CDE Network Segmentation
POS / payment-card environment isolated on its own VLAN; firewall policies enforcing segmentation; explicit deny-by-default policies preventing unauthorised traffic to / from the CDE.
PCI-DSS Technical Controls · Abu Dhabi
PCI-DSS Technical Controls for Abu Dhabi Retail, F&B & Hospitality
Emirtech Technology delivers the technical control layer — POS network segmentation, encryption, EDR, logging, backup and access control — that supports Abu Dhabi retail, F&B and hospitality businesses in their own PCI-DSS compliance work.
ADMCC-approved (security systems) Brand-Agnostic Since 2018 Honest Scope
In short: This page covers “PCI-DSS Technical Controls for Abu Dhabi Retail, F&B & Hospitality” from the technical side, with honest scope. Emirtech installs and configures systems; it is not an auditor, certification body or legal adviser, so confirm the standard or regulation with the relevant authority, auditor or adviser.
PCI-DSS Technical Controls for Abu Dhabi Retail, F&B & Hospitality: key facts
| Who provides it? | Emirtech Technology, based at M44, Mussafah Industrial Area, Abu Dhabi, in operation since 2018. The work is carried out by Emirtech's own engineers. |
|---|---|
| Where? | Abu Dhabi and Al Ain, served from Emirtech's Mussafah, Abu Dhabi base; there is no Al Ain office. In Dubai: smart home, PABX and IP-PBX phone systems, IT AMC and time attendance by scheduled on-site visits, gate barriers, ANPR, video intercoms and turnstiles by Emirtech itself; CCTV, alarm and access control through SIRA-approved partners, with Emirtech coordinating. |
| What is covered | PCI-DSS Technical Controls for Abu Dhabi Retail, F&B & Hospitality. |
| Survey and quotation | Emirtech publishes no price list: it surveys or assesses first and then gives a written, itemised quotation. |
| Credentials | Emirtech is an independent systems integrator. It holds no manufacturer-level credential of its own, and its ADMCC approval covers security systems only, not IT services. |
| Please note | General information, not legal, audit or certification advice. Emirtech is not an auditor, certification body or legal adviser; confirm the standard or regulation with the relevant authority, auditor or adviser. |
| Last reviewed | 21 October 2026 |
How does Emirtech support PCI-DSS alignment for Abu Dhabi retail and F&B businesses?
PCI-DSS (Payment Card Industry Data Security Standard) is the framework that applies to every business storing, processing or transmitting payment-card data — covering merchant requirements from Self-Assessment Questionnaires (SAQ A, B, C, D) for smaller merchants to full RoC (Report on Compliance) assessments for the largest. Compliance is determined by a Qualified Security Assessor (QSA) for Level 1 merchants and verified via SAQ for smaller merchants. Emirtech is not a QSA — QSA status is granted by the PCI Security Standards Council and requires specific accreditation, training and ongoing requalification. We do not perform PCI-DSS assessments, issue Reports on Compliance, sign Attestations of Compliance or provide formal PCI compliance certification. What Emirtech delivers is the technical control layer — the specific PCI-DSS technical requirements that have a network, endpoint, identity or encryption implementation. For retail, F&B, hotel and hospitality customers across Abu Dhabi, that means: (1) Network segmentation isolating POS / payment-card environment (CDE) from staff, guest Wi-Fi, CCTV and other networks; (2) Firewall protecting the CDE with appropriate policies; (3) Encryption in transit (TLS) and at rest; (4) Access control — MFA, role-based access, strict least-privilege on CDE access; (5) Logging — centralised collection of POS, firewall and identity events for the required retention periods; (6) Endpoint security — EDR on POS terminals; (7) Vulnerability management — patching POS and supporting infrastructure; (8) Backup with off-site copies. This technical layer, paired with proper SAQ completion or QSA assessment, is one part of a complete PCI programme. As a security and IT systems integrator (ADMCC-approved for security systems) based in Mussafah M44 since 2018, we serve retail and F&B across every Abu Dhabi district plus Al Ain, and, in Dubai, smart home, PABX and IP-PBX phone systems, IT AMC and time attendance through scheduled on-site visits.
What we cover
PCI-DSS technical control areas we deliver
Encryption & Key Management
TLS for payment-card data in transit; encryption at rest where cardholder data is stored (typically by the POS / processor); secure key management practices for any cryptographic material handled by infrastructure.
POS Endpoint Security & Patching
EDR on POS terminals; OS and application patch management; restrictive USB and removable-media policies; application allow-listing where supported.
Logging, Audit-Trail & Monitoring
Centralised log collection from POS, firewall, identity and supporting infrastructure to a SIEM with the retention periods PCI requires; alerting on high-severity events.
Pair technical controls with QSA assessment or proper SAQ
PCI-DSS is the merchant's compliance programme. Emirtech delivers the technical control layer; the merchant's acquiring bank, payment processor or QSA defines compliance level and assesses compliance. Call +971 55 651 7843 or request a free PCI technical controls review.
- POS / CDE on its own VLAN with strict firewall policies
- TLS in transit; encryption at rest where applicable
- MFA and role-based access on CDE administration
- EDR on POS terminals
- Patch management for POS and supporting infrastructure
- Centralised logging with PCI-required retention
- Restrictive USB / removable-media policies
- Documented technical control evidence for SAQ / QSA
Where we deploy
Common PCI-DSS technical engagements
QSR & restaurant chains
QSR chains, restaurants, cafes and F&B outlets with POS handling card payments — segmented POS VLAN, EDR on terminals, central monitoring across all locations.
Retail stores & mall tenants
Retail outlets and mall tenants with card-handling POS — segmented network, EDR, encryption supporting their SAQ A, B or C assessment.
Hotels & hospitality
Hotels handling card payments at reception, F&B outlets and retail outlets — segmented CDE, encryption at the network layer and logging across all card-handling areas.
Customer-facing offices & clinics
Clinics, customer-service offices and other customer-facing businesses handling card payments — sized PCI-aligned controls appropriate to transaction volume.
Scope — what Emirtech delivers and does not
PCI-DSS is a merchant compliance programme. Emirtech's scope is technical only:
- We deliver: POS network segmentation, firewall, encryption (at the infrastructure layer), MFA and RBAC, EDR on POS terminals, patch management, centralised logging and supporting documentation of technical controls.
- We do not deliver: PCI-DSS assessment, Reports on Compliance, Attestations of Compliance, SAQ assistance as a governance exercise, formal PCI compliance certification or QSA services.
- We do not certify: PCI-DSS compliance is determined by the merchant's acquiring bank, payment processor or QSA based on the merchant's SAQ or Report on Compliance. Emirtech does not issue PCI certificates.
- We are not: A Qualified Security Assessor (QSA), Approved Scanning Vendor (ASV), Internal Security Assessor (ISA) or Payment Card Industry Forensic Investigator (PFI). Those statuses are granted by the PCI Security Standards Council and require specific accreditation.
- What we recommend: Engage with your acquiring bank or payment processor on PCI scope; complete the appropriate SAQ or engage a QSA for Level 1 assessment; pair with Emirtech for the technical control implementation that supports the assessment.
Emirtech is an independent integrator. Our scope on PCI-DSS is technical controls only — not assessment, certification or QSA services.
Answers
Frequently Asked Questions
Is Emirtech a Qualified Security Assessor (QSA)?
No. QSA status is granted by the PCI Security Standards Council and requires specific accreditation, training and ongoing requalification. Emirtech is not a QSA, Approved Scanning Vendor (ASV), Internal Security Assessor (ISA) or Payment Card Industry Forensic Investigator (PFI). We deliver the technical control layer that the QSA or SAQ process will assess.
Can Emirtech help us with our SAQ?
We support SAQ completion by providing technical evidence — network diagrams showing CDE segmentation, firewall policies, EDR deployment records, logging configuration, patch records. The SAQ itself is your merchant responsibility to complete and submit to your acquiring bank. We do not draft or sign the SAQ for you.
How does network segmentation help with PCI scope?
Properly segmenting the POS / payment-card environment (CDE) from other networks reduces the scope of PCI compliance to the CDE and the systems connected to it or able to affect its security. The smaller the CDE, the simpler PCI compliance becomes. Segmentation must be demonstrably effective — firewall rules, logging and periodic testing — for the segmentation to be accepted by the QSA or SAQ process.
Do you install EDR on POS terminals?
Yes. Modern POS terminals are increasingly targeted by malware specifically designed to capture card data. EDR (Sophos Intercept X, SentinelOne, CrowdStrike, Defender for Business) on POS terminals is one of the most important PCI technical controls.
What logging retention does PCI-DSS require?
PCI-DSS requires that audit trails be retained for at least one year, with at least three months immediately available for analysis. Emirtech configures SIEM with appropriate retention to support this requirement, with longer retention where the customer's broader compliance programme (PDPL, ISO 27001) requires it.
How do I get a quote for PCI-DSS technical controls?
Call +971 55 651 7843 or request a free PCI technical controls review. Share your business type, POS environment and current SAQ tier or QSA engagement status. A specialist will respond with a scoped proposal once the survey is done.
Related Pages
Related guides & service pages
Retail Chain IT, CCTV & POS
Retail chain IT and POS service page
Restaurant & F&B Tech
F&B catchment with PCI-relevant POS
Firewall & Network Security
Firewall and VLAN segmentation for CDE
Endpoint Security & EDR
EDR on POS terminals
Ready to start?
Get a free consultation from Abu Dhabi's IT & security specialists.
Need a free site survey or quote in Abu Dhabi?
Talk to Emirtech's engineers — we reply the same working day across Abu Dhabi and Al Ain. Honest scoping, brand-agnostic recommendations.
Mon–Sat 8AM–7PM · [email protected] · Since 2018 · ADMCC-approved for security systems