S3CURE — Frequently Asked Questions (FAQ)

General Information

• What is S3CURE?
  S3CURE is a premier digital product security consultancy that bridges the gap between innovative product design and strict industry compliance. We help digital product developers and security laboratories navigate complex evaluation frameworks smoothly, avoiding costly delays.

• Who leads S3CURE?
  The company was founded by Gary Hemmings, a globally recognized expert and former Vice President of Industry Standards (Chip Product Security) at Mastercard. Gary spent over two decades designing, establishing, and scaling the actual compliance frameworks used across the financial ecosystem today.

• What sets S3CURE apart from other security consultancies?
  We don't just interpret the rules—our founder helped write them. Gary developed the original Mastercard CAST framework and directly led its migration to EMVCo global standard platform approvals. This deep, insider knowledge allows us to prepare your products with unmatched accuracy.

Services Provided

• What are your primary consultancy services?
  We offer a targeted suite of compliance and testing readiness services:

• • Evaluation Pre-Screening: Spotting hardware, software or process flaws before official testing.

• • Digital Product Security Consultancy: Architectural and technical design guidance.

• • Laboratory Relationship Management: Managing interactions and technical hurdles with labs.

• • Comprehensive Site Auditing: Logical and physical security assessments for both labs and developers.

• Can you help my company prepare for laboratory testing?
  Yes. Our specialty is Evaluation Pre-Screening. By checking your mobile apps or Secure Element products before they enter an official security laboratory, and aligning the product and documentation with lab evaluation requirements, we eliminate delays due to insufficient documentation, product security oversight and development facility preparation, saving you significant time and re-testing costs.

• What types of audits do you perform?
  We provide two distinct categories of auditing:

• • For Developers: Meticulous physical and logical site audits to ensure your development environment protects product integrity and aligns with scheme requirements.

• • For Security Laboratories: Independent capability, physical infrastructure, and logical security posture reviews.

Technical Expertise & Frameworks

• What specific technologies can S3CURE help evaluate?
  Our technical portfolio covers a massive spectrum of secure digital environments:

• • Secure Elements & Chip Cards

• • Mobile Wallets & Mobile Payments

• • Advanced Environments: Trusted Execution Environments (TEE), Applet-Wallet combinations, Software Protection Tools (SPTs), SDKs, and Mobile Applications.

• Can S3CURE assist with regulatory compliance, like the EU Cyber Resilience Act (CRA)?
  Yes. Gary has direct experience collaborating with legal bodies, CAST, and EMVCo to align complex security frameworks with evolving CRA regulations. We can help ensure your digital products meet these stringent legal expectations.

• Do you have experience with emerging security vulnerabilities, such as AI-driven threats?
  Absolutely. Our leadership stays ahead of the curve, recently leading reviews on the impact of AI laboratory attack tools on CAST, EMVCo, and JHAS structures. Working with Schemes, developers, government and labs, we ensure your product defences are resilient against modern, automated testing threats.

Engagement & Governance

• Can you assist if our product requires a waiver or a technical exception?
  Yes. Gary has managed thousands of waivers, variance, and exception scenarios at the board level during his career. We can guide you on how to properly structure risk assessments to objectively present your case to payment schemes and governing boards.

• Where is S3CURE located and how do we start?
  We are based in Deeside, United Kingdom. You can connect with us via email at [email protected] or through our official LinkedIn profiles to schedule an introductory consultation regarding your product pipeline.