PCI DSS Certification
Univate Global delivers PCI DSS compliance support in 9 markets: UAE, Saudi Arabia, Philippines, South Africa, USA, Singapore, Malaysia, Vietnam, and India. Our team includes security specialists, QSA-experienced advisors, and implementation consultants.
Implementation Process
v4.0.1What Is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) is a global information security standard for any organisation that stores, processes, or transmits cardholder data. It is developed and maintained by the PCI Security Standards Council (PCI SSC), the body founded by the major card brands (Visa, Mastercard, American Express, Discover, and JCB).
PCI DSS is a compliance standard, not an ISO certification. The current version is PCI DSS v4.0.1, published in June 2024.
Organisations demonstrate compliance through an Attestation of Compliance (AOC), supported either by a Report on Compliance (ROC) completed with a Qualified Security Assessor (QSA) or by a Self-Assessment Questionnaire (SAQ), with validation performed annually.
At a glance
Not an ISO certification
PCI DSS is a compliance standard developed by the PCI Security Standards Council. Compliance is demonstrated through an Attestation of Compliance rather than an ISO certificate.
PCI DSS Requirements
PCI DSS v4.0.1 is built around 12 core requirements, grouped under six control objectives.
Network security controls
Install and maintain network security controls.
Secure configurations
Apply secure configurations to all system components.
Protect stored account data
Protect stored account data.
Encrypt transmission
Protect cardholder data with strong cryptography during transmission over open, public networks.
Anti-malware
Protect all systems and networks from malicious software.
Secure systems and software
Develop and maintain secure systems and software.
Need-to-know access
Restrict access to system components and cardholder data by business need to know.
Identify and authenticate
Identify users and authenticate access to system components.
Physical access
Restrict physical access to cardholder data.
Logging and monitoring
Log and monitor all access to system components and cardholder data.
Security testing
Test the security of systems and networks regularly.
Policies and programs
Support information security with organisational policies and programs.
Benefits of PCI DSS
Protects cardholder data
Reduces the risk of breaches, fraud, and financial penalties.
Meets card scheme obligations
Meets the compliance obligations imposed by acquiring banks and the major card schemes.
Builds trust
Builds customer and partner trust by demonstrating a validated security posture.
Stronger internal controls
Strengthens controls across network security, encryption, access management, and monitoring.
Auditable framework
Provides a clear, auditable framework through the ROC, SAQ, and Attestation of Compliance.
Continuous security
Supports continuous security through the version 4.0.1 emphasis on ongoing, business-as-usual processes.
PCI DSS Implementation Process
Univate Global follows a phased approach to PCI DSS compliance.
Scoping and gap analysis
Scoping and gap analysis of the cardholder data environment against PCI DSS v4.0.1.
Validation level
Determination of the applicable validation level and SAQ type, or ROC scope.
Remediation
Remediation of gaps across network security, encryption, access control, and monitoring.
Policies and evidence
Development of policies, procedures, and evidence mapped to the 12 requirements.
Testing
Internal testing, vulnerability scanning, and penetration testing.
Formal assessment
Formal assessment and completion of the Report on Compliance or Self-Assessment Questionnaire.
Attestation and revalidation
Attestation of Compliance and ongoing annual validation with continuous monitoring.
PCI DSS in 9 Markets
Univate Global supports PCI DSS compliance across nine markets, aligned to local payment and card-scheme requirements.
UAE
Supports card issuers, acquirers, fintechs, and merchants under Central Bank of the UAE (CBUAE) payment oversight.
Saudi Arabia
Aligns cardholder-data protection with the Saudi Central Bank (SAMA) Cyber Security Framework.
Philippines
Supports payment processors and issuers regulated by Bangko Sentral ng Pilipinas (BSP).
South Africa
Meets card-scheme mandates alongside privacy obligations under the Protection of Personal Information Act (POPIA).
USA
Satisfies card-brand and acquiring-bank rules and supports state breach-notification expectations.
Singapore
Aligns with payment-security expectations under the Monetary Authority of Singapore (MAS) Technology Risk Management guidelines.
Malaysia
Supports payment-card data protection under Bank Negara Malaysia (BNM) RMiT policy.
Vietnam
Supports card issuers and acquirers operating under State Bank of Vietnam oversight.
India
Supports adoption driven by Reserve Bank of India (RBI) payment-security directions and card-network mandates.
Why Univate Global for PCI DSS?
Univate Global supports organisations through every stage of PCI DSS compliance, from initial scoping to attestation and annual revalidation. Our security specialists work across payments, banking, and technology to align your cardholder data environment with PCI DSS v4.0.1.
We provide practical remediation guidance, evidence preparation, and readiness support for QSA assessments, together with continuous monitoring to help maintain compliance year round. Engagements are structured, transparent, and tailored to your validation level and business needs.
PCI DSS BY COUNTRY
PCI DSS support in the Philippines, Singapore, Malaysia, South Africa, Vietnam, Saudi Arabia and the USA, plus PCI DSS Benchmark in Singapore.
FIXED-FEE QUOTE
Get a fixed-fee PCI DSS implementation quote from Univate. No hidden costs. Speak to a consultant in your market today.
Often taken alongside PCI DSS
PCI DSS questions we get asked
Can't find the framework
you're looking for?
Univate supports over a hundred certification, privacy and cybersecurity
services across
nine markets. Tell a specialist what your client or regulator is asking for.