The Solution – Consolidated controls, accurate tracking, and sweeping compliance 

Once CellPoint got Sprinto up and running they could immediately see the gaps in security infrastructure. “We identified weaknesses in device management, identity provisioning, and access controls almost right away,” says Thomas. 

Joining forces with Thomas on PCI-DSS audit prep, Frederic Lauret, security architect and decades-long PCI practitioner, was immediately impressed by Sprinto’s impact. 

Right off the bat, Frederic could see that Sprinto brought structure to compliance, enabling better visibility and helping ensure alignment with PCI-DSS recommendations. This newfound transparency empowered the team to swiftly address security gaps and configure systems for sweeping PCI-DSS compliance. 

I’ve been doing PCI certification for ten years and this is the first time I have something that groups all the information and also checks what should be done. I appreciate how the platform tells us what to do and where we’re sliding so that the certification process is always on track. 

Sprinto’s pre-built controls library worked in the background to tie systems, procedures, and policies to controls and produce a clear picture of compliance health on the dashboard. This enabled Frederic to bypass manual planning and focus efforts on tackling compliance gaps. 

We have a control summary on the dashboard, and we just have to go through that to fix things a little bit every day.

With a wealth of experience operationalizing PCI-DSS, Frederic specifically wanted a solution to help maintain a state of compliance beyond audits. “People tend to believe that PCI compliance is just for the time of the certification, but it’s not. It’s ongoing and you need to be compliant throughout the year, not once in the year.”

Sprinto’s continuous compliance monitoring capabilities started running six to seven thousand daily checks on CellPoint’s various compliance controls. This real-time vigilance ensured they never veered from compliance. 

“The metrics are reported at all times, and if something is sliding, we can see it. If you don’t have someone on board to do this manually, then this is where the tool can help, because you have a lot of things that you need to do over time: checking that your logs are okay, checking your users, and checking that all the components of your infrastructure are configured according to PCI requirements. All those things are automated on Sprinto”, Frederic explains.

Leveraging automation for precision, efficiency, and integrity 

Sprinto’s automation helped Cellpoint ensure PCI-DSS controls, consequently strengthening compliance posture and enhancing precision. 

Frederic elaborates, “Previously, under PCI-DSS, I only reported on 5-10% of the infrastructure. Now with Sprinto, I can report everything, so our level of compliance is much more comprehensive and precise. It’s not just a daily check on a small subset, but everything, every day. It’s so much more satisfying.” 

The CellPoint security team noticed two crucial benefits as a result of implementing compliance automation. 

1. Reduced scope of work: Sprinto minimized infosec housekeeping, freeing the team to pursue larger security goals. 
   
   

“We have more margin to operate now that everything’s under control. If we notice vulnerabilities in our processes or if we have to validate some crucial evidence, we have the opportunity to actually consider that matter,” says Frederic. 

2. Increased integrity and trustworthiness: Automation streamlined control testing and evidence collection specifically, improving compliance throughput at large. 
   
   

Thomas explains, “Of course, you can maybe take a screenshot yourself or do some sampling here and there, but you won’t have that overview, and you might miss things. When you need to count on yourself the amount of effort is much higher, so from my point of view Sprinto is actually much more compliant and much better than you would be able to do yourself.”

Having secured its infrastructure and processes according to PCI-DSS guidelines and with Sprinto automatically collecting evidence to demonstrate the same, CellPoint felt confident entering its PCI-DSS pre-audit.

If anybody asks me what I did for the company, I’ll point to the Sprinto dashboard and say, this is it. I can demonstrate that we were at 25% readiness before Sprinto, and now we are looking at upwards of 90%: it’s so much better.

The Result – Organized, collaborative, and automated compliance

CellPoint Digital is a Service Level One organization, and undergoes a PCI audit by a QSA (Qualified Security Assessor) once a year. 

For its audit with Sprinto, CellPoint utilized Sprinto’s audit dashboard to create an audit instance and share granular, control-linked evidence with their QSA. They could collaborate on-platform, fielding precise evidence requests to systematize the audit process.

 Sprinto’s hands-on support both pre and post-audit played a crucial role in helping CellPoint clear their PCI-DSS audit. 

Thomas explains, “Sprinto’s guidance was extremely helpful in pushing us to be better during the entire certification process. When you’re strapped for resources, you can’t put a lot of people on a problem, so Sprinto’s support was something we capitalized on. It’s one of the most valuable parts of the tool.” 

Large-scale compliance automation at CellPoint has now fostered a cultural shift, tending towards enhanced ownership and collaboration. 

Assigning risk and control owners on Sprinto ensures accountability, Sprinto’s automated notifications keep compliance on track and Sprinto’s dashboard enhances overall visibility so everyone involved in compliance can see how well the organization is doing and where to put in additional effort. 

“When you have automation, things are easier: it’s easy to delegate and collaborate. In general, I think we’re getting more organized,” remarks Thomas. 

The biggest needle-mover for CellPoint, however, was Sprinto’s continuous monitoring.  

Thomas elaborates, “Earlier you spent three months taking screenshots of everything. After that, you get your certification, and then everybody goes off to do something else. Now we’re working on it continuously and keeping compliance under control. If we didn’t have Sprinto that would be impossible.” 

Empowered by Sprinto’s continuous compliance monitoring, which maintains CellPoint’s controls in the green, the team is confident in taking on SOC 2 and SOC 1 audits next and expediting their next PCI-DSS audit. 

“If we had to do these compliances the old-fashioned way, it wouldn’t be possible. I also believe we will be ready for the PCI certification audit in one week compared to several months last year. I believe we can do it!” exclaims Thomas. 

CellPoint Digital has successfully brought structure, visibility, and automation to its compliance function, resulting in stronger security guardrails, enhanced collaboration, and significant reductions in effort. However, the team isn’t resting on its laurels, and is looking to keep improving as they take on new challenges and frameworks.

I would say our organization is much more efficient now when it comes to compliance, even if it’s not perfect. We are getting better in steps, and that’s a win for us.