To get through audits successfully and as quickly as possible, you need
- a good auditor with a lot of experience in the security field who does not shy away from technical discussions.
- an internal person responsible who knows PCI DSS, understands it and has sufficient experience with the standard. Ideally a CISO with a very strong technical background. Alternatively, simply buy the know-how from outside and make sure it comes with a CISSP certification. However, the consultant must not only understand PCI DSS, but also be able to combine security with the business.
- a reduction of the scope. As a rule it is very unfortunate if every area of a company falls under PCI DSS. That not only increases the documentation effort, it also reduces overall productivity.
- Support from management. Nothing works without support from the top. A PCI certification not only costs money, at the beginning it will guaranteed be uncomfortable within the company. In practice PCI DSS does not have the best reputation and, admittedly, there are more pleasant certifications. Software developers in particular seem quick to see PCI DSS as the enemy. That does not have to be the case.
- Security as a continuous process. Before the audit is after the audit. PCI DSS does not end after the audit and does not start again at the next one. At the first audit you have to prove less that you "live PCI". At the second you should better not start from scratch again. For this, processes will be necessary. Employees have to be brought along. Without a person who explicitly holds the responsibility for this, the next audit is usually as difficult as the first.
- good preparation. You should already know before the actual audit whether everything is compliant and, if not, where your own weak spots are.