How The Boxoffice Company aced its PCI DSS audit with Sprinto
The Boxoffice Company, with 200+ employees across France, Scotland, Canada, Mexico and the U.S., is a leading provider of media, technology, and data for the global film industry. Its network of media brands reaches millions of movie fans across the U.S., Europe, and Latin America. The organization offers a collection of products, including websites, mobile applications, CRM, and online ticketing solutions, to help discovery platforms, studios, and exhibitors worldwide connect directly with moviegoers and fans.
– Marine Suttle
Managing Director, The Boxoffice Company
– Marine Suttle
Managing Director, The Boxoffice Company
Introduction
The Boxoffice Company is a white-label data solution provider to the movie industry, with 200+ employees across France, Scotland, Canada, Mexico and the U.S., and its products span websites, mobile applications, CRM, and online ticketing, connecting discovery platforms, studios, and exhibitors directly with moviegoers and fans.
With payment data running through those ticketing products, client demand for an Attestation of Compliance (AoC) with PCI-DSS was the initial impetus for pursuing compliance. Marine Suttle, Managing Director at The Boxoffice Company, spearheaded the effort to get PCI DSS-compliant.
What she needed was a compliance partner that could define the scope of PCI-DSS compliance, implement and monitor controls, and minimize internal workload, all while keeping global operations running without disruption.
The Problem
Marine identified expertise as the first of two major challenges to completing this project: while The Boxoffice Company’s engineers managed IT safeguards, they had no experience with the tactical and administrative tasks of compliance, which left uncertainty and stress about what to prioritize for a successful audit.
Marine says, “Taking on PCI DSS felt like we were going camping for the first time. We had no idea what to do or what to bring with us, which was quite stressful. We needed someone to guide us through the process.”
The second challenge surfaced after reviewing the PCI-DSS website, often the first stop for beginners, where The Boxoffice Company realized the complexity of maintaining compliance and documentation could easily spiral out of control, absorb time in research and documentation, and disrupt daily operations. To contain that, the company looked for a partner that could supply actionable steps, technical expertise, and open communication.
The Solution
The Boxoffice Company chose Sprinto after its solution consultants laid out a clear path to PCI-DSS compliance within the company’s timelines and with minimal disruption to global teams, a fit reinforced by Sprinto’s affordability and competitive features.
That path started with guided PCI-DSS scoping to right-size Level 1 audit requirements, then moved into milestone-driven platform and security program implementation, asset-level control integration, automated tracking, and time-bound tasks to hold on-time audit readiness.
“Sprinto broke down the journey into achievable and practical steps, what to do, and who can do it, showing us how we could achieve PCI-DSS compliance without people dedicated full-time. The platform would do the heavy lifting with our account manager guiding us. This felt reassuring, especially since it meant we wouldn’t have to read thousands of pages on PCI guidelines,” reflects Marine.
The Boxoffice Company quickly onboarded Sprinto, and a dedicated team got to work scoping out which activities fell under PCI-DSS.
The Boxoffice Company then integrated cloud assets and infrastructure across geos and teams for centralized, automated control monitoring, and rolled out employee security training and a vulnerability disclosure program, onboarding Sprinto-vetted vendors for ASV and VAPT and updating its policies to reflect the measures now in place, each of these key to the PCI-DSS audit.
This initial phase took around 6 weeks and, from a starting point of ~30% PCI readiness, took The Boxoffice Company 50% of the way to PCI-DSS compliance on Sprinto’s unified control dashboard.
From there, The Boxoffice Company’s compliance A-team concentrated on fixing controls and monitoring them until the final PCI-DSS audit, working from Sprinto’s real-time alerts and emails for any control failures and vulnerabilities. The Boxoffice Company also formed a “PCI committee” made up of representatives from legal, HR, Engineering, and Ops teams to hold control maintenance and audit readiness, a novel approach for a novel mandate.
Marine observes, “It takes a village to achieve compliance. With our distributed team across time zones, Sprinto helped us outline clear tasks and timelines, keeping everyone engaged and accountable for their part.” Within weeks, The Boxoffice Company was up to 98% PCI-DSS control health on the Sprinto dashboard and ready for its L 1 audit.
Impact
The Boxoffice Company’s PCI-DSS audit was unremarkable in the best way. Evidence was collected automatically, clearly linked to PCI control requirements, and pre-reviewed by Sprinto’s in-house experts, which made for a swift, spotless audit with few queries coming back to The Boxoffice Company.
“The PCI audit was very easy and fast, Sprinto pre-prepares everything, and auditors get their own dashboard to check evidence. They just went down the list, saw all the green check marks, and it was done,” explains Marine.
Beyond the audit itself, The Boxoffice Company streamlined its security operations by surfacing system inefficiencies on Sprinto and then smoothing them over and standardizing them. The people side of operations is a prime example: with 200+ employees distributed across 9 time zones, The Boxoffice Company had been working with a fragmented onboarding process, and it brought much-needed process harmony to that, aligning operations with security best practices across the board.
Marine says, “Our HR systems are different in each territory, and there’s no overarching system in place. In the UK it’s SageHR, ADP TotalSource in the U.S., and so on. Sprinto helped us tidy up the onboarding process, because now whenever there’s a new employee they’re added on Sprinto and the security process happens seamlessly,”
Using Sprinto’s mechanism for security training, staff device management, and policy acknowledgments, The Boxoffice Company introduced a compliance layer on top of its standard, region-specific operating processes: updated and uniform IT standards for both privacy and security, essential for demonstrating PCI DSS compliance.
Today, The Boxoffice Company monitors PCI-DSS as well as GDPR controls on Sprinto, and compliance sits as a natural part of operations within the organization, letting The Boxoffice Company win big and keep the business it has won. Marine adds, “Sprinto keeps us honest. Sprinto flags alerts for everything – be it missed scans on an unsecured employee laptop or a new code vulnerability. Even after the PCI audit, Sprinto’s helping us keep the certification.”
Got questions? Talk to our experts!
Media, technology and data for the global film industry
200+
France, Scotland, Canada, Mexico, U.S., EU
