Protect Every Payment. Achieve PCI DSS v4.0.1 Compliance.

TÜV SÜD’s PCI SSC‑certified QSA experts support organisations across the Middle East

Trust & Accreditation

✔ PCI SSC Certified Qualified Security Assessor (QSA)

✔ PCI SSC Approved Scanning Vendor (ASV)

✔ Charter of Trust Member

✔ 10,000+ Experts | 1,000+ Locations | 160 Years of Trust

Is Your Organisation Ready for PCI DSS v4.0.1?

The mandatory deadline for full PCI DSS v4.0.1 compliance has now passed. Any organisation that stores, processes, or transmits payment card data, including merchants, payment processors, fintechs, e‑commerce platforms and service providers, must comply with the updated standard or face increased risk of penalties, card‑scheme fines and reputational damage.

PCI DSS v4.0.1 introduces 64 new and enhanced requirements, many of which remain unclear for organisations, particularly around multi‑factor authentication, authenticated vulnerability scanning, targeted risk analysis and customised implementation approaches. When combined with regional regulatory obligations such as Saudi PDPL, UAE DPL, Qatar PDPPL, Oman PDPL and Bahrain PDPL, compliance becomes a strategic and operational challenge.

Key Challenges

REGULATORY OVERLAP
Aligning PCI DSS v4.0.1 with Saudi NCA, SAMA, UAE CBUAE and regional data protection laws is complex. Misalignment can expose organisations to multiple regulatory penalties.

CLOUD & HYBRID COMPLEXITY
Cloud adoption, containerised workloads and hybrid environments frequently introduce scope creep and assessment failures if not correctly designed and validated.

RESOURCE CONSTRAINTS
Internal security teams are under pressure. Limited local access to QSA‑qualified expertise often results in incomplete guidance and delayed certification timelines.

A Complete PCI DSS v4.0.1 Service Suite

From initial scoping through to ongoing compliance, TÜV SÜD supports every stage of your PCI DSS journey.

PCI DSS Applicability & Scoping
Determine whether PCI DSS applies to your organisation and define precise Cardholder Data Environment (CDE) boundaries to reduce audit scope, cost and complexity.
Gap Assessment
Comprehensive evaluation against all 12 PCI DSS v4.0.1 requirements, including a prioritised remediation roadmap and realistic timelines.
ASV Scanning
Quarterly external vulnerability scans delivered by TÜV SÜD’s PCI SSC Approved Scanning Vendor (ASV) team.
PCI DSS Implementation Support
Practical, end‑to‑end advisory support covering policies, procedures, technical controls and staff awareness to close identified gaps.
Penetration Testing
Network and application penetration testing aligned with PCI DSS Requirement 11.4, including segmentation validation testing.
Formal PCI DSS Audit & Certification (ROC / SAQ)
Independent QSA‑led assessment resulting in your Report on Compliance (ROC) and Attestation of Compliance (AOC).
Additional services
- Card Data Discovery
- Policy & Procedure Development
- PCI DSS Awareness E‑Learning
- PCI DSS v4.0.1 Implementer Training
- ISO 27001
- SOC 2
- VAPT

Your Structured Path to PCI DSS Certification

Supporting PCI DSS Compliance Across Key Sectors

Pictogram in .SVG for Save Costs
Fintech & Digital Payments

Pictogram in .SVG for Secure Phone
E‑Commerce & Retail

Pictogram in .SVG for Institution
Banking & Financial Services

Pictogram in .SVG for Medical Cybersecurity
Healthcare (PCI DSS and HIPAA overlap)

[16 June 2025] Adjusted stroke widthPictogram in .SVG for Plane
Hospitality & Tourism

Pictogram in .SVG for Cloud Hosting
Cloud Service Providers & SaaS

Why Organisations Across the Middle East Choose TÜV SÜD

Local Insight, Global Standards
With teams across the UAE, Saudi Arabia, Qatar, Oman, Bahrain and Egypt, our experts combine regional regulatory knowledge with global PCI DSS expertise.
Independent and Trusted
As a neutral third‑party certification body, TÜV SÜD provides assessments trusted by card schemes, acquirers and regulators worldwide.
One partner, multiple frameworks
Bundle PCI DSS with ISO 27001, SOC 2, and VAPT under a single engagement.
Proven at Scale
More than 10,000 global clients, over 100 cybersecurity specialists, and a heritage of trust dating back to 1866.

Trusted Across the Region

10,000+ Global Clients | 100+ Cybersecurity Experts | 14+ Offices Across ME

TÜV SÜD supported one of the region's largest merchants in achieving PCI DSS certification across multiple payment channels — in-store, online, and mobile — without disrupting business operations, strengthening the client's data security posture and audit readiness.

Hear from our client

frequently asked questions (FAQ)

Does PCI DSS v4.0.1 apply to my organisation?
PCI DSS applies to any organisation that stores, processes or transmits payment card data. Even organisations that outsource payment processing may still retain in‑scope obligations.
What are the key changes from v3.2.1 to v4.0.1?
PCI DSS v4.0.1 introduces 64 new requirements, including enhanced MFA, authenticated scanning, targeted risk analysis and a Customised Approach to implementation.
How long does certification take in the UAE or Saudi Arabia?
Timelines depend on scope and readiness. With a clearly defined CDE, certification can typically be achieved within 8–12 weeks.
How does PCI DSS align with regional regulations?
TÜV SÜD maps PCI DSS controls to regional laws including Saudi PDPL, UAE DPL, Qatar PDPPL, Oman PDPL and Bahrain PDPL — reducing duplication across assessments.
Does outsourcing payment processing remove PCI DSS scope?
No. While scope may be reduced, organisations remain responsible for third‑party oversight under Requirement 12.8.
What is an Attestation of Compliance (AOC)?
The AOC is the formal confirmation that your organisation has been assessed as PCI DSS compliant by a certified QSA. It is required by acquirers, card brands and partners.