Information security and card data · ISO/IEC 27001 with PCI DSS
ISO/IEC 27001 and PCI DSS consulting: one control set, two independent outcomes.
Payment processors, fintechs and the BPOs that handle card data for overseas clients are asked for both. ISO/IEC 27001 gives the management system and certificate; PCI DSS sets specific requirements for the cardholder data environment. Sterling builds one control set that addresses both, with the evidence collected once.
- One control set and one evidence base for ISO/IEC 27001 and PCI DSS, in place of a project for each
- One engagement team, one Effivity workspace and one all-inclusive proposal for the whole programme
- Each certificate, assessment or report comes from the independent party entitled to give it; Sterling prepares you and never issues them
- One control setAccess, logging, change, vulnerability and supplier controls written once and mapped to both.
- A smaller card data scopeSegmentation designed early, so PCI DSS applies to as little of your environment as possible.
- Evidence collected onceThe same logs, tickets and reviews serve the certification body and the assessor.
- One calendarSurveillance audits and annual PCI DSS assessments planned together.
Standards in this programme
The management system and the card data standard, mapped once.
ISO/IEC 27001 requires you to run a risk-based management system and choose controls from Annex A; PCI DSS prescribes specific requirements for systems that store, process or transmit cardholder data. Many requirements overlap, from access control and logging to vulnerability management and supplier oversight, so one control set can address both.
The outcomes stay separate: an accredited certification body issues the ISO/IEC 27001 certificate; your PCI DSS compliance is validated by a Qualified Security Assessor or the self-assessment questionnaire your acquirer accepts.
The engagement, step by step
One control set, one evidence base, then each independent assessment in its own lane.
Every Sterling engagement runs on Sterling OS™: five stages, each with deliverables, decision owners and a weekly working session with your engagement team. Multi-framework work sits under Revise™, the part of Sterling OS™ for new standard integration, delivered at the Design™ or the Drive™ level of support.
- 01
Scope and framework map
At the startWhat happens
We confirm what each customer, acquirer or regulator actually asks for, the systems and data in scope, and where the in-scope data flows. Each requirement of ISO/IEC 27001, PCI DSS is then mapped once, so overlapping requirements are met by one control rather than several.
You receive
- Agreed scope and boundary for each framework
- Control map: one control set cross-referenced to every framework
- Plan with owners, milestones and the assessment calendar
Your side
A project owner with authority across IT, security, operations and compliance, and the owners of the systems in scope.
- 02
Risk assessment and the common core
Early in the programmeWhat happens
One risk assessment, one policy set, access control, change management, logging and monitoring, supplier management, incident response and security awareness are written once with your teams, because every framework in scope asks for them in some form.
You receive
- Risk assessment and treatment plan
- Policy and procedure set mapped to each framework
- Awareness e-learning for your people from Sterling Academy
Your side
Managers agreeing one way of working for security across teams and sites.
- 03
Framework-specific requirements
Alongside the coreWhat happens
Each framework then adds what is specific to it. ISO/IEC 27001 adds the management system itself: context, risk assessment and treatment, the Statement of Applicability, internal audit and management review. PCI DSS adds the cardholder data environment and its segmentation, the protection of stored and transmitted account data, vulnerability scanning and penetration testing, and the targeted risk analyses version 4.0.1 expects.
You receive
- Framework-specific registers and procedures
- Evidence plan: what each assessor will ask to see, and who owns it
- Effivity configured with every framework in one workspace
Your side
System owners putting the controls into daily use, so evidence builds up as people work.
- 04
Internal audit and readiness review
Before any assessmentWhat happens
One internal audit covers the shared controls, with findings traced to each framework, followed by a readiness review against the specific requirements of each assessment. Gaps are closed on evidence before an assessor arrives.
You receive
- Internal audit report with findings traced to each framework
- Readiness review per framework
- Corrective actions closed on evidence
Your side
Owners closing findings and keeping evidence current.
- 05
Independent assessments
When readyWhat happens
Each outcome comes from the party entitled to give it: an accredited certification body for ISO/IEC 27001, a Qualified Security Assessor or the self-assessment questionnaire your acquirer accepts for PCI DSS, a licensed CPA firm for SOC reports. HIPAA has no certificate; compliance is shown by your documented safeguards and assessments. Sterling prepares you and supports you through each one, and does not certify or issue reports.
You receive
- Assessor and certification body options compared, their standing checked
- Support through each assessment until the certificate or report is issued
- A shared calendar for surveillance audits, re-assessments and report periods
Your side
Management attending the opening and closing meetings, and owners answering assessor questions.
Who does what
Choose how much of the work Sterling carries.
Design™ gives your team the structure, templates, workshops and coaching to integrate the systems itself. Drive™ has Sterling consultants carry the integration work with your system owners. They are alternatives, not phases: the software, the training, the accountability and the all-inclusive proposal work the same way in both.
| Task | Design™ guided | Drive™ fully managed |
|---|---|---|
| Scope, integration map and plan | Sterling with your system owners | Sterling with your system owners |
| Common core: policy, risk method, document control | Together your team drafts on Sterling's templates, Sterling reviews | Sterling with your managers |
| Merging existing procedures and records | Your team coached in the weekly session | Sterling consolidated from your current systems |
| Framework registers: risks, assets, data flows, vendors | Your team coached discipline by discipline | Sterling populated with your data |
| Effivity configuration and data migration | Sterling one workspace for every standard | Sterling one workspace for every standard |
| Putting the combined controls into daily use | Your team with guidance in the weekly session | Your team Sterling checks the evidence |
| Internal audit across every framework | Together your trained auditors, Sterling facilitates | Sterling conducted for you across every standard |
| Management review | Your management Sterling prepares the inputs | Your management Sterling prepares and facilitates |
| Certificate, assessment or report decision | The certification body, QSA or CPA firm never Sterling | |
Which model suits you? Where a quality, HSE or IT lead can give the integration some hours each week, Design™ is the usual choice. Where several mature systems must be merged against a deadline, or nobody has that time, Drive™ is. The discovery call settles it.
What you receive
Everything the programme needs. Nothing charged separately.
- Framework map and gap analysisEvery requirement of ISO/IEC 27001, PCI DSS mapped to one control set, with each gap given an owner and a date.
- Implementation plan and assessment calendarMilestones, responsibilities, the weekly sessions and the window for each certificate, assessment or report period.
- Policies, procedures and registersOne documented control set on Sterling’s template sets, cross-referenced to each framework so an assessor finds the evidence quickly.
- Effivity workspace, configuredControls, evidence, risks, audits, actions and training for every framework in one place, included at no additional cost.
- Trained peopleSecurity awareness e-learning for everyone and practitioner learning for control owners, with Certificates of Completion.
- Internal audit and readiness reviewsOne internal audit with findings traced to each framework, then a readiness review before each assessment.
- Assessment supportCertification bodies, QSAs and CPA firms compared and their standing checked, and support until each certificate or report is issued.
- The Sustain™ calendarA year-ahead plan for surveillance audits, re-assessments, report periods, risk reviews and refreshers across every framework.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessHow we price
One all-inclusive proposal. Every component visible. No surprises, ever.
The investment in an integrated system depends on which standards are in scope, which are already implemented or certified, how far your existing systems overlap, the sites, the headcount and the current maturity of your processes. That is why every Sterling proposal is built for your organisation rather than read from a price list. The way the proposal works stays the same.
- One all-inclusive proposal for Sterling's work, software and learning. Consulting, Effivity and Sterling Academy access in one figure; the fee does not move when the work takes longer than we planned.
- Assessor fees identified separately. Certification body, QSA and CPA firm fees, travel and repeat arrangements are shown as their own lines, so the full programme cost is comparable across proposals.
- Payment milestones tied to deliverables, not to the calendar: the gap analysis report, the documented system, the internal audit, each certificate or report.
- Deliverables, responsibilities, assumptions and exclusions in writing, and nothing to sign to receive the proposal.
To prepare your proposal we need
- The standards in scope, and which of them you already hold certificates for
- The certification bodies and audit dates of any current certificates
- The activities and sites to be covered
- Approximate headcount
- Your deadline, or the customer or tender date behind it
That is enough for a scoped, all-inclusive proposal from a Sterling consultant in your region. There is no need to prepare a manual first.
Request a scoped proposalA Sterling consultant replies within one working day.
Don’t be fooled by certification scams
Sterling against the alternatives.
The market offers four ways to a certificate. Three of them leave you with a system that does not run, a certificate that fails a customer's check, or both. This is what each route actually gives you.
| What you get | Template kit, do it yourself | "Certified in 10 days" seller | Body-shopping consultant | Sterling |
|---|---|---|---|---|
| A system built around your operation | Only if your team has the time and the expertise | No: a template with your name on it | Depends on the individual assigned | Yes, with your process owners, on Sterling's template sets |
| Your people trained | Not included | Not included | Sometimes, at extra cost | Included: awareness, practitioner and internal auditor training |
| Software to run the system | Paid for separately | None | Paid for separately | Effivity, included at no additional cost |
| Internal audit and management review before the audit | If you know how | A formality, if at all | Usually | Always, with findings closed on evidence |
| Certificate from an accredited body | Your choice | Often not accredited, or not for your scope | Usually | Always: accreditation checked before you sign |
| Who is accountable if the audit goes badly | You | Nobody | The individual, if still available | Sterling, under the Sterling Promise, until you are certified |
| Fee transparency | Kit price only | One invoice for consulting and certificate | Day rates, open-ended | One all-inclusive proposal; certification-body fees shown separately |
| After the certificate | On your own | Gone | Another contract | Sustain™: surveillance, internal audits, refreshers, transitions |
Sterling's position. Sterling does not certify. We consult, train and prepare you; an independent, accredited body audits and decides. We do not sell certificates without implementation, and we tell you when an offer you have received is one. All ten warning signs of shortcut certification · How to check any ISO certificate
Client experience
On the record: what clients say about working with Sterling.
The person in charge of information security at GCIF writes that, in the company's work on PCI DSS and ISO/IEC 27001, reaching its milestone with only one nonconformity would not have been possible without Sterling's expert direction and structured approach.
The operations manager at CSV Now writes that, in the company's work on ISO/IEC 27001, HIPAA and PCI DSS, the attention to detail, the collaborative approach and the commitment to excellence of Sterling's team set a standard that far exceeded the company's expectations.
OBPO Managed Service's IT risk manager says the PCI DSS engagement gave the company greater clarity on its responsibilities across payment processes, technology environments and internal controls. The structured approach, the evidence review and the readiness activities helped the team organise its compliance efforts and strengthen its security practices.
The company's chief compliance officer writes that the HIPAA and PCI DSS gap analysis gave valuable insight into its compliance posture, existing controls and areas for improvement. It clarified the requirements, helped the company prioritise remediation and set clear action plans to strengthen its security practices. The team's technical expertise, structured approach and practical recommendations made the assessment efficient, credible and valuable for the company's compliance objectives and its customers' assurance requirements.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients ask about ISO/IEC 27001 + PCI DSS.
The answers for your own scope come from the discovery call. These are the questions most programmes begin with.
Does ISO/IEC 27001 certification make us PCI DSS compliant?
No. They overlap heavily, but PCI DSS has specific technical requirements and its own validation. A strong ISO/IEC 27001 system makes PCI DSS much easier, and the reverse; neither replaces the other.
Do we need a QSA for PCI DSS?
It depends on your merchant or service provider level, which the card brands and your acquirer set. Larger volumes need a Report on Compliance from a Qualified Security Assessor; others may complete the self-assessment questionnaire your acquirer accepts. We confirm which applies before the plan is fixed.
Can one audit cover all these frameworks?
Not as one formal assessment, because each outcome comes from a different independent party under its own rules. What we can do is build one control set and one evidence base, so the same evidence serves each assessor, and plan the assessments close together so your people prepare once.
Should the ISO/IEC 27001 scope match the PCI DSS scope?
Not necessarily. ISO/IEC 27001 often covers the whole organisation or service, while the PCI DSS scope should be kept as small as segmentation allows. We set both deliberately at the start.
How long does the programme take?
It depends on the frameworks in scope, which you already hold, the systems and sites, and for a SOC 2 Type 2 report the length of the period your customers expect. The discovery call gives you a dated plan for your scope; there is no fixed number we can reliably promise in advance.
Keep exploring
Other integrated programmes
Watch a video on implementing ISO 27001 and PCI DSS together here.
Programmes clients combine most often
Talk to a consultant
Plan ISO/IEC 27001 + PCI DSS as one programme.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice