Compliance & AssurancePCI DSS
We map where card data flows, reduce what is in scope with tokenisation and segmentation, remediate against the twelve requirements of PCI DSS v4.0.1 and support your validation with a Qualified Security Assessor or self-assessment.
01Overview
The Payment Card Industry Data Security Standard (PCI DSS) is the security standard set by the card brands for any organisation that stores, processes or transmits cardholder data. Version 4.0.1 organises its requirements into twelve principal requirements and has been the only valid version since 31 December 2024, with its future-dated requirements mandatory from 31 March 2025.
Compliance is validated according to how many transactions you handle and how you handle them: a Qualified Security Assessor (QSA) report on compliance for the largest, or a self-assessment questionnaire (SAQ) for many merchants. Acquirers and card brands set the level.
The cheapest way to comply is to touch less card data. Hosted payment pages, tokenisation and segmentation can shrink the cardholder data environment dramatically.
02What we do
From scoping to evidence.
Find every system that stores, processes or transmits card data.
You receive
An accurate scope.
Design out card data where possible.
You receive
A smaller, cheaper environment.
Assess against v4.0.1 requirements, including newly mandatory ones.
You receive
A ranked gap list.
Implement technical and process controls.
You receive
Controls operating.
Penetration and segmentation testing for the card environment.
You receive
Evidence for requirement 11.
Prepare evidence and work with your QSA or acquirer.
You receive
A smooth assessment.
03How we work
A practical path.
Step 1 · Weeks 1 to 3
Map card data flows.
Step 2 · Weeks 3 to 8
Design out card data.
Step 3 · Weeks 6 to 9
Gap assessment.
Step 4 · Months 3 to 8
Fix gaps.
Step 5 · Months 6 to 8
Penetration and segmentation tests.
Step 6 · Month 9
QSA or SAQ and attestation.
04Reference
A summary of PCI DSS v4.0.1.
| Goal | Requirements | Examples |
|---|---|---|
| Build and maintain a secure network and systems | 1 and 2 | Network security controls, secure configurations |
| Protect account data | 3 and 4 | Protect stored data, encrypt transmission |
| Maintain a vulnerability management programme | 5 and 6 | Anti-malware, secure software, payment-page script integrity |
| Implement strong access control | 7, 8 and 9 | Need-to-know, authentication and MFA, physical access |
| Regularly monitor and test networks | 10 and 11 | Logging, scanning, penetration testing |
| Maintain an information security policy | 12 | Policies, risk analysis, awareness, incident response |
05Saudi Arabia and the GCC
Card security meets the local payments ecosystem.
Card acceptance in the Kingdom involves mada and international networks. Acquirers set validation requirements.
Payment service providers face SAMA licensing and cyber requirements in addition to PCI DSS.
Many PCI controls match NCA ECC, SAMA CSF and ISO 27001. We map them to avoid duplicate work.
06Why GoAgile
We build payment systems too.
We build and integrate gateways, so we know the data flows.
Reducing scope reduces cost.
Penetration and segmentation testing included.
We work with your assessor or acquirer.
Mapped to SAMA, NCA and ISO.
Both languages.
Credentials
07Clients
Organisations in regulated sectors choose GoAgile because security is delivered by the team that also builds and runs their infrastructure.
Tier-1 Saudi bank
Banking
National energy operator
Oil, gas and power
Government authority
Public sector
Regional telecom operator
Telecommunications
Healthcare group
Hospitals and clinics
Retail and e-commerce group
Retail
Ports and logistics operator
Logistics
Insurance company
Insurance
Fintech and payments provider
Financial technology
Industrial manufacturer
Manufacturing
Card data touched more systems than anyone realised, which made validation slow and expensive.
Result: A smaller scope and a smoother assessment.
The bank needed evidence that its people, processes and detection would hold up against a realistic attacker, in line with SAMA expectations.
Result: Detection gaps were fixed, playbooks were updated and the board received a plain-language report.
Plant networks had grown without a clear map, and remote access for vendors was a concern.
Result: A mapped, segmented network with a prioritised remediation plan the plant team could schedule.
Client names are withheld for confidentiality.
08Related services
Each service stands alone and works better with the others.
Tell us how card data flows through your business. We will propose a scope reduction and compliance plan.
Start PCI DSS09Questions answered
Tell us about your environment and what you need. We will respond with a scoped proposal, not a brochure.
Specialists who do this work every week, reporting in Arabic and English.