Question 1

Is CinderRook a formal PCI assessment or QSA?

Accepted Answer

CinderRook provides assessment readiness and scope clarity—not a formal QSA assessment, certification, ROC or AOC production, or assessor sign-off. Your chosen QSA or qualified assessor owns the formal assessment and any resulting certification or attestation.

Question 2

Who is CinderRook for?

Accepted Answer

CinderRook is built for mid-market merchants, payment service providers, and teams whose vendors, payment flows, or operating environment have changed. It is a fit when the business needs a clearer readiness starting point before formal assessment or a steadier way to run PCI work between assessments.

Question 3

How does a scope-check responsibility gap become an owned action?

Accepted Answer

We turn the gap into an owned action by validating the assumption with the relevant team or provider, naming the owner, defining the evidence or control needed, prioritizing remediation, and handing off a written brief or recurring operating cadence.

Question 4

What evidence does CinderRook produce or support?

Accepted Answer

CinderRook produces or supports payment-flow and system-boundary maps, vendor and responsibility assumptions, directional findings and open questions, control and evidence workflows, vendor follow-up, and a prioritized readiness handoff. These are practical operating artifacts—not a ROC, AOC, or formal assessor deliverable.

Question 5

How long does a CinderRook engagement take?

Accepted Answer

A focused, time-boxed readiness engagement is shaped around your scope and complexity, so there is no one contractual SLA or fixed timeline to promise. Ongoing PCI operations use a recurring cadence, including the monthly support model described in our pricing, when the team needs continued follow-through.