trio.so

PCI DSS compliance for every device you manage

PCI DSS asks a lot of the laptops, desktops and phones that touch your card data environment. trio.so sets the required settings on every device, checks that they stay on, and gives you the evidence your assessor asks for. It covers Windows, macOS, Linux, iOS/iPadOS and Android from one console.

Start free trialBook a demo
  • Regional Leader, EMEA, Spring 2025
  • Easiest To Do Business With, Mid-Market, Spring 2025
  • Momentum Leader, Spring 2025
  • High Performer, Middle East, Spring 2025
  • Best Support, Mid-Market, Spring 2025

Rated 4.8 on G2

Endpoint compliance  ›  Frameworks  ›  PCI DSS
  • Disk encryption is enabledCTL-ENC-012.2.1
    critical9 devices
  • Firewall is onCTL-FW-011.5.1
    high0 devices
  • Passcode is requiredCTL-PWD-018.3.6
    high5 devices
  • Automatic security updates are onCIS-MACOS-1.36.3.3
    medium3 devices
Configuration policyFirewall · Windows and macOS
Resolved
Resolved after next evaluation
Audit trail

09:42Trio · Finding resolved · Firewall is on (1.5.1) · open → resolved after next evaluation · 6 devices

  • Diyar Private Academy
  • Wires & Fabriks
  • Corvuss American Academy
  • Arabi Company W.L.L.
  • Loglass
  • Skill Authority
  • Bright Learners
  • Synonym
  • Trell

Every device in scope needs controls and proof

Card data stays on the terminal, but the laptops and phones next to it are in scope too. PCI DSS reaches every company or employee owned device that connects to your card data environment. trio.so sets the required controls on each one, checks that they stay on, and keeps the record your assessor asks for.

  • Scope is wideRequirement 1.5.1 covers staff laptops and phones that reach both the internet and your card data environment.
  • Settings slipA firewall switched off for a quick fix stays off until someone notices.
  • Patches have a deadlineRequirement 6.3.3 gives you one month to install critical patches.
  • Policies aren't proofAssessors ask you to show each control in place, device by device.
A card terminal, a laptop and a phone inside one PCI DSS scope line

How it works

How PCI DSS checks work in trio.so

Checks usually live in three tools, and the proof in a spreadsheet. trio.so automates the device checks instead: you turn on the PCI DSS framework, see which devices fail which controls, and fix the settings with policies from the same console. It keeps checking on the schedule you set.

  1. Turn on PCI DSSActivate PCI DSS v4.0.1 for Windows, macOS, Linux, iOS/iPadOS and Android. trio.so maps its device checks to it.
  2. See what failsFindings rank every failing control by severity and devices affected, each with a due date.
  3. Fix and confirmUpdate the policy for the failing devices. A finding counts as resolved only after the next evaluation passes.
Start free trialBook a demo

Requirements

PCI DSS requirements trio.so helps you meet

Most of PCI DSS covers your payment systems and processes. Here is how trio.so helps with the device requirements, and where the proof lives.

PCI DSS requirementHow trio.so helpsEvidence in trio.so
1.5.1Security on devices that reach both networks

Applies firewall and other security settings as managed policies on every enrolled device, company owned or personal.

Policy status for each device, and firewall check results.

2.2.1Secure configuration standards

Enforces passcode, disk encryption, firewall, USB storage blocking on Windows and Linux, and WPA2 or WPA3 Wi-Fi.

Findings for each control, device by device.

5.2 · 5.3Anti-malware that stays active

Checks that anti-malware is active on each computer, and shows Microsoft Defender for Endpoint alerts per device.

Check results for each device, with Defender alerts beside them.

6.3.1 · 6.3.3Ranked vulnerabilities, critical patches within a month

Ranks vulnerabilities by CVSS, EPSS and the KEV list, then patches the OS and third party apps on your schedule.

Patch history: each job, the devices it reached and the result.

8.2.8 · 8.3.6Session lock and strong passwords

Passcode policies set auto-lock time, minimum length and lockout after failed attempts. A check confirms screen lock is on.

Screen lock check results and passcode policy status for each device.

12.5.1An inventory of in-scope systems

Lists each device's owner, serial number, OS and installed apps.

A device list you can export as CSV whenever you need it.

Requirement numbers from PCI DSS v4.0.1 (June 2024).

Controls

Enforce PCI DSS controls on every device

Settings drift between audits. trio.so sends policies to every enrolled device, and their status comes back: applied, failed or pending, device by device. Scheduled checks confirm the settings stay on.

  • EncryptionBitLocker on Windows, FileVault on macOS and disk encryption on Linux.
  • Screen lockAuto-lock minutes, minimum passcode length and lockout after failed attempts.
  • Firewall and updatesThe firewall on, and OS updates current, with a check that confirms both.
  • USB and Wi-FiUSB storage blocked on Windows and Linux, and WPA2 or WPA3 Wi-Fi.

Remediation

Track fixes and keep the record

A fix nobody checks is a guess. When a device fails a control, you fix the setting with a policy, the next check confirms it, and trio.so logs every step, so the history is ready when your assessor asks.

  • Fixes through policiesA configuration policy sets the firewall, encryption or passcode on the failing devices, and each device reports applied, pending or failed.
  • Verified next checkA finding is resolved only after the next evaluation passes on that device.
  • Exceptions expireAn exception covers one control on one device, with an expiry date. Then the finding opens again.
  • Audit trailFramework changes, policy updates, evaluations and resolved findings, with who, when and what changed.
A laptop failing a check, the setting fixed, and the laptop passing on the next check

See your PCI DSS findings in a free trial

Start a free trial, enroll a few devices and turn on the PCI DSS framework. The findings fill in from your own fleet.

Start free trialBook a demo
5
platforms, Linux included
$5
Plans start at $5 per device.
14 days
free trial, no credit card
24/5
support from our team
Monday to Friday

Every OS

PCI DSS checks on every platform

Each operating system reports different signals, so the depth differs. Here is what trio.so checks on each, so you know what your evidence covers.

  • Windows
  • macOS

Windows and macOS

macOS: screen lock, FileVault, firewall, Secure Boot, OS updates and anti-malware. Windows: BitLocker, firewall, Secure Boot, OS updates and anti-malware. Plus the status of every policy.

  • Linux

Linux

Posture signals such as disk encryption, firewall and OS updates, plus the status of core policies.

  • iOS/iPadOS
  • Android

iOS/iPadOS and Android

Whether passcode, encryption and other policies are applied on each phone and tablet, including Android work profiles.

Evidence

Evidence for your PCI DSS assessor

Screenshots go stale the day after you take them. Assessors ask you to show that a control is in place, not just that a policy exists, and trio.so keeps that record as it works.

  • Policy status per deviceApplied, failed or pending, for every policy.
  • Findings per controlWhich devices pass and fail each PCI DSS control.
  • Fresh evidence recordsEach check result with its source, time and freshness.
  • Audit trailWho changed what, from activation to resolved findings.
  • Patch historyEvery patch job, the devices it reached and the result.
  • ExportsEvidence, your device list and console members.
Device evidence records collected in one place

Why trio.so

Compliance checks in the same console as your devices

Another tool is another place to check. Most teams keep a compliance spreadsheet next to their MDM and their patch tool. trio.so checks, tracks fixes and records in the console that already manages the devices.

  • One device record

    Policies, checks, patches, inventory and remote actions share one device record.

  • Pricing you can read

    Plans start at $5 per device. Endpoint compliance is in the Secure plan and above.

  • Rated 4.8 on G2

    Support from real people 24 hours a day, Monday to Friday.

Related

Related compliance features

Pair PCI DSS checks with these trio.so features.

Integrations

Works with the tools you already use

Send device compliance data to Vanta, see Microsoft Defender for Endpoint alerts per device, stream events to Splunk, send alerts to Slack or Microsoft Teams, and bring users in from Microsoft Entra ID or Okta.

  • Vanta
  • Microsoft Defender
  • Splunk
  • Slack
  • Microsoft Teams
  • Microsoft Entra ID
  • Okta

PCI DSS FAQ

No tool can do that on its own. trio.so helps you meet the device requirements: its policies set the device settings, it checks them and keeps the evidence. Scoping your cardholder data environment, network segmentation, your payment application and the assessment itself stay with you, your payment provider and your assessor. Read how a PCI DSS audit works.

Many small merchants do, with a self-assessment questionnaire (SAQ) instead of a QSA. trio.so makes the device part easier: its policies set the device settings, it checks them on a schedule and keeps the evidence your SAQ answers rely on. Our guide to PCI compliance for small business explains merchant levels and SAQ types.

PCI DSS v4.0.1, published in June 2024. It is the version in force now. Our PCI DSS checklist walks through every requirement.

Screen lock, disk encryption, firewall, Secure Boot, OS updates and anti-malware on computers, plus the status of every policy you apply. On iPhones, iPads and Android devices it checks that passcode, encryption and other policies are applied.

They can. Requirement 1.5.1 covers company and employee owned devices that connect to both the internet and your card data environment. trio.so can manage personal Android phones through a work profile, which keeps work apps and data separate from personal ones.

Requirement 6.3.3 says critical patches go on within one month of release. Other patches follow the timeline your own risk ranking sets. trio.so shows CVSS, EPSS and KEV data so you can rank them, and schedules the patching.

No. trio.so checks that anti-malware is running on each computer. With the Microsoft Defender for Endpoint integration, it also shows Defender's alerts per device.

Usually, yes. Policies, training, vendor reviews and the assessment itself sit outside device management. trio.so works alongside tools like Vanta and connects to it (Vanta integration).