Approximately 360,000 credit card transactions a year is enough to put a company squarely in PCI’s most demanding merchant tiers. For one large entertainment and hospitality company, that transaction volume meant a Level 3 Merchant classification under Visa and Mastercard, and Level 2 under American Express, with a compliance deadline that left no room for a slow start. 

Amplix conducted a full PCI DSS readiness assessment across the organization’s reservation systems, call recording infrastructure, and supporting servers, completing the engagement and delivering a remediation roadmap in as little as 90 days. 

Quick Answer  A PCI DSS readiness assessment for a Level 2/3 merchant should cover documentation review, personnel interviews, a full gap analysis against SAQ-D, and vulnerability testing of any system that touches cardholder data. Amplix completed this process for a large hospitality operator in as little as 90 days, identifying clear-text card data across email, backups, and recorded calls, and building the remediation plan to close each gap.

The Challenge 

A Tight Timeline, a Wide Surface Area   

The company’s reservation and property management systems accepted and stored credit card numbers and were connected to the internet. The organization had already begun moving toward tokenization, but legacy exposure remained throughout the environment. 

• Full credit card numbers persisted in backups even after tokenization was adopted 
• Card numbers appeared in scanned images, emails, and printed forms kept under lock and key 
• The call recording system captured card numbers spoken during calls and saved them as audio files on a network drive 
• The assessment had to cover SAQ-D, the most extensive Self-Assessment Questionnaire category, with over 320 control questions 

The Approach 

A Full-Scope Assessment on a 90-Day Clock  

Amplix reviewed existing documentation, policies, and procedures, interviewed personnel across departments, and built a gap analysis between the current environment and PCI requirements. Alongside the documentation review, Amplix conducted an internal vulnerability assessment of the reservation system, property management platform, and other servers to identify weaknesses in application architecture and code. 

The result was a completed SAQ-D and a clear, prioritized remediation roadmap, delivered within the client’s 90-day window.  

The Solution 

Closing Exposure Across People, Process, and Technology  

Recommendations spanned immediate fixes and longer-term structural changes:

• Implement a mechanism to stop and start call recording whenever cardholder data is being discussed 
• Encrypt archived backups and secure the fax server so releases require authorized access and secure deletion afterward 
• Train call center personnel to handle and securely destroy emails containing cardholder data 
• Restrict and actively monitor database access to authorized personnel only 
• Acquire a locking cross-cut shredder and formalize a data classification policy to reduce mishandling of sensitive information 
• Develop a dedicated IT security function focused on identifying, implementing, and monitoring security risk on an ongoing basis 

The Outcome 

Compliance and a Repeatable Security Foundation 

The company achieved PCI DSS Level 3 and Level 2 compliance in as little as 90 days, backed by a completed SAQ-D and documented remediation plan rather than a one-time pass/fail result. Security standards were established across firewall configuration, password policy, system hardening, wireless access, and physical security, giving the organization a foundation it could maintain and audit going forward rather than revisit from scratch at the next assessment cycle. 

Why Amplix 

A 90-day compliance timeline doesn’t leave room for guesswork. Amplix combines documentation review, personnel interviews, and hands-on vulnerability testing into a single engagement so organizations get a complete picture of their PCI exposure, not just a passing score. Learn more about Amplix’s cybersecurity capabilities, or talk with an Amplix advisor about your own compliance timeline. 

---

Frequently Asked Questions

What determines a company’s PCI DSS merchant level? 

Merchant level is determined by annual transaction volume as reported by the card brands. Roughly 360,000 transactions a year, for example, typically places a merchant at Level 3 under Visa and Mastercard. 

What is included in a PCI SAQ-D assessment? 

SAQ-D is the most comprehensive Self-Assessment Questionnaire, covering the broadest set of PCI DSS requirements, and applies to merchants and service providers not eligible for a shorter SAQ type. 

How long does a PCI DSS readiness assessment take? 

Timelines depend on environment complexity, but a full assessment, including documentation review, personnel interviews, and vulnerability testing, can be completed in as little as 90 days when scoped and prioritized correctly. 

What happens if cardholder data is found in emails, backups, or paper records during an assessment? 

Any location storing clear-text cardholder data becomes a remediation priority. This typically means encrypting backups, restricting access, training staff on secure handling, and documenting a legitimate business need to retain the data, or purging it if no such need exists. 

Does moving to tokenization eliminate PCI compliance requirements? 

No. Tokenization reduces exposure but doesn’t eliminate scope entirely, especially when legacy backups, physical records, or call recordings still contain full card numbers from before tokenization was adopted.