PCI DSS compliance in Azerbaijan
We prepare you for a PCI DSS v4.0.1 assessment — with a QSA or via SAQ.
First we reduce the assessment scope, then we close the findings, up to and including changes to your system. An independent assessor does the verification.
Illustration: what a typical gap tracker looks like. Real data is shared after the NDA.
Who needs PCI DSS
Anyone who stores, processes or transmits payment card data — or can affect its security. The requirement comes from your acquirer or the card schemes, not from the state.
Merchants
Shops, services and apps that accept card payments.
Service providers
Payment institutions, PSPs, processors, hosting providers and anyone else your customers' card data passes through.
QSA or SAQ — which one you need
How you validate compliance depends on your level, and your level depends on transaction volume and card scheme rules. Your acquirer has the final say.
QSA assessment → ROC and AOC
An independent assessor reviews you on site and writes a report. Mandatory for large merchants and Level 1 service providers.
Self-assessment → SAQ and AOC
A questionnaire you complete yourself, where your acquirer and the card schemes allow it. There are several SAQ types — from the short SAQ A to the full SAQ D.
Don't know your level? That's the first thing we'll establish in the free consultation.
Fewer systems in scope — fewer requirements
The fewer of your systems touch the card number, the shorter the list of requirements and the cheaper the assessment. This is where every project starts.
Provider-hosted payment page
An iframe or a redirect — and card data never reaches your server. Often this is the path from SAQ D to SAQ A.
Tokenization
The card number is replaced with a token. Systems that only see tokens drop out of scope.
Network segmentation
We separate the cardholder data environment from the rest of your infrastructure, so the assessment doesn't cover the whole office.
Finding stray data
We find card numbers where they shouldn't be: in logs, backups, tickets. Delete them — and the scope shrinks.
How a project runs
- 01
Scoping
We map where card data lives and which systems fall into the assessment scope. Then we look for ways to reduce it.
- 02
Gap analysis
We compare your current state against the v4.0.1 requirements. The output is a list of gaps, a fixed price and a timeline.
- 03
Remediation
Policies and procedures, configuration, code and infrastructure changes. Do it yourself following our roadmap, or hand it to us.
- 04
Evidence
Some requirements need a track record of controls in operation: regular scans, log reviews, a pentest, training. We plan time for this upfront.
- 05
Assessment
We support you through the QSA assessment or help with the SAQ — through to a signed AOC.
- 06
Staying compliant
PCI DSS is an annual cycle, not a one-off checkbox. We help keep your controls working until the next assessment.
PCI DSS v4.0.1: what changed
Since 31 March 2025, requirements that used to be best practices are mandatory. These are what companies most often stumble on in their first assessment against the new version.
- Multi-factor authentication for all access into the cardholder data environment
- Control of scripts on payment pages and detection of changes to them
- Targeted risk analysis for requirements with flexible frequency
- Authenticated internal vulnerability scanning