Payments · 2016 – 2018
PCI-DSS Recertification for a Payment Gateway on AWS
Helped a payment gateway in Thailand restructure its cloud security controls to achieve PCI-DSS recertification for its AWS-based services.
The Challenge
For a payment gateway, PCI-DSS certification is a licence to operate: without it, the business can’t process card payments. This gateway in Thailand ran its services on AWS, and its security solutions and cloud controls needed rework to achieve recertification.
What I Did
Working as an independent security consultant, I helped the gateway:
- Redesign its security solutions for its AWS-based services.
- Restructure its systems and cloud security controls so they met PCI-DSS requirements in a cloud environment.
- Get through the recertification of its AWS-based services.
This drew on the rest of my consulting work at the time: VAPT across networks, cloud systems and web applications; architecture and code reviews; and GRC reviews and audit readiness against PCI-DSS, ISO 27001, SOX and RBI/SEBI guidelines.
Outcome
The payment gateway achieved PCI-DSS recertification for its AWS-based services.
Why It Matters
Moving regulated payment workloads to the cloud is now routine, but proving they’re compliant isn’t. This engagement combined cloud security architecture with hands-on audit readiness, and it ended with the business keeping the certification it depends on.