02The challenge
Orbital's card environment had grown organically across two regions. PCI DSS v4 brought targeted risk analyses and new authentication requirements, while DORA demanded a full ICT third-party register.
03The approach
- 1Scope reductionNetwork segmentation redesign removed dozens of systems from the CDE.
- 2Targeted risk analysesDocumented analyses for every flexible-frequency requirement.
- 3DORA gap to planICT risk framework, incident classification and register of information built alongside PCI.
- 4Pen testingSegmentation and application testing scoped to satisfy both regimes.
04In their words
They'd clearly sat on the auditor's side of the table. Every piece of evidence we produced was accepted first time.
05The results
- ✓Clean PCI DSS v4 Report on Compliance
- ✓DORA register and ICT risk framework ready ahead of supervisory review
- ✓One control set now serving PCI, SOC 1 and DORA