Served as the single point of contact for internal and external audits, carrying a CloudStack environment's PCI DSS certification from version 3.x through to version 4.0.
Delivered by ThirtyZero's founder in senior technical and compliance roles prior to founding the company. Client names and identifying details are withheld under confidentiality.
Maintaining one certification is a full-time discipline on its own. This role required owning three at the same time, ISO 27001, ISO 9001, and PCI DSS, for a CloudStack cloud environment, with a single person acting as the point of contact for every internal and external audit across all three.
Partway through, PCI DSS itself changed. Version 4.0 replaced the long-standing 3.x series with new and more detailed requirements, which meant the certification work was not just maintaining an existing standard but carrying the environment through a full framework revision without losing certification status along the way.
Acted as the sole point of contact managing both internal audits and external certifying-body audits across ISO 27001, ISO 9001, and PCI DSS for the CloudStack environment.
Kept the information security management system (ISO 27001) and quality management system (ISO 9001) certifications current through their respective audit and surveillance cycles.
Managed the environment's PCI DSS compliance through the release of version 4.0, updating controls and documentation to meet the new requirements rather than letting the certification lapse at the framework change.
PCI DSS 4.0 introduced more detailed and, in places, stricter requirements than the 3.x series it replaced, including changes to authentication, monitoring, and how organizations are expected to demonstrate ongoing compliance rather than point-in-time compliance. Carrying an existing certification through that change means updating controls and evidence to match the new standard, not simply re-submitting the old documentation.
ISO 27001, ISO 9001, and PCI DSS overlap in places but are not the same framework, and each has its own audit cycle, evidence requirements, and certifying bodies. Managing them as one integrated program, rather than three disconnected efforts, is what keeps the audit workload from tripling.
Being the person auditors, both internal and external, go to for evidence, walkthroughs, and remediation status across all three frameworks. It means the organization is not scrambling to find the right person when an audit starts, because one person already owns the full picture.
Yes. This describes the kind of compliance program ownership ThirtyZero's founder has held formally, as part of a job description, at a previous employer. The employer's name is withheld under confidentiality; the scope is described here to show the kind of audit and certification management work we can take on.
A complete virtualization platform built from the hypervisor up, then used to move existing tenants off an aging NSX-v environment onto NSX-T without asking them to start over.
Read case studyBuilt alongside a Microsoft-partnered Dell team to bring Azure's cloud model on site, keeping financial-sector data inside the country rather than in a public Azure region.
Read case studyTell us what you are working with and what is not working. We will give you a straight answer on scope, approach, and whether it is a fit.
