The EIC Compliance Blog
Frameworks explained, regulations decoded, and compliance strategies from the team that delivers 200+ engagements annually.
PCI DSS on Kubernetes — Scoping and Controls for EKS, AKS, GKE and ACK
Namespaces are not segmentation. How a Kubernetes cluster enters PCI DSS scope, the managed control-plane responsibility split, NetworkPolicy and service-mesh segmentation, RBAC, secrets, images, audit logs, and the findings we see.
All Articles
PCI DSS Requirement 11.4 Explained — What v4.0.1 Requires of Your Penetration Test
11.4.1 to 11.4.7 in plain English: methodology contents, 12-month and after-change cadence, six-monthly segmentation tests for service providers, tester qualification and independence, and what the QSA checks in the report.
The PCI DSS Shared Responsibility Matrix, Explained
What the matrix is, where AWS, Azure, Google Cloud and Alibaba Cloud publish theirs, how a QSA decides which controls are inherited and which must be evidenced, and the five mistakes that turn it into a finding.
SAQ or ROC? How PCI DSS Validation Works When You Host in the Cloud
Merchant and service-provider levels, which SAQ fits which cloud-hosted payment architecture, why “we’re on AWS so we’re SAQ A” is wrong, and how to reduce scope honestly.
PCI DSS on Alibaba Cloud — The QSA’s Guide to Cloud Compliance
Alibaba Cloud publishes a PCI DSS attestation — but its scope, regions and your workloads need checking. Shared responsibility, CDE scoping with Resource Directory and RAM, requirement-to-service mapping, and the gaps a QSA expects.
PCI DSS on Google Cloud (GCP) — The QSA’s Guide to Cloud Compliance
Google Cloud is validated at PCI DSS Level 1 — but your workloads are not. Shared responsibility, CDE scoping with projects and VPC Service Controls, requirement-to-service mapping, GKE scope, and the gaps QSAs find.
PCI DSS on Azure — The QSA’s Guide to Cloud Compliance
Azure is validated at PCI DSS Level 1 — but your workloads are not. Shared responsibility, CDE scoping in Azure, requirement-to-service mapping, and the gaps QSAs find most often.
PCI DSS on AWS — The QSA’s Guide to Cloud Compliance
AWS is validated at PCI DSS Level 1 — but your workloads are not. Shared responsibility, CDE scoping with Organizations and VPCs, requirement-to-service mapping, and the gaps QSAs find most often.
SWIFT CSP Mandatory vs Advisory Controls — CSCF v2025 Explained
A complete breakdown of SWIFT CSCF v2025 mandatory and advisory controls — what each covers, which apply to your architecture type, and common APAC assessment failures.
How Much Does PCI DSS Compliance Cost? A QSA’s 2026 Breakdown
A transparent breakdown of PCI DSS compliance costs — QSA fees, remediation, SAQ vs ROC, cloud hosting, scope reduction with CardIntel, and Year 2 maintenance costs.
How to Choose a PCI DSS QSA Organisation — 7 Questions to Ask
A practical framework for evaluating QSA organisations — 7 questions to ask, red flags to avoid, and how to verify PCI SSC listing before you sign.
PCI DSS vs ISO 27001: Which Does Your Business Need?
PCI DSS and ISO 27001 serve different purposes. This guide explains the key differences, which your organisation actually needs, and when pursuing both makes business sense.
What is CREST Accreditation and Why Does It Matter?
CREST is the international gold standard for penetration testing accreditation. Learn what it means, why it matters for your organisation, and how to verify a provider’s status.
ISO 27001:2022 Transition — Your Complete Roadmap
Everything you need to manage the transition from ISO 27001:2013 to 2022 — Annex A restructure, 11 new controls, transition deadline, and a 6-step migration roadmap.
SWIFT CSP 2026: Complete Guide for Bangladesh Banks
A practical guide to SWIFT CSCF v2025 compliance for Bangladeshi financial institutions — mandatory controls, attestation deadline, and Bangladesh Bank expectations.
PCI DSS v4.0.1 — What Changed and What You Must Do Now
A practical breakdown of the major changes in PCI DSS v4.0.1 — customised approach, targeted risk analysis, enhanced authentication, and the future-dated requirements that are now mandatory.