PCI DSS Compliance Services
For any organisation that stores, processes or transmits cardholder data — scope reduction, SAQ or RoC preparation, segmentation, quarterly ASV scanning, and penetration testing.
PCI DSS is the global standard for protecting cardholder data, enforced by the payment brands through merchant and acquirer agreements. Passeca maps your cardholder-data environment, applies scope-reduction so you validate the smallest possible surface, closes the 12 requirements, runs the required penetration tests and ASV scans, and supports your SAQ or QSA-attested RoC.
What is PCI DSS?
PCI DSS (the Payment Card Industry Data Security Standard) is the global information-security standard for organisations that store, process or transmit cardholder data. It is maintained by the PCI Security Standards Council (PCI SSC), which was founded by the major payment brands — Visa, Mastercard, American Express, Discover and JCB.
PCI DSS is not a law but a contractual obligation: any merchant or service provider that accepts or handles payment cards agrees to it through acquirer and payment-brand agreements. Compliance is validated either by a Self-Assessment Questionnaire (SAQ) for lower-volume merchants or by a Report on Compliance (RoC) attested by a Qualified Security Assessor (QSA) for the largest. The current version of the standard is PCI DSS v4.0.1, organised into 12 requirement groups.
Who needs PCI DSS compliance?
- You accept payment cards. Any merchant that takes card payments is in scope, regardless of volume.
- You run an online store or payment gateway. E-commerce is a primary driver of PCI DSS scope.
- You are a service provider to merchants. Payment processors, gateways and hosts handling cardholder data are service providers under the standard.
- An acquirer or payment brand asked for validation. That request carries a deadline and a validation-type expectation.
What does PCI DSS actually require?
PCI DSS v4.0.1 organises its requirements into six goals containing twelve requirement groups. Every requirement applies to the cardholder-data environment (CDE) and the systems connected to it; scope reduction shrinks how much of your estate that is.
- Build and maintain a secure network — firewalls and routers (Req. 1–2), and secure configuration of system components.
- Protect cardholder data — protect stored data (Req. 3) and encrypt transmission over open, public networks (Req. 4).
- Maintain a vulnerability-management programme — anti-malware (Req. 5) and secure systems and applications including patching (Req. 6).
- Implement strong access control — restrict access on a need-to-know basis (Req. 7), unique IDs (Req. 8), and restrict physical access (Req. 9).
- Monitor and test networks — logging and log monitoring (Req. 10), and regular security testing including annual penetration testing and ASV scanning (Req. 11).
- Maintain an information-security policy — a policy that addresses security for all personnel (Req. 12).
v4.0 added an emphasis on targeted risk analysis, customised approaches to requirements, and stronger authentication and monitoring expectations. The scope of testing and the validation path (SAQ vs RoC) depend on your merchant level and architecture.
How Passeca helps you achieve PCI DSS compliance
- 01
Scoping & cardholder-data mapping
We map exactly where cardholder data enters, flows through and leaves your environment, and apply scope-reduction techniques — network segmentation, tokenisation, P2PE — so only the systems that truly must be in scope are in scope.
- 02
Self-assessment level determination
We determine your merchant or service-provider level and therefore whether you need a Self-Assessment Questionnaire (SAQ) or a formal Report on Compliance (RoC) attested by a Qualified Security Assessor (QSA).
- 03
Gap analysis against the 12 requirements
We assess your environment against all 12 PCI DSS requirement groups and rank the gaps. We prioritise scope reduction first because it shrinks the entire compliance surface that follows.
- 04
Remediation & evidence
We implement the missing requirements — segmentation, access control, logging, vulnerability management — and capture evidence in Hyperproof, including the penetration tests and quarterly scans the standard requires.
- 05
Attestation & ongoing validation
We support you through SAQ completion or RoC fieldwork with a QSA, arrange the required ASV quarterly scans, and set up annual revalidation so you stay compliant cycle over cycle.
What you get from the engagement
How long does PCI DSS compliance take?
| Validation path | Typical duration | What drives it |
|---|---|---|
| SAQ (low volume, scoped down) | 1–3 months | Scope reduction and SAQ completion |
| RoC — Level 1 merchant | 3–6 months | Remediation plus QSA fieldwork |
| Service provider (RoC) | 3–6 months | Multi-tenant segmentation validation |
Scope reduction is the biggest time and cost lever. A well-segmented environment that keeps cardholder data on isolated systems can move from Level-1-style effort to an SAQ path. Passeca prioritises this in step one.
How much does PCI DSS compliance cost?
Cost depends on the validation path. SAQ-based compliance is far cheaper than a QSA-attested RoC. The QSA fee (for Level 1) and ASV scanning fees are billed separately from Passeca's consulting. Scope reduction is the single biggest cost lever.
| Validation path | Consulting (Passeca) | QSA / ASV fees |
|---|---|---|
| SAQ | Price on request | ASV scanning only |
| RoC — Level 1 merchant | Price on request | Quoted separately by the QSA |
| Service provider (RoC) | Price on request | Quoted separately by the QSA |
Doing more than one framework?
| PCI DSS | ISO 27001 | SOC 2 | |
|---|---|---|---|
| Access control | |||
| Encryption in transit / at rest | |||
| Logging and monitoring | |||
| Vulnerability management | |||
| Annual penetration testing | Req. 11.4 | A.8.8 | CC7 |
| Information-security policy | |||
| Scope | Cardholder data | Whole ISMS | Service org |
PCI DSS, ISO 27001 and SOC 2 share the bulk of their technical controls. PCI DSS is the narrowest in scope (the cardholder-data environment only) but the deepest within that scope. Passeca maps evidence once in Hyperproof so the same controls satisfy all three.
PCI DSS compliance, answered
The questions merchants and service providers ask about meeting PCI DSS.
What is PCI DSS?
Who needs to comply with PCI DSS?
What is the difference between an SAQ and an RoC?
What are the PCI DSS merchant levels?
How does network segmentation reduce PCI DSS scope?
Does PCI DSS require penetration testing?
How much does PCI DSS compliance cost?
What version of PCI DSS applies — and when is v4.0.1 required?
Reduce your PCI scope before you validate
Book a free scoping call. We will map your cardholder-data flows, show you where scope reduction is possible, and give you the cheapest validation path for your volume.
Related