A large cruise line operator had just absorbed another company’s technology environment through acquisition, and its PCI DSS compliance posture needed to catch up fast. Merging two merchants’ cardholder data environments doesn’t just double the paperwork. It resets the clock on what “compliant” even means. 

Working with Amplix, the operator assessed its combined environment against all 399 applicable PCI DSS requirements under the SAQ D merchant type, uncovering exactly where compliance stood after the merger and building the roadmap to close what remained. 

Quick Answer  A PCI DSS assessment after a merger should treat the combined environment as a new baseline, not an average of the two prior states. Amplix’s review of a merged cruise line operator found an 82% compliance score across 399 requirements, with the clearest gaps in documentation, access review, and legacy system carryover from the acquired entity.

The Challenge 

A Merged Environment, Inherited Risk    

When one cruise line acquired another, it inherited more than ships and staff. It inherited an entire cardholder data environment, including a reservation and hotel-management platform with its own PCI scope, its own call recording system, and its own set of undocumented configurations. 

• The combined organization’s PCI DSS Merchant Type landed at SAQ D, the most comprehensive assessment category 
• No pen test had been performed on the legacy environment in several years 
• Contractor training on security policy wasn’t required or tracked 
• Server administrators lacked separate privileged accounts, and admin activity wasn’t logged or reviewed

The Approach 

Assessing the Combined Environment as a New Baseline  

Amplix conducted a full PCI DSS readiness assessment across the merged organization rather than treating either legacy environment as a starting point on its own. That meant reviewing documentation, interviewing personnel from both organizations, and mapping how cardholder data actually moved across systems that had never been evaluated together. 

The assessment scored the combined environment at 82% compliance across all 399 applicable requirements: 329 in place, 7 not in place, and 41 still needing testing or more information. 

The Solution 

Closing the Gaps Without Slowing the Integration   

Amplix’s recommendations focused on making the merged environment auditable, not just compliant on paper: 

• Establish a retention and purge policy for recorded calls containing cardholder data, rather than keeping them indefinitely 
• Build and maintain current cardholder data flow diagrams across all merged systems, updated as the environment continues to change 
• Document firewall and router configuration standards, including clear roles and responsibilities for who manages what 
• Formalize a training program that reaches all personnel, including contractors, so security policy awareness doesn’t lag behind the technical merger timeline 

The Outcome 

A Clear Roadmap Instead of an Open-Ended Risk 

The assessment gave the operator a prioritized, documented path to full compliance instead of an ambiguous merged environment nobody could fully account for. Firewall and router configurations that existed but weren’t documented now had clear ownership. Legacy systems inherited through the acquisition were brought into the same security review cycle as the rest of the organization, closing the visibility gap that the merger had created. 

Why Amplix 

A merger changes the boundaries of a PCI DSS environment overnight, and the requirements don’t pause while two companies integrate their systems. Amplix helps organizations treat compliance as part of the merger timeline itself, not an afterthought discovered during an audit. Learn more about Amplix’s cybersecurity capabilities, or talk with an Amplix advisor about assessing your own environment. 

---

Frequently Asked Questions

What is PCI DSS compliance?  

PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements for any organization that stores, processes, or transmits credit card data, scaled to transaction volume. 

What is required for PCI DSS compliance?  

Requirements span 12 categories covering firewalls, encryption, access control, monitoring, and policy documentation, verified through a Self-Assessment Questionnaire (SAQ) matched to merchant type. 

Do companies need a new PCI DSS assessment after a merger or acquisition?  

Yes. Combining two cardholder data environments creates a new compliance baseline, since the combined systems, access points, and data flows have changed. 

Who enforces PCI DSS compliance?  

The PCI Security Standards Council sets the requirements, but enforcement happens through the payment card brands and the banks that process transactions on a merchant’s behalf. 

How long does a PCI DSS readiness assessment take? 

Timelines vary with environment complexity, but a focused assessment covering documentation review, personnel interviews, and a gap analysis can typically be completed within a 90-day window.