The Context

PCI DSS Level 3 applies to merchants processing between 20,000 and 1 million Visa or Mastercard e-commerce transactions per year. The Caya forex platform required scoping and gap analysis of the full payment processing pipeline, including cardholder data flows, network segmentation, access controls, logging, encryption, and vulnerability management. The engagement was conducted at a time when PCI DSS 1.x and the transition to 2.0 were reshaping compliance expectations for mid-tier merchants.

The Challenge

Forex platforms present non-standard PCI DSS scoping challenges: cardholder data flows may intersect with trading infrastructure, multi-currency systems, third-party payment gateways, and international processing paths. Clearly defining the CDE boundary, identifying all data flows, and mapping them to PCI DSS control requirements required close collaboration with platform engineers, operations, and third-party payment partners. Remediation prioritization had to balance compliance timelines with operational risk in a live trading environment.

What I Did

• •Scoped the cardholder data environment (CDE) across the Caya forex platform, including payment pipelines, third-party integrations, and network zones
• •Conducted cardholder data flow analysis to identify where card data was accepted, transmitted, processed, and stored
• •Assessed network segmentation controls to validate CDE isolation from out-of-scope systems
• •Performed a structured PCI DSS gap assessment against Level 3 requirements, including all twelve PCI DSS requirement domains
• •Mapped existing security controls to PCI DSS requirements and identified gaps, deficiencies, and compensating control opportunities
• •Developed a prioritized remediation roadmap scoped to Level 3 validation timelines and platform risk profile
• •Advised on encryption, tokenization, and key management practices for cardholder data at rest and in transit
• •Reviewed logging, monitoring, alerting, and audit trail capabilities against PCI DSS log management requirements
• •Assessed vulnerability management programs, patch cadence, and internal/external scanning practices
• •Supported policy and procedure documentation for incident response, access control, and security operations
• •Coordinated with third-party payment gateway relationships to validate scope boundaries and shared responsibility
• •Prepared the organization for formal Level 3 validation by a Qualified Security Assessor (QSA)

The Outcome

Completed PCI DSS Level 3 scoping and gap analysis for the Caya forex platform.