Menu
PCI DSS
Bottom line
PCI DSS is a contractual standard, not a government certification. Validation produces an Attestation of Compliance (AOC), or for Level 1 merchants a Report on Compliance from a QSA. Costs span $1K–$40K (SAQ path) up to $30K–$200K (Level 1 ROC).
One of 10 compliance framework explainers we maintain.
Key facts
- Controls
- 12 high-level requirements covering ~300 sub-requirements (v4.0.1)
- Recertification cycle
- Annual revalidation (ROC or SAQ)
- Ongoing oversight
- Quarterly ASV scans for in-scope systems
- Public registry
- PCI SSC Qualified Security Assessor list ↗
- Common gap categories
- Network segmentation (Req 1); Encryption in transit and at rest (Req 3, 4); Vulnerability and patch management (Req 6, 11); Logging and monitoring (Req 10); Strong authentication (Req 8)
- Related standards
- PCI PINPCI P2PEPCI 3DS CoreSOC 2
What is PCI DSS?
A global security standard (version 4.0, current release 4.0.1) maintained by the PCI Security Standards Council (founded by Visa, Mastercard, Amex, Discover, JCB), scoped to any entity that stores, processes, or transmits payment cardholder data. Version 3.2.1 was retired March 31, 2024.
Is PCI DSS a certification or an attestation?
PCI DSS is a contractual compliance requirement, not a government certification. Validation produces an Attestation of Compliance (AOC); Level 1 merchants require a Report on Compliance (ROC) from a Qualified Security Assessor (QSA). PCI SSC issues no certificates.
Who needs PCI DSS?
Merchants, payment processors, SaaS platforms, and service providers that handle card payments. Validation level is set by annual transaction volume; Level 1 (6M+ transactions/year) requires an annual QSA-led on-site assessment.
What does PCI DSS cost and how long does it take?
Range
$1K–$200K / 3–12 months
SAQ path (Levels 2–4): $1K–$40K over 3–6 months. QSA/ROC path (Level 1): $30K–$200K for the assessment alone over 6–12 months end-to-end. The two paths sit an order of magnitude apart.
One thing to watch
The SAQ vs. ROC split is the single biggest cost variable. A Level 4 SaaS startup and a Level 1 retailer face order-of-magnitude different costs.
Sources
Last verified 2026-05-13. Found a stale or wrong source? Email hello@soc2auditors.org.