How do I give our security auditor the information he wants? (2011)

Birmingham? I think I know this guy - we have a client based there and are three years into a war with their PCI auditor, who are dangerously incompetent. They were adamant that we should be able to decrypt PANs (credit card numbers) - we still haven't complied, as we quite deliberately don't store them and just transit them. It's not a phishing scam, this is pretty much state of the art in the UK - and try being a…

Definitely seems less like a auditor (I believe asking for some of that is flat out illegal) and more like a hacker posing as a auditor, trying to get passwords/creditcard #'s.

The last time this got discussed, I thought the consensus was he was trolling -- the point being the correct answer is to explain why you don't have these (technical controls, hashing of passwords, etc.). The other reason would have been if he wanted login access to servers to validate configs himself, but there are much better ways to accomplish that (I'd be very reluctant to give an auditor anything but read-only access to any production infrastructure, but it is…

My first thought was red team. Anyone that is capable of complying to the request is in breach. Ctrl-F "red team" found nothing. But then I read the answers and apparently a couple of them had the same idea. Not sure why it's not the most upvoted option, it seems like the only one that is is not self refuting, as the sincere version of those hypothetical businesses would starve from terminal stupidity... Perhaps my reasoning is wrong?