Trust sits at the foundation of every digital payment.
As millions of transactions move through digital channels every day, protecting payment information requires security to be built into the systems and processes that support every transaction. At eSewa, we continue to strengthen this foundation as we work to provide a secure and reliable payment experience for our customers and partners.
As part of this commitment, eSewa has achieved PCI DSS v4.0.1 certification, marking a significant milestone in our ongoing focus on payment security.
A globally recognized standard for payment security
The Payment Card Industry Data Security Standard (PCI DSS) is a globally recognized security standard established to protect payment card data. It was developed and is maintained by the PCI Security Standards Council (PCI SSC).
The Council develops and maintains the standard, while compliance is assessed and enforced through the broader payment ecosystem, including payment brands, acquiring banks, and contractual relationships.
PCI DSS applies to organizations that store, process, or transmit payment card data, as well as systems that can affect the security of the environment where that data is handled.
For eSewa, achieving PCI DSS v4.0.1 certification represents alignment with this internationally recognized framework and reinforces the security practices supporting our payment environment.
Six goals, twelve requirements, one security framework
PCI DSS is structured around 12 core requirements grouped into six broader security goals. Together, they establish a comprehensive approach to securing the payment environment.
- Build and Maintain a Secure Network and Systems: Establish and maintain network security controls and ensure systems are securely configured.
- Protect Account Data: Protect stored account data and secure cardholder data during transmission over public networks.
- Maintain a Vulnerability Management Program: Protect systems and networks from malicious software while developing and maintaining secure systems and software.
- Implement Strong Access Control Measures: Limit access based on business need, authenticate users, and restrict physical access to cardholder data.
- Regularly Monitor and Test Networks: Log and monitor access to systems and payment data while regularly testing security controls.
- Maintain an Information Security Policy: Support security through organizational policies and programs.
Together, these requirements focus on the fundamentals of payment security: securing the environment, protecting payment data, controlling access, managing vulnerabilities, monitoring activity, testing security, and maintaining organizational accountability.
Protecting payment information throughout its lifecycle
Payment security extends beyond the moment a transaction takes place.
PCI DSS establishes safeguards for account data throughout its lifecycle, including requirements for protecting stored information and securing cardholder data during transmission. It also places strict controls around sensitive authentication data and its retention.
Access to payment environments is another important layer. The standard requires access to be limited according to business need, users to be identified and authenticated, and activity involving systems handling payment data to be logged and monitored.
The standard also addresses security monitoring, regular testing, vulnerability management, and protection of online payment pages against threats such as unauthorized scripts and e-skimming.
For eSewa, these requirements form part of the security foundation supporting our card payment environment in scope for the certification.
Security that continues beyond certification
PCI DSS v4.0.1 represents the current version of the standard. Version 4.0 was published in March 2022, followed by v4.0.1 in June 2024. The updated version corrected errors and clarified requirements while adding no new requirements and removing none.
The current standard places greater emphasis on security as an ongoing practice. Organizations are expected to demonstrate that controls operate effectively throughout the year, with defined ownership, continued monitoring, and regular validation.
This approach aligns with how we view security at eSewa.
Achieving certification is a significant milestone, but maintaining a secure payment environment requires continued attention. As technologies, payment experiences, and security threats evolve, our security practices must evolve with them.
A milestone built through rigorous assessment
Achieving PCI DSS certification involves a structured process that includes establishing the scope of the payment environment, mapping payment data and systems, assessing security gaps, implementing and embedding controls, and undergoing formal assessment.
For eSewa, achieving PCI DSS v4.0.1 certification reflects the work and continued focus invested in strengthening the security of our payment environment.
It adds another layer to our broader commitment to maintaining strong security practices as Nepal’s digital payment ecosystem continues to grow.
Strengthening trust with every payment
Our users should be able to make payments with confidence, knowing that security remains a fundamental part of the experience.
The achievement of PCI DSS v4.0.1 certification reinforces eSewa’s commitment to protecting payment information and maintaining a secure payment environment aligned with an internationally recognised security standard.
As we continue to innovate and expand the ways people pay, we will continue to strengthen the systems, processes, and practices that support those payments.
Because every payment represents trust, and at eSewa, protecting that trust remains a responsibility we take seriously.
