Lion Cipher Lab
Scope a cardholder data environment and complete a PCI DSS self-assessment (SAQ)
- GRC / Compliance
- Intermediate
- ~55 min
- Free · no account required
Why it matters
If a business takes a card, it is under PCI DSS. Not sometimes, not above a certain size — the moment a merchant signs an agreement with a bank to accept card payments, that agreement obliges them to protect card data to the standard. That covers the multinational retailer and it covers the person selling candles at a weekend market with a card reader in their apron. What separates a competent practitioner from a panicking one is not knowing the twelve requirements by heart; it is being able to draw a line around the systems that actually touch card data, defend that line, and then shrink it.…
What you'll learn
- PCI DSS scoping and CDE definition
- cardholder data vs sensitive authentication data
- payment data-flow mapping
- scope reduction (tokenization, P2PE, hosted pages, segmentation)
- choosing the right SAQ type
- completing requirement responses and an Attestation of Compliance
- building a remediation plan with owners and dates
Steps in this lab
- The vocabulary, from absolute zero — and the one rule you must never break
- Who writes the rules, who enforces them, and what an 'acquirer' actually is
- Choose your merchant scenario and set up the working folder
- Draw the CDE — the three-bucket inventory that decides how much work you have
- Trace one payment end to end — the step that changes your answers
- Scope reduction — the real skill, and the four levers that do it
- Pick the right SAQ — then go and download the real one
- The twelve requirements, held in one head — plus defined vs customized approach
- Answer a real slice of it — a dozen responses you have to be able to defend
- Write the attestation summary and the remediation list
- Why this, not that — PCI DSS against SOC 2 and ISO 27001, and who actually chases you