s discretion.

How long does it take to regain PCI DSS compliance after a breach?

Timelines vary based on technical scope, identified compliance gaps, and evidence readiness.

Factors influencing project duration include network complexity, remaining engineering tasks, scanning cycles, and assessor scheduling.

Distinguish between total project duration and individual milestone deadlines set by your acquiring bank.

Clarify expectations for each deadline and collaborate closely with your QSA to keep validation on schedule.

In summary

Post-breach compliance validation formally proves that your payment environment meets all applicable PCI DSS security controls.

To successfully navigate validation:

• Confirm all bank validation tiers and audit deadlines in writing.
• Appoint an accredited QSA immediately when required.
• Address all remaining control gaps systematically.
• Maintain comprehensive configuration and testing evidence.
• Complete mandated validation audits and submit attestations.
• Clarify future annual validation terms once the post-breach review concludes.

Need help regaining PCI DSS compliance after a breach? Arrange a call with one of our PCI DSS QSAs.

Frequently Asked Questions

Does every PCI DSS breach require a PCI Forensic Investigation (PFI)?

No. Scheme rules do not mandate PFIs for every incident. Your acquiring bank and card schemes evaluate incident risk to decide if formal forensic analysis is necessary.

When required, a PFI establishes how the breach occurred, whether data was stolen, and what remediation is mandatory.

What’s the difference between a PCI Forensic Investigator (PFI) and a Qualified Security Assessor (QSA)?

While both hold PCI credentials, their responsibilities differ significantly.

Specifically, a PCI Forensic Investigator analyses breach events to identify root causes and quantify data exposure.

Conversely, a Qualified Security Assessor (like Securious) helps organisations implement controls, achieve compliance, and complete formal post-breach validation audits.

Will we have to appoint a QSA after a PCI DSS breach?

Acquiring banks routinely mandate QSA appointments following confirmed breaches.

If mandated, engage your QSA promptly to maintain compliance with bank milestones. Your QSA will evaluate controls, identify remaining gaps, and deliver final validation audits.

Will we have to complete a Level 1 PCI DSS assessment after a breach?

Yes, acquiring banks frequently elevate breached merchants to Level 1 QSA-led audits, even if they previously qualified for self-assessment.

Therefore, your acquiring bank dictates your specific post-breach assessment tier.

Who decides what we need to do after a PCI DSS breach?

Your acquiring bank acts as your primary authority, enforcing rules established by Visa, Mastercard, and other card schemes.

While incident responders and QSAs provide technical support, your acquiring bank sets all binding compliance milestones.

Will we have to notify the ICO?

If the incident exposed personal data, UK data protection legislation applies.

Consequently, organisations must report qualifying personal data breaches to the Information Commissioner’s Office (ICO) within 72 hours where risk thresholds are met.

Seek qualified legal or data protection counsel alongside your technical response.

Will we have to notify our customers?

Customer notification depends on the categories of data exposed, regulatory requirements, and legal risk evaluations.

Your acquiring bank, legal counsel, and forensic specialists will advise on whether direct consumer notification is necessary.

Can we continue accepting card payments after a breach?

Payment continuity depends on the severity of the threat and acquiring bank directives.

While some merchants maintain processing under enhanced monitoring, others must adopt temporary operational adjustments.

What happens if we can’t meet a deadline set by our acquiring bank?

Never ignore a bank deadline. Contact your acquiring bank immediately to explain your progress and request agreed milestone adjustments.

Your QSA can assist by providing formal status reports demonstrating that remediation is actively proceeding.

Can a PCI DSS breach result in fines or financial penalties?

Yes, payment schemes may levy non-compliance fines, forensic audit costs, and fraudulent transaction assessments.

Penalties vary based on compromise duration, compliance history, and remediation speed.

However, prompt cooperation and thorough remediation significantly reduce exposure to severe scheme penalties.

How much does a PCI Forensic Investigation cost?

PFI costs vary based on infrastructure complexity, forensic scope, and required analysis hours.

Your acquiring bank will explain commissioning procedures and associated financial liabilities.

How long does the whole process usually take?

Timelines depend on network complexity, forensic findings, and remediation scope.

Simple incidents may conclude within weeks, whereas extensive breaches requiring deep architectural changes and Level 1 audits can span several months.

What if we weren’t PCI DSS compliant before the breach?

Many merchants identify compliance deficiencies only after an incident occurs.

Your focus should remain on containment, remediation, and achieving required security standards.

An accredited QSA will help you resolve control gaps and establish a viable compliance program.

What if the breach was caused by one of our suppliers?

Breaches frequently originate within third-party payment processors, software vendors, or hosting providers.

Even if an external vendor caused the issue, your bank may still require information regarding your environment.

Can Securious help if another company is already investigating the breach?

Yes. While a PFI performs forensic analysis, Securious provides remediation guidance and post-breach QSA compliance validation.

We already complete an annual PCI DSS assessment. Isn’t that enough?

Prior self-assessments do not exempt merchants from post-breach bank mandates.

Acquiring banks routinely require elevated validation before returning a business to standard processing terms.

Can we return to self-assessment after a PCI DSS breach?

Yes, acquiring banks often allow merchants to return to self-assessment once post-breach validation terms and sustained monitoring periods conclude successfully.

Does a PCI DSS breach automatically mean we weren’t compliant?

Not necessarily. While breaches often highlight control deficiencies, an incident alone does not legally prove non-compliance at the time of the event.

Subsequent assessments establish which controls were operating and identify required improvements.

Can we become PCI DSS compliant again after a breach?

Yes. Thousands of organisations restore compliant processing following an incident by completing remediation and achieving formal validation.

We need help now. Where should we start?

If you suspect an active breach, need to update your incident response procedures (PCI DSS Requirement 12.10.x), or have already been contacted by your acquiring bank, act quickly and consult qualified specialists.

Whether you need help decoding bank notices, structuring technical remediation, or completing QSA validation audits, early engagement prevents delays and protects your business.

Need immediate advice? Speak to one of our PCI DSS QSAs.