PCI DSS compliance in Azerbaijan
We prepare you for a PCI DSS v4.0.1 assessment — with a QSA or via SAQ. First we reduce the assessment scope, then we close the findings, up to and including changes to your system. An independent assessor does the verification.
Who needs PCI DSS
Anyone who stores, processes or transmits payment card data — or can affect its security. The requirement comes from your acquirer or the card schemes, not from the state.
QSA or SAQ — which one you need
How you validate compliance depends on your level, and your level depends on transaction volume and card scheme rules. Your acquirer has the final say.
Fewer systems in scope — fewer requirements
The fewer of your systems touch the card number, the shorter the list of requirements and the cheaper the assessment. This is where every project starts.
Provider-hosted payment page
An iframe or a redirect — and card data never reaches your server. Often this is the path from SAQ D to SAQ A.
Tokenization
The card number is replaced with a token. Systems that only see tokens drop out of scope.
Network segmentation
We separate the cardholder data environment from the rest of your infrastructure, so the assessment doesn't cover the whole office.
Finding stray data
We find card numbers where they shouldn't be: in logs, backups, tickets. Delete them — and the scope shrinks.
How a project runs
-
Scoping
We map where card data lives and which systems fall into the assessment scope. Then we look for ways to reduce it.
-
Gap analysis
We compare your current state against the v4.0.1 requirements. The output is a list of gaps, a fixed price and a timeline.
-
Remediation
Policies and procedures, configuration, code and infrastructure changes. Do it yourself following our roadmap, or hand it to us.
-
Evidence
Some requirements need a track record of controls in operation: regular scans, log reviews, a pentest, training. We plan time for this upfront.
-
Assessment
We support you through the QSA assessment or help with the SAQ — through to a signed AOC.
-
Staying compliant
PCI DSS is an annual cycle, not a one-off checkbox. We help keep your controls working until the next assessment.
PCI DSS v4.0.1: what changed
Since 31 March 2025, requirements that used to be best practices are mandatory. These are what companies most often stumble on in their first assessment against the new version.
- Multi-factor authentication for all access into the cardholder data environment
- Control of scripts on payment pages and detection of changes to them
- Targeted risk analysis for requirements with flexible frequency
- Authenticated internal vulnerability scanning