Building PCI DSS compliance from scratch
Nandakumar Rangasamy
Engineering Lead & India Site Leader, GoMobi
Discover why 1400+ companies trust Scrut
THE COMPANY
Deliberate approach to building trust in fintech
GoMobi is a fintech platform operating under the regulatory oversight of Malaysia. As a company, they embed security deeply into their operations. However proving this via a compliance certification was essential.
THE CHALLENGE
Achieving PCI DSS without prior compliance experience
Since GoMobi were not compliant with any industry framework to begin with, there was a steep learning curve involved. This meant re-evaluating security posture from the ground up.
-
Setting up compliance operations from scratch: With no clear roles established or policies approved across departments, there were gaps in ownership.
-
Time-draining manual collection of evidence: Teams had to manually track evidence submissions and validity, increasing complexity and the likelihood of inaccuracies.
-
Reactive approach to remediating issues: Gaps in monitoring the overall security and compliance posture meant that there were delays in fixing any issues coming up.
-
Avoiding short-term tick-the-box compliance: GoMobi did not want to achieve certification as a stamp of approval, but instead tailor its processes to sustain it continuously to build trust.
THE SOLUTION
Built-in expertise, automation, and audit readiness
With Scrut’s unified platform to manage policies, automate evidence collection, and prep confidently for audits; GoMobi quickly transitioned to a structured, audit-ready compliance program.
Consolidated compliance monitoring and management
Scrut’s central dashboard allowed HR, IT, and governance teams to collaborate seamlessly. Policies were created easily using the in-line editor and auditor-vetted templates. Further, automated recurrence schedules for updating policies were set up. Employee policy acceptance was streamlined with timely automated reminders. All this was done with collaboration enabled by the platform’s task management capability. Lastly, detailed audit logs tracked every minute action in real time for comprehensive visibility during audits.
Automated cloud scans and evidence collection
End-to-end audit preparation and support
Scrut’s expert infosec team with over 50 years of experience, provided extensive support in creating and managing compliance documentation. Corrective actions were minutely tracked and implemented via the platform and any other compliance gaps or vulnerabilities were instantly identified and mitigated. Structured guidance throughout the audit preparation process helped them enter the certification phase with confidence, knowing that all necessary controls and the 12 core requirements of PCI DSS were robustly in place.
THE IMPACT
Strengthening security maturity for long-term fintech growth
-
Improved security alignment across departments: Scrut’s methodical approach and intuitive platform led to an organization-wide culture of compliance and accountability, leading to better cross-functional operations.
-
Comprehensive visibility of compliance progress: Proactive tracking of compliance from cloud to evidence and even audits, led to greater transparency in progress and gaps and ensured that appropriate steps were taken to maintain constant compliance.
-
Reduced overhead, increased compliance maturity: GoMobi avoided additional tooling costs of having an additional HRMS by using Scrut to automate employee access control, policy acknowledgment tracking, and security trainings.
-
Future-proofed compliance for scalable growth: Pursuing PCI DSS with a methodical, security-first approach has laid the foundation for sustainable growth. This aided market expansion, especially across regulated geographies.
Nandakumar Rangasamy
Engineering Lead & India Site Leader, GoMobi
Explore why our customers trust Scrut for their compliance needs
Customer success stories
