PCI DSS Compliance Audits
PCI DSS assessments for companies in Italy
1 Sequence Cyber Ltd is a PCI SSC-listed Qualified Security Assessor (QSA) company for Europe. Our QSAs, Ron Williams and Venkata Kamala Bandepalli, carry out PCI DSS v4.0.1 assessments for merchants and payment service providers in Italy, including ROC, AOC and SAQ support. Assessments are delivered in English. Scoping calls are free.PCI SSC-listed QSA company for Europe (verify on the PCI SSC QSA list) · ISO 27001 and ISO 9001 certified · Quarterly ASV scans through Qualys, a PCI SSC Approved Scanning Vendor
What is different in Italy
- PagoBANCOMAT, Italy's domestic debit scheme run by Bancomat S.p.A., is not a PCI SSC member brand. Most Italian debit cards are co-badged with Visa or Mastercard, so shared terminals and systems are usually in PCI DSS scope.
- Banca d'Italia supervises payment and e-money institutions. DORA has applied to them since 17 January 2025.
- The Garante per la protezione dei dati personali enforces GDPR together with Italy's Privacy Code (D.Lgs. 196/2003, as amended).
- Italy implemented NIS2 through D.Lgs. 138/2024, with the national cyber-security agency (ACN) as the authority.
How to choose a PCI DSS QSA in Italy
- Check the PCI SSC QSA list for the Europe region.
- Ask how PagoBANCOMAT and co-badged cards will be scoped.
- Ask whether Italian-language evidence can be reviewed, and whether your acquirer accepts an English ROC.
- If you are supervised by Banca d'Italia, ask how PCI DSS evidence will be reused for DORA.
Frequently asked questions
Is PagoBANCOMAT in PCI DSS scope?
Not on its own. Systems that also process a PCI SSC brand, which most co-badged cards do, are in scope.
Do you work in Italian?
Our assessments are delivered in English. Tell us at scoping if your evidence is mainly in Italian.