Firstly, don’t panic. This is something that happens to a lot of people. It is also relatively common for an organisation to be asked about PCI DSS compliance for the first time, and to not really know where to start, or have internal expertise. The most important thing at this point is to establish exactly what your organisation is doing with card data. Dionach can help you with this with an initial conversation with a QSA around your understanding of your scope, and also help out with demystifying some of the terminology related to PCI DSS. Typically, at this point, we would recommend some form of scope review by a QSA, followed by a gap assessment to work out exactly where you are on your compliance journey. The output of these exercises would ensure that the scope of your compliance is correct and give a list of actions needed achieve compliance. The scope review would also highlight any existing processes that could make compliance difficult, or pose an unnecessary risk, with recommendations on alternatives. From that point, Dionach can support you through your compliance journey with as little or as much help as you need, with various services to help with working towards compliance and completing your annual attestation.