[abritishguy]

Name and shame, this auditor is actively damaging security and should be shut down.

[madaxe_again]

I've worked with about eight or nine. Two of them are jaw drops in horror. A bunch are "err, what?", but get the job done vaguely competently if in a very procedural fashion. Quite often it's totally nontechnical people with backgrounds in finance/filing who do the assessment. Finally, there are two outfits we've worked with that we liked - one well enough to come audit us.

Oh, also, the big automated platforms like SM and TW are pretty poor.

The way it's set up right now, if you're lucky enough to be deemed a QSA by the PCI council, congratulations, you are now legally welcome to blackmail and extort. Zilch oversight, it's the Wild West, and snake oil salesmen abound.

[tomblomfield]

Who were the two you liked? We're looking at various PCI stuff at the moment.

[Cthulhu_]

The OP reported the auditor with the appropriate authorities and hopefully they'll revoke their certification.

Alternatively, I'd report the auditor to the police for attempting to acquire personal user data, a clear violation of data protection acts and user privacy.

[pawadu]

The company is under investigation, the auditor has already been fired.

[RubyPinch]

Naming and shaming is also going to paint a big target on that company's head, since, you know, they collect plaintext data n' stuff

[fdgdasfadsf]

I suggest being careful with UK libel laws here. I am not a lawyer.

[tankenmate]

Indeed, truth is not always an absolute defence in the UK. Also the law varies depending in which jurisdiction you are in in the UK; e.g. England & Wales vs Scotland vs Northern Ireland.