What a PCI DSS consultant costs and what it covers
If a card brand, acquirer or customer requires you to validate PCI DSS, a consultant's fee follows from a written scope, and the PCI Security Standards Council publishes no price for it. The SSC does not estimate compliance costs and does not impose fines, so any financial consequence of non-compliance comes from individual payment brand programs. Ask each consultant or implementation partner for a fixed-scope proposal that lists the systems, locations, requirements and deliverables it covers, then compare proposals on that basis rather than on headline day rates. The largest cost driver is the validation method. Visa requires Level 1 merchants and Level 1 service providers to submit an annual Report on Compliance completed by a Qualified Security Assessor, while Level 2 and 3 merchants and Level 2 service providers typically complete an annual Self-Assessment Questionnaire. Confirm your level and the applicable validation requirements with your acquirer or the payment brand before you request quotes, because the wrong assumption changes which assessor you need and what you pay for. Scope is the second driver: the more systems that store, process or transmit cardholder data or could affect that environment, the more controls must be built, tested and evidenced. Recurring testing also adds effort every year. Quarterly scans, annual penetration tests and segmentation tests have fixed frequencies, so ask whether a quote covers the first cycle only or the recurring work. Your organization owns its controls. A consultant can scope the environment, identify gaps, configure systems and assemble evidence, but the consultant does not issue validation. Only the QSA issues the Report on Compliance, and the organization signs the Attestation of Compliance. Ask any consultant to state in writing which deliverables it prepares, which decisions remain with your team, and which parts the assessor will test independently, so that you know what you are paying for and who is accountable for each control.
Who gets paid for what in a PCI DSS engagement
This table compares each cost component of a PCI DSS engagement by who is paid, whether the cost is one-time or recurring, and what moves it up or down. Use it to build a quote request that separates assessor fees from consulting, tooling and internal effort. The main takeaway is that the validation method and the size of the cardholder data environment drive most of the spend, and the SSC publishes no price for any of it.
| Cost component | Who is paid, and one-time or recurring | What drives the cost up or down |
|---|---|---|
| QSA assessment | A Qualified Security Assessor firm, billed for the assessment. Recurs annually where a Report on Compliance applies. | Validation level set by the payment brand, the size and number of systems in scope, and how ready the environment is when the assessor arrives. |
| ASV scans | An Approved Scanning Vendor, for external vulnerability scans. Recurs at least every three months under requirements 11.3.1 and 11.3.2. | Number of external IP addresses and internet-facing services, and how often rescans follow failed results. |
| Implementation partner | A consultant or integrator, paid under a fixed-scope written agreement. Usually one-time for gap analysis and build, with optional recurring support. | Gap between current controls and requirements, the number of systems to rebuild, and whether scope reduction is done before the build starts. |
| Tooling and licenses | Software vendors or open-source support providers. Often recurring, with some one-time setup. | Choice of commercial or open-source tools, number of endpoints or users, and whether log and file integrity tools are self-hosted. |
| Penetration testing by an independent tester | An independent tester who is not the QSA or the consultant who built the controls. Recurs at least every 12 months under requirements 11.4.2 and 11.4.3. | Scope of internal and external targets, segmentation testing frequency (six months for service providers), and retest rounds after findings. |
| Internal staff time | Your own employees, paid through existing payroll. Recurs through daily, monthly and annual tasks, plus assessment support. | Number of people who own controls, the quality of existing policies and inventories, and how much evidence is collected automatically. |
What makes PCI DSS consulting more expensive or longer
Consulting effort for PCI DSS rises or falls with a small set of drivers. Most of them trace back to how much of the environment touches account data and how that data is validated, so these cards are ordered from scope down to the choices made during assessment.
Size of the cardholder data environment
The cardholder data environment (CDE) includes every system that stores, processes or transmits account data, plus connected and security-impacting systems. PCI SSC FAQ 1580 is the reference point for connected systems. Each additional server, database, administrator workstation or network segment in that boundary is another system the consultant must document, configure and test. To reduce this, trace where account data flows and remove copies that are not needed, for example by tokenizing data earlier in the payment path. Ask any consultant to show the scope boundary in writing before quoting.
Validation level and report type
The validation route sets how much evidence an assessor needs. Visa requires Level 1 merchants and Level 1 service providers to submit an annual Report on Compliance by a QSA, while Level 2 and 3 merchants and Level 2 service providers complete an annual Self-Assessment Questionnaire. A ROC involves interviews, sampling and evidence review, so a consultant preparing for one spends more time on evidence than on an SAQ. Confirm your level with your acquirer or payment brand before engaging anyone.
Number of locations and third parties
Each payment location, data center, cloud account and outsourced processor adds its own configurations, data flows and responsibilities. Shared services need responsibility matrices that show which controls the organization runs and which the provider runs. Consultants must verify each third party's attestation and reconcile the boundary between them. Reduce this by consolidating payment locations onto a standard build and by limiting third parties that touch account data to those that are truly needed.
Maturity of existing evidence
Consultants spend the most time where evidence is missing, scattered or out of date. Firewall rule reviews, access recertifications, log reviews and vulnerability scan records must exist for the full assessment period, not only on the day of the review. Organizations with a documented calendar of recurring tasks and an evidence store usually need less rework. Ask a consultant to start with a gap analysis that lists every requirement lacking dated evidence, so the cost of catching up is visible before the work begins.
Customized approach versus defined approach
Each requirement can be met through the defined approach, which follows the standard's stated steps, or through the customized approach, which meets the stated objective in a different way. The customized approach requires the entity to document its own design, risk analysis and testing, and the assessor must test that design against the objective. That usually adds design and documentation work compared with the defined approach. Choose it only where the design benefit is clear, and ask the consultant to estimate the documentation effort for each customized requirement separately.
Compensating controls
A compensating control is used when a requirement cannot be met as written because of a documented technical or business constraint. The entity must document the constraint, the alternative control, and how that control meets the intent of the requirement, and the QSA decides whether it is acceptable. PCI SSC FAQ 1046 notes that the SSC does not approve specific compensating controls. Each one adds analysis, testing and assessor review that recurs every year. Ask consultants to remove the constraint where possible before designing a compensating control around it.
How a PCI DSS consulting engagement moves from scoping to evidence
A consulting engagement follows a fixed sequence in which each phase produces a document or control the next phase depends on, so that the independent assessor receives a defined scope, a clear gap picture and evidence the organization can show. The organization keeps ownership of its controls throughout, and the assessor decides the outcome.
Agree the written scope and role split
Before any technical work starts, the organization and the provider agree in writing what the engagement covers, which systems and business channels are in view, who does each task, and what the deliverables are. The agreement also states that the provider prepares controls and evidence but does not issue any validation. The output is a signed statement of work with a named owner on the client side. You know this step is done when a reviewer can read the document and say who is responsible for every deliverable, including the assessor's role in the later handover.
Map scope and account data flows
The provider works with your team to identify where cardholder data is stored, processed or transmitted, and which connected or security-impacting systems could affect that environment. The team builds network and data-flow diagrams and inventories the systems in each zone. Scope drives the effort of everything that follows, so this phase tests whether segmentation and any tokenization or encryption you rely on actually limit the environment. The output is a scoping document and data-flow diagrams that your team and the assessor both accept as the starting point. You know it is done when stray card data locations have been searched for and each system has a documented reason for being in or out of scope.
Run gap analysis against v4.0.1
The provider compares your current controls with each applicable requirement of PCI DSS v4.0.1, using the defined approach as the baseline and noting where a customized approach might be considered. It checks policies, configurations, logs, access records and testing history against what the requirement expects, and it records which future-dated requirements already apply. The output is a gap register that lists each requirement, its current state, the evidence that exists, the gap, and the proposed fix with its owner. You know this step is done when every in-scope requirement has a status and no gap is recorded without an owner.
Build and remediate controls
Your team, with the provider's help, closes the gaps in the register by changing configurations, deploying tools, writing procedures, and setting up recurring activities such as scans and reviews. Where a control cannot meet the requirement as written, the team documents the proposed approach and discusses it with the assessor early, because the SSC does not pre-approve configurations and the QSA decides whether an alternative meets the intent of a requirement. The output is a working control set with change records. You know this step is done when each remediated control can be demonstrated on a live system, not only described in a document.
Prepare evidence for each requirement
The provider organizes the artifacts an assessor will sample, such as policies with approval records, configuration baselines, log extracts, access review sign-offs, scan and penetration test reports, and training records. The evidence is mapped to the requirement it supports and dated so the assessor can see that periodic activities actually occurred over the assessment period. Recurring activities with fixed frequencies need a record for each cycle, so gaps in the calendar should be identified now. The output is an evidence index that maps each requirement to its artifacts and owners. You know this step is done when a staff member who was not involved can locate the evidence for any requirement within a short search.
Hand over to the independent assessor
The organization gives the assessor the scoping document, data-flow diagrams, gap register, evidence index and records of any consulting involvement. The assessor then decides its own testing approach and sampling, and produces the Report on Compliance or the Self-Assessment Questionnaire with its Attestation of Compliance, depending on the validation level and the entity's type. The provider does not sign or issue either document. Your team records any consulting role in the questionnaire where the form requires it, and the assessor confirms independence before testing. You know this step is done when the assessor has accepted the evidence package and has documented its findings, which is the only point at which validation exists.
Why the consultant cannot also assess the same controls
The rule is simple to state: a QSA employee who recommends, designs or implements controls for an entity may not assess those same controls. PCI SSC FAQ 1562 allows another QSA employee who was not involved in the design or build to perform the assessment. The independence question is about people inside the QSA company, not only the firm, so a firm that offers both services must show that the assessing individuals had no hand in the controls under review. Before engaging anyone, ask the QSA company how it separates its consulting and assessment staff and who would sign the Report on Compliance for your environment.
A separate consulting firm avoids the question entirely. If an implementation partner builds segmentation, logging or access controls, the QSA you hire to assess your environment has no conflict to manage, and the assessor can test those controls without having shaped them. The trade-off is coordination: you carry more of the handoffs between the builder, your own staff and the assessor, and you should write down who owns each control and each piece of evidence before work starts. The partner still prepares systems and evidence, but only the independent assessor reports on compliance.
When a QSA helps you complete a Self-Assessment Questionnaire, the rules are different and more lightweight. PCI SSC FAQ 1445 says the parties should agree the QSA's role in advance. The QSA records that role in Part 3c of the SAQ, and an Internal Security Assessor records any involvement in Part 3d. Ask your assessor to confirm in writing what they will and will not do for the SAQ, and make sure the questionnaire reflects that role accurately, since the Attestation of Compliance is your organization's statement.
Who owns controls, who prepares evidence and who assesses
Your organization owns PCI DSS. The standard places responsibility for the cardholder data environment, its controls and its compliance status with the entity that stores, processes or transmits account data, and no consultant or assessor takes that on. Your team decides scope, accepts risk, approves policies and signs the Attestation of Compliance as the officer who makes the compliance statement.
- Policy and approval: Your leadership approves the security policies, risk analysis and standards that Requirement 12 expects, and maintains them over time.
- Control operation: Your staff runs daily and periodic activities such as log reviews, access reviews, patch cycles and change approvals, and keeps the records.
- Scope decisions: Your team owns the system inventory, data-flow diagrams and the final decision on what is in the cardholder data environment.
- AOC signatory role: An authorized officer signs the Attestation of Compliance. A consultant can draft material for that signature but should not sign it on your behalf.
- Third-party oversight: You remain accountable for vendors and service providers in the payment flow, including the evidence they supply.
Before you engage any firm, confirm in writing which tasks you keep, which ones a partner performs and who signs each deliverable.
An implementation partner helps you build and document controls, and it prepares the evidence an assessor will later examine. It works on your systems and in your environment, but it does not issue reports, attestations or certificates. Those come only from an independent assessor.
- Scoping support: The partner can map systems and data flows and help you test scope boundaries, while you retain the final scope decision.
- Control build: Engineers configure hardening, logging, access control, encryption and segmentation to the requirements you select.
- Evidence preparation: The partner organizes configuration exports, logs, test results and tickets so an assessor can trace each control to its proof.
- Testing coordination: It schedules scans and penetration tests and tracks remediation, although the testers must meet the qualification rules that apply to them.
- Independence boundary: A firm that designs or builds controls for you generally cannot assess the same controls. Ask the assessor to confirm this in writing before work begins.
Ask each partner which deliverables they produce, who reviews them, and how their role will be recorded in the SAQ or ROC if required.
A Qualified Security Assessor (QSA) performs the independent assessment and writes the Report on Compliance (ROC) for entities that must validate that way. An Approved Scanning Vendor (ASV) runs the external vulnerability scans that the standard requires. Both are qualified by the PCI Security Standards Council, and their work is what carries external weight.
- Independent assessment: The QSA tests the controls, samples evidence and decides whether each requirement is met, including whether a compensating control meets the intent of a requirement.
- ROC and attestation: The QSA completes the ROC on official templates. The entity signs the AOC, and the QSA's report is the record the payment brands rely on.
- ASV scanning: The ASV performs external scans and reports on them. Scans from a partner or internal team do not replace this external scan.
- Independence rule: A QSA employee who designed or implemented controls for you may not assess them. A different QSA employee who was not involved must do the assessment.
- Fees and scope: Assessor fees depend on the agreed scope and validation level, so request a written statement of work that lists the systems, sites and testing included.
Verify any assessor or ASV on the PCI SSC listings before signing, and confirm which person on the team will perform the assessment.
How to choose a PCI DSS consultant and check their role
A consultant can help you prepare for PCI DSS, but the role must stay separate from the assessor who validates your environment. These cards cover the checks that confirm who does what before you commit to a written scope.
Confirm the assessor listing directly
If the firm says it is a QSA company, check that listing on the PCI SSC website yourself rather than relying on its marketing or a logo. Ask for the names of the individuals who will work on your engagement and confirm their qualifications the same way. Consultants who are not listed can still help with planning and controls, but they cannot issue a Report on Compliance. Record the listing check in your procurement file so the assessor selection is documented before any work starts.
Separate consulting and assessment teams
Ask whether the people who design or build your controls will also be the people who assess them. Under PCI SSC rules, a QSA employee who recommends, designs or implements controls for an entity may not assess those controls, and another QSA employee who was not involved may do so. Request written confirmation of which team members sit on each side, and make sure your assessor is not the same firm that wrote your control design.
Payment environment experience
Ask for examples of work in environments similar to yours, such as e-commerce checkout, card-present terminals, payment service providers or cloud-hosted cardholder data environments. Good answers name the systems involved, the scope decisions made and the requirements the team found hardest to meet. Vague references to general security work do not show that the team understands cardholder data flows, segmentation or the difference between the SAQ and ROC paths.
Evidence and documentation handling
Ask who owns the evidence, where it is stored and how it is named, dated and version-controlled. Confirm that your organization keeps copies of policies, configurations, scan reports and change records in your own systems after the engagement ends. A consultant may prepare evidence, but the assessor decides what it proves. Ask how the team handles evidence that another auditor has already reviewed, since reuse of other reports depends on the assessor's acceptance.
Written role for each party
Before signing, ask for a responsibility matrix that lists each task, the party who performs it, and the party who approves it. Include scoping, gap analysis, control build, evidence collection, internal scans, penetration testing and the Attestation of Compliance. Ask the consultant to state which items it will not do, such as signing any attestation or issuing a validation statement. Any role the consultant claims for the assessor must appear in the assessor's own agreement.
Questions before a fixed-scope agreement
Fixed-scope agreements work best when the scope document names the systems, locations, deliverables and acceptance criteria. Ask what is excluded, how changes to scope are priced and approved, and who pays for re-work if the assessor finds gaps. Ask what the recurring tasks are after the first engagement, including quarterly reviews and scans, and whether they are included or quoted separately. Ask the firm to confirm any deadline in writing against the current PCI DSS version and the SSC's published dates.
Questions buyers ask about PCI DSS consultants and costs
Does the PCI SSC publish a price for PCI DSS compliance?
No. The PCI Security Standards Council publishes no cost estimate for PCI DSS compliance, and it does not impose fines. Any financial consequences of non-compliance come from individual payment brand programs, so ask your acquirer or the relevant brand what applies to your organization. Your total cost depends on how your validation is performed, how much of your environment is in scope, and how much remediation work you need before assessment. Ask each provider to price those components separately: the assessor's fee for the validation you need, the consultant's fee for readiness and build work, and any tooling or scanning subscriptions that recur each year.
Is a PCI DSS consultant required to get validated?
No. PCI DSS does not require you to hire a consultant. Your validation is performed by a Qualified Security Assessor for a Report on Compliance, or by you for a Self-Assessment Questionnaire, depending on the level and validation type set by your payment brand. Many organizations still bring in outside help for gap analysis, scoping, control design and evidence preparation, especially when they lack staff who know the standard well. Whether that help is worth paying for depends on your in-house experience, the size of your cardholder data environment and the timeline your acquirer has set.
How much effort does PCI DSS work need from our own staff?
Expect your own staff to remain responsible for the controls, even when a provider does most of the building. Internal effort usually concentrates in three places: confirming which systems store, process or transmit account data, supplying architecture and data-flow information, and running the day-to-day tasks such as log review, access reviews and change approvals. Your staff will also answer assessor questions and approve policies. Ask a provider to show, in the written scope, which tasks require named internal owners and roughly how many hours of their time each phase is expected to take.
Can our team handle PCI DSS readiness without outside help?
Often yes, if you have people who understand the requirements and the environment well enough to test their own controls. Smaller merchants on a short Self-Assessment Questionnaire may need little outside support. Larger environments, service providers and organizations using the customized approach usually benefit from an independent gap analysis, because internal teams find it hard to see their own blind spots. Whichever route you choose, the organization keeps ownership of the controls and the evidence. Make an honest internal skills assessment before deciding, and document which parts you plan to keep in-house.
How long does a PCI DSS readiness project take?
The duration depends on the agreed scope, not on a standard timeline. The main variables are how many systems are in the cardholder data environment, how many controls already work as described, how much policy and documentation must be written, and how quickly your team can make changes. Ask any provider for a phased plan with dependencies and internal milestones, and confirm that the schedule covers the assessor's availability as well as the build work. Recurring activities such as quarterly external scans and annual penetration tests continue after the project ends, so the plan should show when they start and who runs them.
Can the company that assesses us also build our controls?
Not for the same controls. Under the PCI SSC's QSA independence rule, a QSA employee who recommends, designs or implements controls for an entity may not assess those controls. Another QSA employee who was not involved may perform the assessment. A QSA firm may still help with some preparation work, but the assessment and the consulting must be kept separate, and you should confirm how the firm manages that split before signing. If you use a different firm for consulting, the assessor can still rely on the evidence it produces, but the assessor decides what it accepts.
What do we need to provide before a PCI DSS quote?
Providers need enough detail to scope the work in writing before they can price it. Prepare the list of payment channels you operate, the systems that store, process or transmit card data, network and data-flow diagrams, the current SAQ or ROC history, and any service providers or third parties that touch your environment. Include your acquirer's validation requirement and deadline, and any compensating controls or customized approaches you already use. Ask the provider to state its assumptions, the deliverables for each phase, what your team must supply and what is excluded. Vague scopes tend to produce vague quotes.
How DeployOpen scopes, implements and prepares PCI DSS evidence
DeployOpen works as an implementation partner. We help your team scope the systems in question, build and harden the self-hosted open-source platforms involved, and prepare the configurations, records and evidence your QSA or other assessor will review. We do not issue Reports on Compliance, Attestations of Compliance or certificates, and the assessment remains with an independent assessor.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- We map where cardholder data flows across the systems you run inside your own cloud, data center or air-gapped network.
- The written scope states which systems, controls and evidence items are included, and which remain with your team or an assessor.
How we build
- We plan, implement, customize, integrate and harden the self-hosted open-source platforms in your own infrastructure.
- We configure logging, access controls, backups and security testing so that the controls produce the records an assessor will ask for.
- Where a control needs a customized approach or compensating control, we document the design and confirm your assessor's position before building.
How we hand over
- We document configurations, architecture and operating procedures so your staff can run the environment after handover.
- We prepare the evidence packages that map each in-scope control to the artifacts an assessor will sample, such as configuration exports and test reports.
- We walk your team through the evidence and leave written records of decisions, so responsibility stays clearly with your organization.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, separate from the initial fixed-scope work.
- Recurring activities such as quarterly internal scans or annual penetration tests can be planned into a retainer if you ask for it.
- Before you sign, ask us to confirm the scope, the responsibilities that stay with you, and what your QSA needs from us.
