PCI DSS · NIS2 · DORA · ISO 27001 · GDPR: Compliance from people who have passed the audit
We turn PCI DSS, NIS2, DORA, ISO 27001 and the EU AI Act into working controls, clear evidence and real security improvements.
From requirement to evidence
We have delivered seven PCI DSS certifications, so we know what auditors ask for and what actually reduces risk. We help you understand what applies, close the gaps efficiently and stay audit-ready year after year.
PCI DSS
Seven certifications delivered. Scoping, segmentation, controls and evidence for PCI DSS v4, and keeping the certification year after year.
NIS2
Scoping, gap analysis and the security measures NIS2 requires, including incident reporting within 24 hours.
DORA
Digital operational resilience for financial entities and their ICT providers.
ISO/IEC 27001
An information security management system that fits your organisation and passes certification.
EU AI Act & ISO 42001
Classify your AI systems, meet your obligations and set up AI governance.
GDPR & privacy
Privacy by design, DPIAs and data protection processes that work in practice.
Proven in practice
Not just talk. Requirements turned into reality.
Compliance, privacy and AI only matter when they work in real systems. Every area we advise on is one we have delivered hands-on.
PCI DSS
Seven PCI DSS certifications completed. The latest was led as CSO, for a platform storing card and financial data.
Patient data & healthcare
Designed, developed and operates a patient system for private healthcare, with applications connected to SLL. In daily use by customers for 15 years.
Monitoring, incidents & PKI
Operated the SIEM, acted as incident manager and administered PKI for a large Swedish retail group with its own bank.
Application security
Deployed a web application firewall and configured its policies and rules, protecting applications at one of the largest banks in the Nordics.
Cloud security & geopolitics
Speaks at IT security conferences on the biggest security challenges in the cloud, and writes on the geopolitical risks of cloud dependency.
AI, privacy & delivery
Long experience bringing AI, privacy and GDPR into real software development. Delivered with agile methods, not slide decks.
PCI DSS, done for real
PCI DSS is one of the most demanding security standards there is. We have completed seven PCI DSS certifications, so we know where the effort really goes. We help merchants and service providers reduce scope, implement the controls and prepare the evidence for the assessor.
- Scope reduction and network segmentation
- PCI DSS v4 gap analysis and roadmap
- Targeted risk analyses and customised approach
- Evidence collection and QSA audit preparation
- Year-round compliance, not just audit season
1 · Scope & segmentation
Smaller scope, less to protect and audit
2 · The 12 requirements
3 · Evidence & assessment
Evidence collected all year, assessor (QSA) satisfied
7×
certified
Information classification: know where your data may live
Before you can decide where data may be stored, who may access it or whether it may be used with AI, you need to know what kind of data it is. Information classification gives every type of information a level, from public to strictly confidential, with clear rules for storage and handling. That is the foundation for hybrid environments: what may go to the cloud, what must stay in the EU, and what must stay on your own premises.
- Classification model adapted to your business, from public to strictly confidential
- Rules for storage: global cloud, EU cloud or on-premise
- Handling rules: encryption, access, sharing and retention
- What may and may not be used with AI tools
- The basis for GDPR, NIS2, PCI DSS and patient data requirements
- Training so people actually apply it
Public
Website, brochures
Internal
Policies, plans
Confidential
Customer data, contracts
Strictly confidential
Patient data, card data
Gap analysis & roadmap
A clear picture of where you stand against the requirements, with a prioritised plan to close the gaps. Where frameworks overlap, one plan covers them all.
- Scoping and applicability
- Control-by-control assessment
- Cross-mapping PCI DSS, ISO 27001, NIS2 and DORA
- Budget and timeline estimates
Prioritised by risk, with budget and timeline per gap
Compliance as code
Where possible, we automate controls and evidence collection in your platforms, so compliance becomes continuous instead of a yearly scramble.
- Policy-as-code in CI/CD and Kubernetes
- Automated evidence and reporting
- Continuous control monitoring
- Evidence and reports available in your customer portal
- The same approach for ESG and CSRD data, powered by AI
policy: encryption_required
applies_to: [storage, databases]
frameworks: ["ISO 27001 A.8.24", "PCI DSS 3.5", "NIS2 Art. 21"]
action: deny_if_missing
One control, evidence for three frameworks
Track record · PCI DSS
Seven PCI DSS certifications, delivered
PCI DSS is one of the most demanding standards in security. armsec founder Martin Vallée has taken organisations through seven PCI DSS certifications. The most recent was at a Northern European cybersecurity SaaS provider serving banks, finance, insurance, telecom and hosting, whose platform stores and manages sensitive card and financial data. As Chief Security Officer, he led the Security and Technical teams through the 2025 renewal.
PCI DSS certifications delivered
Frameworks covered: PCI DSS, NIS2, DORA, ISO 27001, GDPR and the EU AI Act
Years running a system with sensitive patient data
How we work
A clear path from first meeting to lasting results
Scope
Identify which regulations, systems and data are in scope.
Assess
Measure current maturity against the requirements.
Implement
Policies, processes and technical controls.
Certify
Evidence, internal audit and support through the external audit.
PCI DSS, NIS2 or DORA on your agenda?
Book a short scoping session and find out what applies to you and what to do first.