Continu-US · PCI DSS 4.0.1
Continu-US for PCI DSS 4.0.1
Continuous verification of your cardholder data environment, scoped to the validation method you assess under.
Continu-US checks your cardholder data environment from the systems you already run: endpoints and payment workstations, firewalls, switches and routers*, cloud, ticketing and your SIEM. It shows where you stand against every PCI DSS v4.0.1 requirement in scope, whether you complete a self-assessment questionnaire or a QSA writes your Report on Compliance, and it runs in your own Azure environment.
Validation method and scoping
The requirements your method actually contains
All 260 PCI DSS v4.0.1 requirements are mapped, and the list narrows to the ones your validation method and entity type contain.
Validation method
Twelve methods are built in: the ten self-assessment questionnaires and both Reports on Compliance. A reduced SAQ scopes out the requirements it does not contain, rather than leaving you to mark them not applicable by hand.
Entity profile
Merchant, service provider or both. Service-provider-only requirements, and Appendix A1 and A2, follow from the profile rather than the questionnaire, so a reduced SAQ doesn’t drop them. A service provider recorded against a merchant questionnaire is flagged as a mis-selection.
Indicated brand level
Enter annual transaction volumes by card brand, and the indicated level for each is worked out from that brand’s own published thresholds, with your service provider category recorded alongside.
Cardholder data environment
Tag each device as in the CDE, connected-to or security-impacting, or out of scope. Out-of-scope devices are left out of PCI results and reports.
Program records
The records PCI expects you to keep, kept
Program registers
System components, media, wireless access points, point-of-interaction devices, third-party providers, the responsibility matrix, targeted risk analyses, scope, segmentation and the operational review, each tied to its requirement.
Critical control failure log
Requirement 10.7: each failure of a critical security control recorded with when it was detected, the cause, what was restored and how long it took, with your response captured against it.
Service provider obligations
If you’re a service provider, the additional cadence PCI puts on you is scheduled and evidenced, and a customer evidence packet is produced that you can hand to your own customers.
Assessment readiness
Days remaining to your assessment date, progress against each milestone, the registers still to complete, and alerts where a third-party service provider’s own validation has lapsed.
Continuous verification
Verified all year, with the periodic work on a calendar
Checked against PCI’s own values
Each result is mapped to the PCI DSS requirement it supports. Where PCI DSS is stricter than a general baseline, results are judged against PCI’s figure: a 30-minute lockout duration (8.3.4) is checked as 30 minutes, not a shorter default.
Drift alerts
A setting that moves from its approved value shows up the day it happens, with the device and the before and after values, instead of at your next assessment.
PCI activity calendar
The periodic work PCI DSS expects, scheduled and tracked with evidence: penetration and segmentation tests, ASV scans, access reviews, risk analyses, payment terminal inspections, rogue wireless checks and more, at frequencies within PCI’s limits.
Compensating controls and remediation
Record a complete compensating control worksheet; if evidence for that requirement starts failing, it’s flagged as a conflict. Raise a remediation item in one click from any failing finding, with owners, dates, change history and spreadsheet export.
Results in PCI’s terms
An indicated result your assessor recognizes
Continu-US indicates; your assessor decides. Each requirement is shown with the result its evidence points to, using the same terms as PCI DSS reporting.
In Place
Passing checks, current activities or documents, and nothing failing.
In Place with CCW
Met through a recorded compensating control worksheet.
Not in Place
Failing or overdue evidence, or an open remediation item.
Not Applicable
Outside your scope: not contained in your validation method, or tied to an entity type you are not.
Not Tested
Nothing decisive collected yet.
Progress against all six Prioritized Approach milestones on one page, a filled copy of PCI SSC’s Prioritized Approach Tool for v4.0.1 with each entry marked for assessor confirmation, an annual report in PCI terms, and a hashed evidence package organized by requirement that your assessor can verify independently.
Built by a QSA company
Built by assessors who know what evidence holds up
Continu-US comes from Anthony Timbers LLC, a PCI Qualified Security Assessor company. We’re also an authorized CMMC Third-Party Assessment Organization (C3PAO) and a FedRAMP 3PAO, accredited to ISO/IEC 17020.
Evidence from your endpoints, payment workstations, network devices, cloud, ticketing system and SIEM is collected as configuration and activity evidence, never cardholder data. Also handle government or defense work? The same evidence maps to NIST SP 800-53 Rev 5 and to CMMC Level 2, so you can switch views without collecting anything again.
* Specific firewall, switch and router brands are supported.
We never assess an organization we manage, advise, or license Continu-US to. Continu-US indicates results; determinations of compliance are made by your assessor. Continu-US supports your compliance program; it doesn’t certify it, and it doesn’t guarantee an assessment result. PCI DSS is a standard of the PCI Security Standards Council.
Capability brief
Continu-US PCI DSS capabilities
The full PCI DSS edition of the Continu-US capability brief, including evidence sources, deployment and security details.
See it on your environment
Run it yourself as a licensed platform, or have ATLLC run it for you as part of our managed security services. Onboarding is guided, and its length depends on the size and complexity of your cardholder data environment; we agree the plan during discovery.
More on Continu-US: Overview · CMMC Level 2 · Pricing · MSSP partners
One firm. Four authorizations.
MSSP
CMMC Level 2 Certified MSSP
24/7 security monitoring and incident response for small to mid-sized businesses and DoD contractors.
C3PAO
Authorized CMMC C3PAO
Official CMMC Level 2 certification assessments, authorized by the Cyber AB.
3PAO
FedRAMP 3PAO
FedRAMP Rev5 and 20x assessments as a FedRAMP Recognized independent assessor, accredited to ISO/IEC 17020.
QSA
PCI Qualified Security Assessors
PCI DSS assessments and consulting, listed as QSAs on the PCI SSC website.
Team credentials
ISO/IEC 17020 accredited