PCI DSS Technical Layer · Honest Scope
Emirtech delivers the PCI DSS technical-control layer — segmentation, firewall, EDR, MFA, encryption, logging — that underpins your merchant compliance programme. We are not a QSA or ASV; we engineer the controls your assessor validates.
Get a free site survey Talk to a specialist
In short: This page covers “PCI DSS Technical Controls — Honest Scope” from the technical side, with honest scope. Emirtech installs and configures systems; it is not an auditor, certification body or legal adviser, so confirm the standard or regulation with the relevant authority, auditor or adviser.
| Who provides it? | Emirtech Technology, based at M44, Mussafah Industrial Area, Abu Dhabi, in operation since 2018. The work is carried out by Emirtech's own engineers. |
|---|---|
| Where? | Abu Dhabi and Al Ain, served from Emirtech's Mussafah, Abu Dhabi base; there is no Al Ain office. In Dubai: smart home, PABX and IP-PBX phone systems, IT AMC and time attendance by scheduled on-site visits, gate barriers, ANPR, video intercoms and turnstiles by Emirtech itself; CCTV, alarm and access control through SIRA-approved partners, with Emirtech coordinating. |
| What is covered | PCI DSS Technical Controls — Honest Scope. |
| Survey and quotation | Emirtech publishes no price list: it surveys or assesses first and then gives a written, itemised quotation. |
| Credentials | Emirtech is an independent systems integrator. It holds no manufacturer-level credential of its own, and its ADMCC approval covers security systems only, not IT services. |
| Please note | General information, not legal, audit or certification advice. Emirtech is not an auditor, certification body or legal adviser; confirm the standard or regulation with the relevant authority, auditor or adviser. |
| Last reviewed | 21 October 2026 |
Emirtech is a systems integrator (ADMCC-approved for security systems) founded in 2018 and headquartered at M44, Mussafah Industrial Area, Abu Dhabi. We deliver the technical-control layer that underpins PCI DSS Requirement areas for Abu Dhabi and Al Ain merchants — but we want to be clear about scope from the outset. Emirtech is not a PCI Qualified Security Assessor (QSA), not an Approved Scanning Vendor (ASV), and not a PCI consultancy. SAQ (Self-Assessment Questionnaire) and ROC (Report on Compliance) validation must be performed by an engaged QSA firm, and quarterly external vulnerability scans must be performed by a PCI SSC-listed ASV. We work alongside your QSA and ASV on the engineering evidence layer. On the technical side we deliver: network segmentation isolating the cardholder data environment (CDE) from corporate and guest networks using VLAN and firewall policy; FortiGate firewall rule-base hardening with documented justification; endpoint detection and response (EDR) deployment across in-scope systems; multi-factor authentication (MFA) for administrative and remote CDE access; encryption in transit (TLS 1.2+) and at rest for in-scope storage; centralised logging via Microsoft Sentinel or Wazuh with retention configuration to support PCI evidence requirements; vulnerability scanning support (internal scans and remediation coordination with your ASV's external scans); patch management programmes; and ADMCC-approved physical CCTV and access-control where card data is physically handled. Whether your environment qualifies for SAQ A, A-EP, B, B-IP, C, C-VT, D, or full ROC depends on merchant level, channel mix, and processing volume — your acquirer and QSA determine this. We are independent of the PCI Security Standards Council, all card brands (Visa, Mastercard, Amex, Discover, JCB), and any payment processor or acquirer. Discuss your CDE scope on +971 55 651 7843 or email [email protected].
PCI DSS technical capabilities
VLAN design and FortiGate policy isolating the cardholder data environment from corporate, guest and OT networks. Documented segmentation reduces PCI scope and supports the boundary controls your QSA will assess during SAQ or ROC validation.
FortiGate rule-base hardening with documented business justification, endpoint detection and response on in-scope systems, and multi-factor authentication for administrative and remote CDE access. Configurations are evidence-ready for QSA review.
TLS 1.2+ enforcement in transit, encryption at rest for in-scope storage, and centralised logging via Microsoft Sentinel or Wazuh with retention tuned to PCI evidence needs. We configure alerting on the technical events your QSA expects to see.
Internal vulnerability scanning, remediation coordination with your ASV's external quarterly scans, and patch management programmes for in-scope operating systems and applications. We do not act as the ASV — that remains a PCI SSC-listed firm.
We are honest about what an integrator can deliver. Emirtech is a technology firm (ADMCC-approved for security systems) founded in 2018, based at M44 in Mussafah Industrial Area. We engineer the technical layer beneath your PCI DSS programme — segmentation, firewall, EDR, MFA, encryption, logging — while your engaged QSA performs SAQ or ROC validation and your engaged ASV runs the quarterly external scans. We coordinate, deliver evidence-ready configurations, and stay in our lane. Call +971 55 651 7843 or request a free PCI DSS technical-control consultation.
Merchant environments we can scope for
Restaurants, retailers and hotels in Abu Dhabi and Al Ain processing card-present transactions via PIN entry devices or integrated POS. Technical work focuses on PED isolation, POS hardening and back-office segmentation around the CDE.
Online merchants using hosted payment pages or iframes (SAQ A territory) versus direct post (SAQ A-EP). We deliver the supporting infrastructure controls — your QSA confirms which SAQ applies based on integration model and processing volume.
Clinics, polyclinics and specialty centres in Mussafah, Khalifa City, Mohammed Bin Zayed City and Al Ain that accept card payments alongside DOH-regulated clinical systems. We segment payment infrastructure from clinical EMR networks.
Property management firms collecting rent and service charges by card, and private schools and training centres taking tuition payments. We isolate payment workflows from broader business systems and configure logging that supports SAQ evidence.
PCI DSS programmes succeed when each party stays in lane. Here is exactly where Emirtech operates and where we deliberately do not:
Emirtech is an independent systems integrator (ADMCC-approved for security systems) focused on delivering defensible, evidence-ready technical infrastructure that supports your QSA-led PCI DSS programme — without overstating what an integrator can or should deliver.
Common questions
No. Emirtech is not a QSA firm and we do not perform SAQ validation or issue Reports on Compliance (ROC). QSAs are individually certified by the PCI Security Standards Council and operate as licensed assessment firms. You must engage a QSA directly for formal PCI DSS validation. Emirtech works alongside your QSA on the technical engineering layer — segmentation, firewall, EDR, MFA, encryption, logging — so the controls your QSA needs to evidence are properly designed, deployed and documented.
No. Approved Scanning Vendor (ASV) status is granted by the PCI SSC and Emirtech is not on that list. Your quarterly external vulnerability scans must be performed by a PCI SSC-listed ASV. We coordinate with your chosen ASV, remediate findings on the infrastructure we manage, and run internal vulnerability scans that support the broader PCI evidence picture.
Merchant level determines this, and merchant level is set by your acquirer based on annual card transaction volume per brand. Level 1 merchants generally require a ROC validated by a QSA. Levels 2 to 4 typically use a Self-Assessment Questionnaire, with the specific SAQ (A, A-EP, B, B-IP, C, C-VT, D) determined by how you accept cards. Confirm both merchant level and SAQ eligibility with your acquirer and QSA — Emirtech does not determine this.
Effective segmentation places only the systems that store, process or transmit cardholder data — plus systems that can affect their security — inside the cardholder data environment (CDE). Systems that are properly isolated from the CDE and cannot affect its security can fall outside the PCI DSS scope; your QSA confirms where the boundary sits. We design VLANs, FortiGate policy and access controls to make that boundary defensible. Your QSA validates whether the segmentation is sufficient through penetration testing or scoping review.
No. Emirtech is an independent systems integrator (ADMCC-approved for security systems). We have no affiliation with the PCI Security Standards Council, Visa, Mastercard, American Express, Discover, JCB, Network International, Mashreq Payment, Telr, Checkout.com, Stripe or any acquirer or processor. We integrate the technical infrastructure underneath whichever payment provider you have contracted.
Call +971 55 651 7843 or request a free PCI DSS technical-control consultation. Share your merchant level (if known), card acceptance channels, current network and firewall setup, engaged QSA (if any), and current IT. A specialist will respond with a scoped proposal once the survey is done.
PCI DSS Technical Layer · Honest Scope
Free site survey · transparent scope · honest costs · ADMCC-approved for security systems · Mussafah M44 home base since 2018.
Related Pages
Emirtech delivers ISO 27001 Annex A technical control layer — NOT ISO certified consultancy, NOT certification body. Honest scope. Call +971 55 651 7843.
Read more →: ISO 27001 Technical Controls — Honest Scope Abu Dhabi
PDPL-aligned technical readiness in Abu Dhabi — biometric, access control, audit trails configured to Federal Decree-Law No. 45 of 2021. Call +971 55 651 7843.
PCI DSS technical support for Abu Dhabi retail & hospitality — VLAN segmentation, POS hardening & cardholder data flow mapping. Call +971 55 651 7843.
FortiGate, Sophos XG, SonicWall and Meraki MX firewall installation, VLAN segmentation, VPN and network security for Abu Dhabi offices. Call +971 55 651 7843.
Read more →: FortiGate, Sophos & SonicWall Firewall Abu Dhabi
Need a free Abu Dhabi site visit? Call +971 55 651 7843 or email [email protected] — we reply the same working day across Abu Dhabi and Al Ain.