PCI DSS compliance in Georgia

What PCI DSS is

The Payment Card Industry Data Security Standard (PCI DSS) is set by the PCI Security Standards Council, founded by the major card brands. It applies to any organisation that stores, processes or transmits cardholder data, or that can affect the security of that data. The current version is PCI DSS v4.0.1. The requirements that were future-dated in version 4.0 became mandatory on 31 March 2025, including targeted risk analyses, stronger authentication and controls against skimming on payment pages.

How compliance is confirmed

There is no PCI DSS certificate. Compliance is confirmed through documents defined by the Council and accepted by your acquiring bank or the card brands:

• Self-Assessment Questionnaire (SAQ) for eligible merchants and some service providers, with a signed Attestation of Compliance (AOC).
• Report on Compliance (ROC) prepared by a Qualified Security Assessor (QSA) for larger merchants and most service providers, also with an AOC.
• Quarterly external vulnerability scans by an Approved Scanning Vendor (ASV) where the SAQ type or ROC requires them.

Which path applies depends on your transaction volume, the card brands and your acquirer's instructions. Be careful with offers of a "PCI DSS certificate": what matters is a valid AOC and the supporting reports.

Service providers have their own validation rules, and their customers usually ask for a copy of the service provider AOC every year. If you host, process or support payments for other companies, expect this request in contracts and due diligence.

Who needs it in Georgia

Card payments are widely used in Georgia, and online and in-store acquiring is provided by Georgian banks and payment service providers supervised by the National Bank of Georgia. Requests for PCI DSS evidence usually come from acquirers, card schemes or foreign partners. Typical cases:

• E-commerce merchants and online services taking card payments on their own website or through a payment page.
• Payment service providers, payment facilitators and processors that handle card data for other businesses.
• Hotels, travel agencies and tour operators in Tbilisi, Batumi and resort areas that take card details by phone, email or booking systems.
• Contact centres, hosting and IT providers that can affect the security of a client's cardholder data environment.

How BALTUM helps

1. Data flow mapping and scoping. We trace where card data enters, moves and is stored, then look for ways to reduce scope through tokenisation, hosted payment pages or segmentation.
2. Validation path. We confirm with you which SAQ type or ROC applies and what your acquirer expects.
3. Gap assessment. We compare current controls with PCI DSS v4.0.1, including the requirements that became mandatory in 2025.
4. Remediation support. Policies, targeted risk analyses, access and logging controls, vulnerability management, payment page script monitoring and service provider management.
5. SAQ preparation or QSA assessment support. We help you complete the SAQ and AOC, or prepare for the QSA assessment and coordinate ASV scans with an approved vendor.
6. Annual cycle. We help you keep evidence up to date for the next annual validation.

The duration depends on the size and complexity of your card data environment. We set it after scoping.

Related standards and reading

An ISO/IEC 27001 system covers many PCI DSS process requirements, but not all technical ones, so the two are often run together. For the wider picture in the financial sector, read cybersecurity requirements for banks and financial companies in Georgia.

To discuss your payment flows, contact us at info@baltum.org or through the request form.

Frequently asked questions

Can we get a PCI DSS certificate?

No such certificate exists. Compliance is confirmed by an SAQ or a ROC together with a signed Attestation of Compliance, plus ASV scan reports where required.

We use a payment provider's hosted page. Do we still need PCI DSS?

Yes, but the scope is usually much smaller. Many merchants with fully outsourced payment pages can use a short SAQ. Your website still needs controls, because it directs customers to the payment page.

Is BALTUM a QSA?

No. BALTUM provides readiness and remediation support. When a ROC is required, the assessment is performed by a Qualified Security Assessor, and scans by an Approved Scanning Vendor.