What does PCI DSS compliance cost, and what decides the number?
A payment brand, acquirer or contract has asked for PCI DSS validation, and you need a budget before you can commit. The PCI Security Standards Council publishes no cost estimate for compliance, and the biggest single driver is the validation method: whether the card brand rules require a Report on Compliance completed by a Qualified Security Assessor (QSA), or allow a Self-Assessment Questionnaire (SAQ). Which path applies is set by the brand's merchant or service provider level, not by your own preference, so confirm your level with your acquirer or the relevant brand before you ask anyone for a quote. A ROC carries assessor fees for on-site or remote testing, while an SAQ shifts more of the preparation work onto your own staff.
Beyond the validation method, four factors place your organization somewhere on the range. Scope size decides how many systems must meet the requirements, so a smaller cardholder data environment costs less to test and evidence. Recurring activities are fixed by the standard: quarterly external and internal scans, penetration tests and segmentation tests at set intervals. The cost of those depends on how many systems, locations and networks they cover, and on whether an Approved Scanning Vendor or a tester is engaged per cycle. Third-party services, such as a PCI-listed P2PE solution or a payment provider's hosted pages, can reduce the number of applicable requirements, but your written agreements and yearly monitoring of those providers remain your job. Remediation of gaps found in readiness work is the least predictable cost, and it is one-time only if the fixes hold.
Organizations own their controls. DeployOpen plans, implements and documents the systems, configurations and evidence that the controls depend on, and can scope that work in writing before it starts. Ask any provider, including DeployOpen, to separate those services from the assessment itself. Only a QSA or the applicable validation body issues the Report on Compliance or accepts the Attestation of Compliance, so budget the assessor's fees as a separate line. When you request quotes, ask each party for the validation level it assumes, the systems in scope, the number of scan and test cycles, and which deliverables are one-time versus annual.
Who is paid for what in PCI DSS compliance
This table lists each cost component of PCI DSS validation, who is paid for it, whether it is one-time or recurring, and what drives its size. Read it to see which costs fall to an assessor, a scanning vendor, a penetration tester, an implementation partner or your own staff. The main takeaway is that the validation path and the size of your scope set most of the spend, and the recurring testing calendar is the cost you cannot avoid.
| Cost component | Who is paid | One-time or recurring | What drives the cost |
|---|---|---|---|
| Qualified Security Assessor (ROC) | QSA company, for the on-site or remote assessment and the Report on Compliance | Recurring, annually | Scope size, number of locations and systems sampled, and how well evidence is organized before the assessor arrives |
| Assessor fee for SAQ validation | Usually none for the SAQ itself, but an external reviewer may be engaged to check the questionnaire | Recurring, annually, if engaged | Whether you choose an independent review, and how many systems and payment channels you must explain |
| Approved Scanning Vendor (ASV) scans | ASV company, for external quarterly scans and rescans after failures | Recurring, quarterly | Number of external IP addresses or hosts in scope and the number of rescans needed to pass |
| Third-party penetration testing | Independent penetration testing firm, for internal and external tests and segmentation tests | Recurring, at least every 12 months | Size of the environment, segmentation complexity, and whether service providers need six-month segmentation tests |
| Implementation partner work | Implementation partner, for preparing systems, configurations, controls and evidence | Mostly one-time at first validation, then recurring for upkeep | Number of in-scope systems, how much is already documented, and the amount of remediation found in the gap review |
| Tooling and licenses | Software vendors or open-source support providers, for logging, file integrity monitoring, scanners and vulnerability management | Recurring license or subscription, plus one-time setup | Number of endpoints, log volume, retention period, and whether tools are self-hosted or subscribed |
| Internal staff time | Your own employees, for policy upkeep, access reviews, change records and evidence collection | Recurring across the year | Staff skill level, documentation quality, and how many teams touch the cardholder data environment |
| Remediation of gaps | Your engineers, plus any contracted developers or hardware vendors | One-time for each gap, with recurring fixes after changes | Number of gaps found, legacy systems that need replacement, and whether compensating controls or the customized approach are used |
| Third-party service provider oversight | Your own staff, to review each provider's status and written agreement | Recurring, at least yearly | Number of payment providers and how much of their evidence you must collect for your own assessment |
What makes PCI DSS compliance more or less expensive
Most of the money in PCI DSS compliance follows from three choices: how you validate, how much of your environment is in scope, and how many recurring tests you must buy and fix. The cards below cover the drivers you can control and what to ask for before you commit to a quote.
Validation level and method
The validation path is the largest single cost driver. Under Visa's rules, Level 1 merchants and Level 1 service providers submit an annual Report on Compliance completed by a QSA, while Level 2 and 3 merchants and Level 2 service providers complete an annual Self-Assessment Questionnaire. Confirm your level with your acquirer or payment brand before scoping work, because a ROC costs far more than an SAQ. Ask your acquirer which validation method applies to you in writing.
Size of the cardholder data environment
Every system that stores, processes or transmits account data, plus every connected or security-impacting system, must meet the requirements. A flat network where payment servers share segments with corporate workstations multiplies the controls, tests and evidence you must produce. Segmentation that is designed, documented and tested can shrink that population. Ask any consultant for a scope estimate built from a current data-flow diagram, not from an assumed architecture.
Recurring quarterly scans
External scans by an Approved Scanning Vendor and internal scans must run at least every three months under Requirements 11.3.1 and 11.3.2. These are recurring fees, and each failed scan adds rescanning and remediation work. The price depends on the number of external IP addresses and the scanning tools you run internally. Ask whether the quote covers rescans after failures and how the vendor prices additional addresses.
Penetration and segmentation testing
Internal and external penetration tests run at least every 12 months, and segmentation tests run every 12 months, or every six months for service providers (Requirements 11.4.2, 11.4.3, 11.4.5 and 11.4.6). A service provider therefore pays for segmentation testing twice as often as a merchant. Ask for the tester's qualifications, the methodology used, and whether retesting of fixes is included in the fixed price.
Point-to-point encryption and tokenization
A PCI-listed point-to-point encryption solution can significantly reduce the number of requirements that apply to a merchant, though it does not remove PCI DSS entirely (PCI SSC FAQ 1158). Tokenization can similarly reduce the systems that hold live account data. Both cost money up front in licensing or integration, so compare the one-time integration cost with the recurring testing and assessment work they remove. Confirm the listing status of any P2PE product before you rely on it.
Reusing SOC 2 evidence
A QSA cannot rely on a SOC 2 or SOC 3 report for PCI DSS, but may reuse evidence from those audits after reviewing it independently (PCI SSC FAQ 1567). Where your organization already produces access reviews, change records or logging evidence for a SOC 2 examination, reuse can cut duplicated evidence work. Agree in advance which evidence the QSA will accept, and confirm that the SOC 2 control scope matches the cardholder data environment.
Remediation of gaps
Gaps found during readiness work or the assessment cost money to fix, and missed periodic activities cannot be covered by compensating controls (PCI SSC FAQ 1572). A missed quarterly scan leaves a hole in the evidence that needs corrective action and can delay validation. Budget for remediation separately from the assessment, and ask a readiness reviewer to test the controls before the QSA arrives so that findings are fixed while the work is still cheap.
Which PCI DSS costs recur every year
The recurring part of PCI DSS compliance cost is the annual cycle of testing, scanning and validation, and it starts with quarterly external ASV scans and internal scans at least every three months (Requirements 11.3.1 and 11.3.2). Each scan run costs money, but the larger expense is the people who review results, close findings and rescan until the output is clean. Penetration tests must be repeated at least every 12 months and again after significant change (Requirements 11.4.2 and 11.4.3), and segmentation tests follow the same logic, every 12 months or every six months for service providers (Requirements 11.4.5 and 11.4.6). Ask any tester or QSA firm for a quote that separates the annual test from the retest of findings, because retesting is often where budgets slip.
Validation itself recurs. Every year the organization completes a Report on Compliance with a QSA or a Self-Assessment Questionnaire, and signs the matching Attestation of Compliance. Where the work is handled by a consultant, confirm what the annual fee covers: evidence review, scope confirmation, the assessor's time on the assessment and any reassessment after findings. Scope also changes each year as systems, vendors and payment flows change, so budget for an annual scope check rather than assuming last year's boundary still holds. Requirement 12.8 adds yearly monitoring of each third-party service provider that touches account data or the cardholder data environment, which means reviewing their current attestations and responsibility matrices every year.
Continuity is the cost most often underestimated. A missed quarterly scan or an expired penetration test cannot be fixed later with a compensating control, and the resulting gap in evidence must be addressed through corrective action, which can delay compliance. Budget for a standing calendar of recurring tasks with a named owner for each, and ask vendors and assessors how they handle a missed activity so that an internal delay does not become a validation delay. A practical check for your planning is to list every recurring activity, its frequency, its owner and the evidence it produces, then confirm the annual budget covers all of them without relying on one-off projects.
How the validation path changes the budget
A Level 1 merchant or Level 1 service provider typically submits an annual Report on Compliance completed by a Qualified Security Assessor. The assessor's fee is the largest visible line, and it covers an on-site or remote assessment, sampling of systems and evidence, and the report itself. Around that fee sit internal preparation costs, quarterly external and internal scans, annual penetration tests, and segmentation testing. Visa requires Level 1 merchants and Level 1 service providers to submit an annual ROC by a QSA, according to the Visa compliance validation page.
- QSA assessment fee: Paid per engagement and driven by the number of systems, locations and sampled controls in scope.
- Internal staff time: Recurring effort to produce evidence, answer sampling requests and maintain policies and inventories.
- Quarterly scanning and annual testing: Recurring vendor fees for ASV scans and penetration tests, repeated on fixed cycles.
- Remediation work: One-time engineering to close gaps found in the first assessment, plus retesting.
- Acquirer and brand paperwork: Coordination with the acquirer, which can affect timing but is usually not billed separately.
Confirm with your acquirer or the relevant payment brand which level you are assigned, whether a ROC is required, and what submission deadlines apply. The PCI SSC does not set these levels.",
Level 2 and Level 3 merchants, and Level 2 service providers, typically complete an annual Self-Assessment Questionnaire rather than a ROC, according to the same Visa guidance. The questionnaire itself does not carry a QSA fee, so the budget shifts toward internal effort, scanning, and any help you choose to buy. Many organizations in this group spend most of the budget on preparing evidence and closing gaps, not on the validation document.
- Internal effort: Staff time to answer the questionnaire, gather evidence and sign the Attestation of Compliance.
- Quarterly ASV scans: Recurring vendor fees for external scans, which Visa requires at every merchant and service provider level.
- Penetration testing: An annual cost where the questionnaire type requires it.
- Optional consultant support: Fixed-scope help with gap analysis or evidence review, if your team lacks capacity.
- Tooling for evidence: Logging, file integrity monitoring and access review tools that produce evidence without manual collection.
Confirm with your acquirer which SAQ type applies, because the questionnaire type changes which requirements and tests are required. Ask whether the brand requires any additional validation for your level.",
A merchant that fully outsources payment pages through redirects or embedded iframes may qualify for a shorter questionnaire, and the budget often drops sharply compared with a merchant that handles card data itself. The remaining costs concentrate on the parts that stay with the merchant: the checkout page, the scripts loaded on it, and the systems that still touch payment flows. Eligibility depends on the criteria in the questionnaire, so the cost estimate should follow the eligibility review, not precede it.
- Eligibility review: Internal or consultant time to confirm that no card data reaches your own systems.
- Scanning where applicable: Quarterly external scans can still be required depending on the questionnaire type and your environment.
- Script and page controls: Engineering effort to manage payment page scripts and change detection on the merchant-controlled page.
- Third-party oversight: Annual review of the payment provider's compliance status and written agreements.
- Fewer assessor hours: Where a questionnaire is used, the assessor line item is usually absent or smaller.
Confirm with your acquirer which questionnaire applies to a fully outsourced model, and ask the payment provider for its current validation evidence and responsibility matrix before you set a budget.",
A service provider that stores, processes or transmits account data for customers, or that can affect the security of a customer's cardholder data environment, carries validation work that often extends beyond its own systems. Costs rise with the number of customers, shared environments and the level of access staff have to customer systems. The validation level and method still come from the payment brands and acquirers, so confirm them before planning. Visa requires Level 1 service providers to submit an annual ROC and Level 2 service providers to complete an annual questionnaire, according to the same Visa page.
- Multi-tenant scope: Engineering and evidence work to show that tenants are isolated and that shared components are covered.
- Customer-facing documentation: Responsibility matrices and attestations that customers request, which take recurring effort to maintain.
- Assessor scope growth: Larger scope increases assessor hours and sample sizes for a ROC.
- Penetration and segmentation testing: Segmentation testing has a shorter cycle for service providers, so this line recurs more often.
- Partner oversight: Yearly monitoring of any third party your service depends on, which the standard expects.
Confirm with your brand or acquirer whether you are a Level 1 or Level 2 service provider, and ask customers which evidence they will accept before you scope the work.",
How reducing scope lowers the bill
Every system that PCI DSS touches is a system someone must test, document and evidence each year, so shrinking the scope is one of the few levers that reduces the bill directly. PCI DSS applies to the cardholder data environment (CDE) and to connected or security-impacting systems. Fewer systems in that boundary means fewer requirements to test, fewer scan targets, a smaller penetration test and segmentation test, and less evidence for the QSA or the SAQ to review. Before you accept any quote, ask the assessor and the implementation partner to list every system counted in scope and the reason each one is there, and ask which of them could be removed by moving card data elsewhere.
Tokenization and PCI-listed point-to-point encryption (P2PE) are the two main ways organizations do this. According to the PCI SSC, a PCI-listed P2PE solution can significantly reduce the number of requirements that apply to a merchant, but it does not remove PCI DSS entirely, so you still need to confirm which requirements remain and who validates them (PCI SSC FAQ 1158). Confirm the listing status of any P2PE product with its vendor and the PCI SSC before you design around it, and ask your QSA or SAQ advisor to confirm in writing which requirements still apply. Tokenization needs the same check, because a token service that can detokenize may itself sit inside the CDE.
Reusing evidence from other audits can also cut effort, but only within limits. A QSA cannot rely on a SOC 2 report alone to satisfy a PCI DSS requirement, yet may reuse SOC 2 evidence after independently reviewing it (PCI SSC FAQ 1567). In practice, ask whether your existing SOC 2 or ISO 27001 evidence, such as access reviews and change records, maps to PCI DSS requirements in a way the QSA will accept, and budget for the review work that remains. The savings come from avoiding duplicate collection, not from skipping the assessor's testing.
What inflates PCI DSS cost and how to avoid it
Most PCI DSS overspend traces back to a handful of avoidable problems: scope nobody mapped, card data nobody expected, vendors nobody monitored, and recurring tasks nobody scheduled. Each card names the cost effect and the control that keeps it in check.
Scope discovered late
When the cardholder data environment is not mapped before assessment planning starts, teams find connected or security-impacting systems mid-project and must bring them into scope. Every added system adds requirements to test, evidence to collect and assessor hours. Map account data flows and connected systems first, then confirm the scope with your assessor before committing budget. Ask any consultant to show how scope was determined and who approved it. Scope errors are often the largest source of rework.
Stray card data in unexpected systems
Primary account numbers often turn up in logs, support tickets, spreadsheets, backups and test databases. Each location found late can pull a system into scope and force remediation of storage, retention and access controls. Run discovery scans across file shares, databases and logs before the assessment, and fix the source process rather than only deleting copies. Ask for the discovery method, the tool used and the list of locations found and cleared. Repeat discovery after major releases.
Unmanaged third parties
A third-party service provider can reduce your effort, but it does not remove your responsibilities. Missing written agreements or skipped yearly monitoring of providers under Requirement 12.8 create gaps that someone must later close under time pressure. Keep a current provider inventory, collect each provider's PCI DSS responsibility matrix and attestation, and record your annual review. Confirm with each provider which requirements it covers and which remain yours.
Gaps against newer requirements
Requirements that became effective on 31 March 2025 were best practices before that date, so some organizations never built the processes, documentation or tooling they now need. Assessing the v4.0.1 requirements late means redesigning controls during the assessment window. Compare your current controls against the full v4.0.1 list before planning, and assign an owner and evidence type to each gap. Ask your assessor to confirm which future-dated requirements apply to your validation type.
Missed quarterly activities
A missed quarterly ASV scan or internal scan leaves a hole in the evidence record. Compensating controls cannot fill a missed periodic activity, so the entity must run corrective action, which can delay compliance and add retest and consultant fees. Put every quarterly and annual activity on a shared calendar with a named owner and a reminder. Schedule the ASV scan vendor before the window closes, and confirm that scan results are retained for your assessor.
What to ask for in a PCI DSS quote
Before comparing any proposal, ask for a written scope that states the validation level and method you are assuming, such as a Report on Compliance by a Qualified Security Assessor or a Self-Assessment Questionnaire with its Attestation of Compliance. The validation path drives most of the cost, and a quote that does not name it cannot be compared with another. Confirm the level against your card brand's rules, since Visa, for example, requires a QSA-led Report on Compliance from Level 1 merchants and Level 1 service providers, while lower levels complete a Self-Assessment Questionnaire. Also ask which systems the quote treats as in scope, because the number of systems drives the effort on every requirement.
Ask for a list of recurring activities with the frequency assumed for each. At minimum this should cover quarterly external and internal scans, the external scans performed by an Approved Scanning Vendor, annual penetration testing, segmentation testing at the frequency your entity type requires, and the yearly review of third-party service providers under Requirement 12.8. Require the proposal to separate one-time work, such as gap closure and documentation, from these recurring tasks, so you can budget for the second year as well as the first. The PCI SSC does not publish a cost figure for any of this, so the quote is the only reliable place to find it.
Ask the proposal to name who does what. The QSA issues the assessment report and is the only party whose opinion counts for the validation. The Approved Scanning Vendor performs and reports the quarterly scans. The implementation partner, such as DeployOpen, prepares systems, configurations and evidence, but does not issue reports or certificates, and the quote should say so. State the independence boundary in writing: the party that remediates your environment should not also be the party that validates it. Finally, ask what is excluded from remediation. Hardware replacement, licensed third-party products, end-of-life system upgrades and staff time on your side are common gaps. DeployOpen does not publish a price list, and its fixed-scope quotes follow a written scope agreed before work starts.
PCI DSS compliance cost questions buyers ask
Is there an official PCI DSS compliance cost?
No. The PCI Security Standards Council publishes no cost estimate for PCI DSS compliance, so any figure you see is a vendor or consultant estimate, not a standard. The council does not enforce compliance or impose fines. Financial consequences for non-compliance come from individual payment brand programs, which is why the Council's own FAQ on consequences of non-compliance is the right starting point for understanding who can charge you what. Your real cost is set by four things: which validation method your acquirer or brand requires, how large your cardholder data environment is, which recurring tests apply to you, and how much remediation your current environment needs. Ask any provider to price each of these separately so you can compare quotes on the same basis.
Does a ROC always cost more than an SAQ?
Usually, but the validation method is only one part of the bill. A Report on Compliance must be completed by a Qualified Security Assessor, so its cost is largely assessor time. Visa requires Level 1 merchants and Level 1 service providers to submit an annual Report on Compliance by a QSA, while Level 2 and 3 merchants and Level 2 service providers complete an annual Self-Assessment Questionnaire. An SAQ still carries cost: someone must answer each requirement with evidence, and an outside party may still be paid to help. Which path applies depends on your level and your acquirer, so confirm it in writing before you request quotes. A larger scope can make an SAQ more expensive in internal effort than a smaller ROC, so compare the work involved, not just the document type.
Can we do PCI DSS compliance in-house?
Often yes for the internal work, but not for every activity. Your team owns the controls, the policies and the evidence, and it can complete an SAQ or prepare for a ROC without an outside firm. Some activities must come from parties independent of your team. Quarterly external vulnerability scans must be run by a PCI SSC Approved Scanning Vendor, and a ROC must be completed by a QSA. Internal staff can prepare for both, which reduces the hours billed by outside parties. The cost question is capacity: in-house work competes with operations, and gaps in periodic activities cannot be fixed later with compensating controls, so a missed quarterly scan can delay compliance. Estimate the hours your team needs for scope confirmation, evidence collection and recurring tasks before deciding.
Does an implementation partner replace the QSA?
No. An implementation partner prepares systems, controls and evidence, but only a QSA can complete a Report on Compliance, and a certificate from any party does not count as validation. Under PCI DSS, the organization remains responsible for its compliance, and the assessor reviews what you present. A partner's work can reduce assessor time because the evidence is organized, scope is documented and gaps are closed before the assessment starts. It also adds its own cost, which is separate from the assessor fee. Ask the partner to state in writing what it delivers and what the QSA will still need to test. Keep the consulting and assessment roles separate so the assessor's independence is not in question.
How often do PCI DSS costs recur?
Most of the cost recurs every year because the standard sets fixed testing frequencies. External Approved Scanning Vendor scans and internal scans must run at least every three months. Internal and external penetration tests must run at least every 12 months, and segmentation tests run every 12 months, or every six months for service providers. The validation itself, whether an SAQ or a ROC, is annual. One-time costs include the first scope definition, gap closure against the current version of the standard, and initial tooling or infrastructure changes. Ask each provider to split its quote into one-time work and annual fees, and to state how repeat assessments are priced if scope changes during the year.
Does reducing scope really cut PCI DSS cost?
Yes, because PCI DSS applies to the cardholder data environment and to connected or security-impacting systems. Fewer systems in scope means fewer systems to test, scan, log and document each year. Tokenization, point-to-point encryption and outsourced payment pages are common ways to shrink scope. A PCI-listed point-to-point encryption solution can significantly reduce the number of requirements that apply to a merchant, though it does not remove PCI DSS entirely. Scope reduction also has upfront costs, such as integration work and the review needed to confirm that data no longer flows where it used to. Ask for a quote that shows the number of systems in scope before and after the change, so you can see the saving in recurring work.
How a PCI DSS cost engagement moves from scope to report
The sequence turns an open cost question into a fixed scope, a dated evidence set and an assessor-signed report, with each phase producing a document the next phase depends on. Your organization owns the controls throughout, the implementation partner prepares systems and evidence, and only the QSA issues the ROC or SAQ with its Attestation of Compliance.
Confirm the validation path with the acquirer
Start by asking your acquiring bank or payment brand which validation route applies to you: a Report on Compliance by a QSA or a Self-Assessment Questionnaire. Visa's published rules tie this to merchant and service provider level, so the level and the required submission should be confirmed in writing before any budget is set. Your team owns this decision and the output is a short written record naming the level, the submission type and the deadline your acquirer has set. Without that record, quotes for assessor work cannot be compared on a like-for-like basis.
Define scope and map data flows
Identify every system that stores, processes or transmits account data, plus the connected and security-impacting systems that could affect them. The output is a current scope statement, a data-flow diagram and a system inventory that a QSA can test against. Scope size is the main lever on cost, so this step is where you decide whether tokenization, P2PE or outsourced payment pages could shrink the environment. Confirm each decision with your assessor before you commit to it.
Scope partner work in writing
Define what an implementation or consulting partner will do, such as gap analysis, control configuration, policy drafting or evidence collection, and what your team and the assessor will do. Ask for deliverables, named roles and acceptance criteria in a fixed-scope statement of work. Consultants that prepare your evidence must stay independent of the QSA who validates it, so confirm that boundary in the contract. The output is a signed scope document that makes the quote traceable to specific work products.
Close gaps and build evidence of periodic activities
Remediate the gaps found in the readiness review and set up the recurring activities assessors check, including log reviews, access reviews, change records and policy acknowledgments. Periodic activities that are missed cannot be fixed with compensating controls, so the evidence trail must start early enough to cover the assessment period. The output is a dated evidence library mapped to each v4.0.1 requirement in scope, with owners named for every recurring task.
Run quarterly ASV scans and annual penetration tests
Engage an Approved Scanning Vendor for the external quarterly scans and run internal scans on the required cadence. Commission internal and external penetration tests and segmentation tests, and retest any findings that are fixed. Each test produces a dated report, and failed scans or open findings must be remediated and rescanned before the results are submitted. The output is a complete set of passing scan reports and penetration test reports, each tied to its scope statement.
Hand evidence to the QSA or assessor
Provide the scope statement, data-flow diagrams, evidence library, scan reports and penetration test reports to the QSA or other assessor your validation path requires. The assessor tests the evidence, asks for clarifications and may sample records. Where you use SOC 2 evidence, the QSA must review it independently before reuse. The closing output is the ROC or completed SAQ, signed with its Attestation of Compliance by the assessor or by your officer for an SAQ, which you submit to your acquirer or payment brand. Certificates or logos do not replace these documents.
Checks before hiring a QSA, ASV or consultant
Hiring outside help for PCI DSS is one of the larger recurring costs, and the wrong choice can cost more than the fee. The checks below help you confirm that the firm and people you hire are listed, independent and experienced with payment environments before you sign a statement of work.
Verify the QSA company listing
Only a QSA company listed on the PCI SSC website can issue a Report on Compliance. Confirm the company's listing and its current status on the official list before the proposal stage, and ask for the listing reference in writing. A listing that has lapsed or carries remediation status can delay your assessment and force rework on evidence already collected. Treat a verbal assurance as insufficient.
Check the individual QSA employee
The company listing is not enough, because the individual who signs your Report on Compliance must be a QSA employee in good standing. Ask for the name of the lead assessor and confirm that person's QSA credential on the PCI SSC list. Ask who else will sample evidence, since staff changes mid-engagement are a common source of delay and cost overruns.
Confirm the ASV listing for scans
Quarterly external scans must come from an Approved Scanning Vendor listed by the PCI SSC. Confirm the vendor's listing before you buy scanning services, and check that the scope covers your public IP addresses and any cloud or hosting ranges. A scan from an unlisted provider does not produce evidence an assessor will accept, and a gap in quarterly scans is hard to correct later.
Separate consulting from assessment
A firm that designs your controls should not also validate them, because the assessor must test controls it had no hand in building. Ask each vendor which work it will perform for you and whether the same firm would assess the result. If it would, ask how independence is documented. Keeping these roles apart may mean paying two firms, so compare the total cost before choosing a single provider.
Ask for named staff and payment experience
Request the names and roles of the people who will do the work, along with examples of prior work in payment environments of similar size and architecture. Ask how many years each person has worked on PCI DSS assessments and whether they have experience with your validation level and method. Keep the examples general and confirm references directly rather than relying on marketing material.
Get scope, deliverables and fees in writing
Ask every provider for a written scope that lists the systems covered, the deliverables, the validation method, and the assumptions behind the price. Vague quotes usually hide costs for additional sampling, retesting and extra interviews. Ask which items are one-time, such as the first assessment or gap work, and which recur each year, such as scans, penetration tests and the attestation renewal.
How DeployOpen scopes and prepares PCI DSS work
DeployOpen plans, implements and documents the self-hosted open-source platforms that sit inside a PCI DSS environment, inside your own cloud accounts, data centers or air-gapped networks. We prepare systems and evidence so the cost of compliance can be estimated from a written scope, while the organization owns its controls and an independent QSA or assessor issues the validation.
How we scope
- Written scope names the systems, payment channels and validation method that drive PCI DSS compliance cost before work starts.
- We map which components touch cardholder data or could affect its security, so recurring ASV scan and penetration test scope is agreed in advance.
- Fixed-scope proposals list deliverables and timelines, so you can ask for a quote that matches the agreed boundaries.
How we build
- We implement and harden the open-source platforms in your environment against the PCI DSS requirements that apply to the agreed scope.
- Testing covers application, API, infrastructure and segmentation checks, with findings tracked to remediation before the assessor arrives.
- Configuration, logging and access controls are built to produce the recurring evidence that quarterly and annual activities require.
How we hand over
- Documentation covers system inventories, data-flow and network diagrams, configuration baselines and responsibility records for your team to maintain.
- Evidence packages are organized by requirement so your QSA can test controls directly, and we confirm what you own after handover.
- Knowledge transfer sessions leave your staff able to run scans, reviews and log checks without relying on our team.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, with recurring costs set in the written agreement.
- Retainers can cover quarterly scan coordination, annual testing cycles and updates when PCI DSS versions or scope change.
- Ask any provider, including us, to confirm in writing which activities are included, who pays for assessor time and how changes are priced.
