ISpectra delivers PCI DSS certification in Kolkata in 3 to 6 months. Any organisation that processes, transmits or stores cardholder data is in scope. We identify where cardholder data is stored, processed or transmitted. We narrow the PCI DSS scope, address identified gaps and validate the required controls.
Our 100% first-attempt pass rate covers every client so far. We put a fixed-fee quote in writing within 48 hours. Our team supports you on-site across Kolkata.
Kolkata is a banking city first. Several established banking institutions operate across the region, serving customers through extensive branch networks and a strong focus on financial inclusion.Card programmes at this scale lean on many vendors, from card printing to collections, and each one can fall inside PCI DSS. PCI DSS compliance is how a card issuer, a personalisation bureau and a collections floor all prove the same thing to the same auditor.
Card fraud is also on the local police's radar. Kolkata Police's cyber unit names OTP theft and ATM card cloning among the common tricks. It gets about 400 complaints a day, across every kind of cyber fraud. Monthly losses fell from about ₹22 crore in 2024 to about ₹16 crore in 2025, and recovery rates roughly doubled.
Don't read the low NCRB figure as low risk. The city logged just 21 cybercrime FIRs in 2024, but that reflects how cases get registered, not how many happen. Sector V BPOs face a second problem: police there have raided fake call centres that cheated foreigners. For a real firm taking card payments for US or UK clients, an Attestation of Compliance is the quickest way to prove you are the genuine article.
We run each PCI DSS audit in Kolkata as a fixed-fee project with six clear steps. You sign off each output before the next one starts.
We meet your operations, IT and client-delivery leads for 90 minutes. Together we settle your role as merchant or service provider and list every card touchpoint.
We trace card data through calls, chat, web forms, bank links and batch files. Anything that stores, moves or can affect it is in scope.
We assess your controls against all of . You get a ranked remediation plan with owners and dates, sized for a lean budget.
We remediate each identified gap: segment the network, harden systems, add MFA, centralise logs and set clean-desk and no-phone rules for agent floors.
Quarterly ASV scans, internal scans, segmentation checks and the yearly penetration test, with every fix retested.
We complete your SAQ or back your QSA through the RoC, hand over the AoC and keep the programme running each year.
PCI DSS is built on 12 requirements. Below, each one is tied to a Kolkata business that handles card data, such as a bank, a back-office floor or a vendor.
Separate the payment segment from agent desktops, training rooms and shared building networks in Sector V.
Hardened images for every server, desktop and terminal. No vendor default passwords left in place.
Keep card data only when a clear need exists. Encrypt or tokenise it, and purge it on schedule.
Use strong encryption whenever card data crosses public networks, including links to overseas clients.
Anti-malware kept current on agent machines and servers, with alerts that someone actually reads.
Patch fast, code securely and control the scripts that run on any web payment page you host.
Collections agents see what they need to close a call. Nobody else sees full card numbers.
One login per person, no shared agent IDs, and MFA for every route into the CDE.
Access control on floors, no phones or paper at payment desks, and secure handling of card stock and printed statements.
Logs kept 12 months, with 3 months close at hand. CERT-In also needs 180 days of logs held in India.
ASV scans every quarter, internal scans, a yearly pen test and segmentation tests to prove the walls hold.
Policies, training, incident plans and written terms with every third-party service provider that touches card data.
A full Report on Compliance is only needed at higher levels or when a client demands it. Many Kolkata merchants use one of eight SAQs instead. The choice follows your card flow.
The card brands decide these levels based on yearly volume. Service providers have their own two levels; Level 1 means more than 300,000 card transactions a year.
You send every payment to a PCI-validated provider's hosted page and never handle card data electronically yourself.
You outsource processing, but your website still shapes the page where buyers enter card details.
You use only imprint machines or standalone dial-out terminals and keep no electronic card data.
You use standalone, PTS-approved terminals that talk to the processor over an IP link, a common setup for city-centre shops.
Your payment application is connected to the internet, but no card data is stored electronically.
Staff type one card at a time into a web-based virtual terminal, often for mail or phone orders.
You only use hardware terminals from a listed point-to-point encryption solution.
Everyone else, including every service provider, such as a Sector V BPO taking payments for clients. It maps to the full standard.
| Level | Yearly volume or trigger | How you validate |
|---|---|---|
| Level 1 | Above 6 million card transactions, or any merchant that suffered a breach | Yearly on-site QSA assessment with a Report on Compliance |
| Level 2 | Between 1 and 6 million card transactions | Yearly SAQ with ASV scans; some acquirers want a RoC |
| Level 3 | 20,000 to 1 million e-commerce transactions | Yearly SAQ plus quarterly ASV scans |
| Level 4 | Below 20,000 e-commerce transactions (or below 1 million overall) | Yearly SAQ plus quarterly ASV scans, as the acquirer decides |
ISpectra confirms your level and the right SAQ / RoC during the free kickoff workshop.
Row by row: the exposure of running card work in Kolkata without validation, and what a completed programme delivers.
PCI DSS applies to any Kolkata organisation that stores, processes or transmits cardholder data. Card data sits with banks and their vendors, with back-office floors and with a growing base of online sellers. We shape the work around how your business really handles cards.
Card management systems, issuer processing and the PCI DSS evidence banks need.
Vendors that emboss cards or print statements for banks, with strict physical controls.
Agents taking card payments on calls, descoped with masking or pay-by-link.
Voice and chat teams handling card payments for US, UK and other overseas clients.
Front-desk, booking engine and banquet payments.
Domestic debit and prepaid card programmes, and field devices used by agents.
Agent devices that serve rural customers on behalf of banks.
Colocation and cloud hosts supporting customers' PCI DSS evidence.
Teams building or running payment systems for clients abroad.
D2C stores and loyalty platforms with checkout pages to protect.
Freight and service fees paid by card around the Kolkata port.
In-store terminals and card flows across outlets.
Billing counters and online payment links for patients.
Fee collection and course sales by card.
Premium, EMI and renewal payments made by card.
New payment apps that want PCI DSS built in from day one.
Tell us how cards reach you. We will send a free scoping view and our SAQ or RoC advice, with no strings.
Most Kolkata firms reach a solid PCI DSS v4.0.1 position in 3 to 6 months, on dates we fix in writing. Here is the longest usual schedule. A lean scope shortens each phase, down to about 12 weeks.
Kickoff, card-flow mapping and confirmation of your level.
A full gap check and a ranked plan for the fixes.
Segmentation, hardening, policies, ASV scans and an internal pen test.
Your SAQ or RoC, QSA sign-off where required, and the AoC.
We are engineers who put PCI DSS controls into your systems and floors. We stay on to keep them working. Every client we have prepared has passed on the first attempt: a 100% first-attempt pass rate.
Our PCI DSS consultants in Kolkata visit Sector V, New Town and central offices for workshops and floor walkthroughs.
Every programme is designed and run by senior Qualified Security Assessors.
PCI DSS mapped to SOC 2, ISO 27001, HIPAA, GDPR and DPDP, with shared controls.
Segmentation, tokens and payment links shrink what you must audit.
A written quote in 48 hours and a 3 to 6 month programme. Over 200 B2B engagements delivered.
Overseas clients and banks often ask for more than PCI DSS. The frameworks share many controls, so one build covers a lot of ground.
For IT and BPO firms whose US clients ask for a SOC 2 report.
A widely known security system standard with strong overlap with PCI DSS.
For teams handling US health data, including patient payments.
For firms serving clients or customers in the EU.
India's personal data law, which sits alongside card rules.
Trusted by 200+ Global Enterprise Clients
Trusted by 200+ Global Enterprise Clients
“ISpectra Technologies brought deep expertise in cybersecurity and DevSecOps to our projects, playing a crucial role in our EDR Tool implementations and SOC 2 compliance. Their solutions were tailored to our business and their proactive approach improved both our agility and security posture. ISpectra felt more like an extension of our team than an external vendor.”
What Your Kolkata Business Gets
No obligation · Results in 48 hours · 100% confidential
Pick a time that works for you
Our team responds within 24 hours
Talk to our QSA-led PCI DSS experts. Get a comprehensive PCI DSS applicability and security assessment completely free.
Onsite delivery across 37 locations in India
