Use Case in Software Testing: How to Turn One Into Test Cases
Every path through a use case becomes at least one test case. A worked bank-transfer example shows the test table, and ISTQB's 2023 and 2025 syllabus changes explain…
Compliance Testing Services: HIPAA, PCI DSS, GDPR, WCAG
Vervali tests software that handles health, payment or personal data against the rules that govern it: HIPAA, PCI DSS, GDPR and the accessibility standards. Each engagement produces a control-by-control result, the gaps that would fail a review, the remediation path and the audit evidence, so a compliance deadline stops being a guess.
150+ clients
450+ projects
275+ engineers
15+ years
ISO/IEC 17025:2017Accredited testing laboratory
CMMI Maturity Level 3The process is written down and repeats
ISO 9001:2015Quality management
ISO/IEC 27001Information security
Which Rules Apply
The data your software handles and the markets it serves determine the control set. We test application controls for HIPAA, PCI DSS, GDPR and accessibility, with cloud configuration evidence covered by cloud security and compliance testing.
HIPAA
Software that handles electronic protected health information. PHI handling, access control, audit logs, encryption in transit and at rest. Healthcare context sits on healthcare and life sciences.
PCI DSS
Software that touches payment data: the cardholder data environment in the application, storage versus tokenisation, and scripts on payment paths. Fintech context sits on fintech and banking.
GDPR
Software that processes personal data of people in the EU: lawful basis, consent, access and erasure paths, and whether the product actually does what the notice says. US and EU rules are both in the work when both apply.
Accessibility Testing
Public-facing software may need WCAG, ADA or Section 508 evidence. Manual keyboard and assistive-technology checks are covered through ADA and Section 508 compliance testing.
Turn the framework into a control list your product team can act on.
Free Compliance Gap Check (One Framework, One Application)How a Compliance Test Is Run, Control by Control
We turn each applicable requirement into a test, record the result and attach the evidence. Security attack paths can be added through security testing and penetration testing.
Map the Controls
We identify the requirements that apply to the application, data flows, user roles and third parties. Every in-scope control has an owner, test method and expected evidence before execution begins.
Test Operation
We test whether the control works in the product, not whether a policy says it exists. Access, logging, encryption, consent and retention are exercised through real roles and flows.
Record the Evidence
Each result includes the date, method, artefact and gap. Controlled test data and evidence handling can be supported through test data management and compliance.
HIPAA First: PHI Handling, Access, Logs, Encryption
For software handling PHI, we test the safeguards that protect each data path and make access reconstructable. The result shows where a healthcare review would find missing control operation or evidence.
PHI Paths and Access
We trace PHI through user journeys, APIs, exports and integrations, then test role boundaries, session controls and minimum-necessary access. Healthcare delivery experience includes a diagnostics back end in Chennai.
Logs and Encryption
We verify encryption in transit and at rest, key handling, audit-event coverage and whether logs identify the user, action and record. Cloud account controls are covered by cloud security and compliance testing.
PCI DSS for Software That Touches Payment Data
We test how payment data enters, moves through and leaves the application, then verify the controls that reduce the cardholder data environment and protect what remains.
Payment Data and Segmentation
Storage, tokenisation, masking, role access and separation between payment components and the rest of the product. The test follows browser, API and back-office paths rather than relying on the architecture diagram.
Attack Testing and Evidence
Payment-page scripts, API authorisation and agreed in-scope assets can be tested through penetration testing. Findings return with retest evidence; a qualified assessor still owns formal PCI validation where required.
Data Protection and Consent Testing
Privacy controls must behave the way notices and consent choices say they do. We test collection, preference, access, deletion and retention paths against the application evidence.
Notice and Consent Behaviour
We verify that consent is informed, recorded and respected across web, mobile and integrated services. Withdrawal must stop the relevant processing without breaking unrelated account functions.
Data Rights and Retention
Access, correction, export and erasure are tested through the complete workflow, including downstream systems. Retention evidence must show that expired records are removed or lawfully isolated.
Accessibility as a Compliance Obligation
Accessibility becomes a compliance risk when customers cannot complete the same essential journeys. We include the applicable WCAG evidence and route detailed legal-readiness work through the specialist audit service.
Essential Journey Checks
Keyboard access, focus, labels, errors, contrast and assistive-technology behaviour are tested on the flows that carry the greatest customer and legal risk.
WCAG and Legal Readiness
Detailed WCAG 2.2 AA auditing, ADA and Section 508 analysis, remediation retesting and VPAT support are available through ADA and Section 508 compliance testing.
What the Evidence Pack Contains
The final pack connects every control to the test, result, artefact and remediation status. It is structured for internal review and for the external assessor who needs to verify the claim.
Control-by-Control Results
Each row names the requirement, test method, result, date and owner. Failed or incomplete controls include severity, dependency and a remediation path rather than a generic recommendation.
Traceable Artefacts
Logs, screenshots, exports and test records sit beside the control they support. A banking engagement reduced audit preparation from five days to five hours once this evidence was organised.
Remediation Testing and Re-Audit
A gap closes only when the corrected control works and new evidence replaces the failed result. Retesting keeps the final pack aligned with the application that will enter review.
Guidance Developers Can Use
Every gap identifies the failing behaviour, affected control, dependency and expected evidence. Your team can implement the change without translating a policy-only finding.
Targeted Retest
We rerun the affected control and connected regression paths, then update the status and artefacts. The pack records what changed and the date the corrected behaviour passed.
Proof From Delivery
Delivery evidence across banking, healthcare and fintech shows how control testing, security findings and audit artefacts support regulated software teams.
Banking · audit preparation
Before: audit preparation took five days of assembling screenshots. After: a dated evidence pack, and 80% less time spent assembling evidence, from 5 days to 5 hours. The bank stays unnamed.
5 days to 5 hours80% less audit preparationIndia · Chennai diagnostics chain · back end
The back end of a diagnostics chain: PHI-class data and the load patient volume actually produces. A compliance pass that ignores that estate is a slide.
Diagnostics back endUAE · fintech platform · API
Authorisation between accounts on a payments platform, with APIs the team had not fully evidenced. After: a ranked report and a retest of agreed in-scope assets. The client stays unnamed.
UAE fintechAPI controlsFrequently Asked Questions
A SOC 2 readiness assessment tests whether the selected Trust Services Criteria are supported by working controls and traceable evidence before the auditor begins. We can test access, logging, encryption, change control, availability and application evidence. Vervali does not issue or sign a SOC 2 report, and we do not describe Vervali as SOC 2 compliant or certified.
HIPAA does not have a single certificate or fixed fee. Cost depends on the application, PHI paths, user roles, integrations, existing safeguards and available evidence. Typical Vervali work is $25 to $49 per hour, with scope and price agreed before testing. The free gap check covers one framework and one application so the larger estimate is based on observed risk.
As of September 2026, HHS still describes the Security Rule changes published on 6 January 2025 as proposed, not final. The current HIPAA Security Rule remains in effect. The proposal would strengthen cybersecurity requirements for electronic PHI, but a proposal is not a compliance deadline. We test against the rule in force and update scope when HHS finalizes a change.
The HHS Office for Civil Rights enforces HIPAA, and state attorneys general can also bring actions. Covered entities and business associates remain responsible for their own compliance. Vervali tests software controls and evidence, identifies gaps and supports remediation. We do not enforce HIPAA, issue a HIPAA certificate or replace legal counsel or a regulator.
We test three aspects of each control: design, operating effectiveness and evidence. Design asks whether the safeguard fits the requirement. Operating effectiveness checks whether it works in the software and workflow. Evidence checks whether a reviewer can verify the result and date. Framework coverage may include HIPAA, PCI DSS, GDPR and WCAG, depending on the application.
Timing depends on the framework, application size, number of roles and integrations, and how much evidence already exists. We define the schedule after the gap check and control mapping. Remediation and retesting add time when controls fail. An external auditor or assessor sets their own fieldwork schedule; Vervali quotes the testing and evidence work separately.
Yes. For GDPR, we test notices, consent, access, erasure, retention and the supporting application evidence. For ISO 27001, we can map and test relevant software and cloud controls and organize artefacts. An accredited certification body issues the client certificate. Vervali holds ISO/IEC 27001 for its own information security management system; that certification does not transfer to a client.
Yes. Each failed control includes the affected behaviour, severity, dependency, remediation path and evidence needed to close it. After your team implements the change, we retest the control and connected regression paths. The updated pack records the new result and date, giving the reviewer evidence that the gap was corrected rather than merely acknowledged.
Email Us
Call Us
