Compliance · PCI DSS

PCI DSS compliance with Offline Secure Storage®.

Protect cardholder data and align with PCI DSS v4.0 by keeping archived payment data off network-accessible systems, on hardware that is physically disconnected between sessions.

Book a mapping call Framework matrix

12 core requirements
PCI DSS v4.0
Scope reduction

Offline by default
Identity-locked access
Encrypted
Session logs

As featured in

The requirement

PCI DSS v4.0 requirements.

PCI DSS v4.0 tightens the rules for stored cardholder data, and expects customised approaches to be backed by demonstrable controls.

What it asks

Requirement 3 asks merchants to keep stored account data to a minimum and protect what they keep.

Alignment, not certification

This is a mapping, not a certification claim. Confirm current Cyber Essentials Plus status, scope and validity with Firevault. Everything else on this page is alignment, with evidence you can use in your own assessment.

Physically disconnected Offline Secure Storage: server, three drives and a padlock

What is tested

PCI DSS core requirements.

Each line is something an assessor, regulator or underwriter can ask you to evidence.

1
Protect stored account data

Keep it to a minimum, and protect what is kept.
2
Protect data in transmission

Strong cryptography over open, public networks.
3
Restrict access by business need

Only the people who need cardholder data can reach it.
4
Monitor and test networks

Log, review and test the controls.

Consequences

Non-compliance risks.

What happens when the control is missing, and there is no record to show.

Processing restrictions

Loss of the ability to process card payments.

Financial penalties

Fines from the card brands, passed on through your acquirer.

Forensic audits

Mandatory third-party security assessments.

Increased liability

Liability for fraudulent transactions.

The architecture

How OSS supports PCI DSS compliance.

Offline Secure Storage® takes archived cardholder data off network-accessible systems.

Network segmentation

Physical disconnection separates archived data from the cardholder data environment.

Access control

Identity-verified access, with full audit trails.

Encryption

Stored data is encrypted on dedicated hardware.

Scope reduction

Moving archived data offline shrinks the cardholder data environment.

What sits offline

Payment data protected.

The records most often moved into Offline Secure Storage® for this framework.

Archived cardholder data
Transaction records and logs
Payment processing documentation
Security audit evidence
Key management records
Compliance assessment reports

Authoritative sources

Read the guidance for yourself.

PCI Security Standards Council

PCI DSS v4.0

The standard itself, and the guidance around it.

PCI SSC document library

NCSC

Offline backups in an online world

Why at least one backup should be offline and separate from the network it protects.

Read the NCSC blog

Tell us which framework you are being tested against.

We will map Offline Secure Storage® to the outcomes your assessor is checking, with wording and evidence you can submit. From £360 a month including VAT. 36-month commitment.

Book a mapping call Get started