PCI DSS compliance cost: what moves the price, and how scope decides it

What you pay for, and why no two budgets match

PCI DSS compliance has no all-inclusive proposal because the standard applies to whatever your cardholder data environment contains. Four things set the total: the systems, people and locations inside it; the level and validation route applied to you; how far existing controls already meet the twelve requirements; and how much of the work your team carries. Scope comes first, because remediation, testing and assessment effort all grow with it.

The money leaves in four directions:

• Consulting, if you use it, to scope, remediate and assemble evidence.
• Independent validation: the QSA's assessment where required, ASV scans and penetration tests.
• Remediation: the technology and configuration work the gaps demand.
• Internal effort: staff hours that never arrive as an invoice.

How scope decides the cost

The PCI Security Standards Council defines the CDE as the systems, people and processes that store, process or transmit account data, plus any system with unrestricted connectivity to them. On a flat network that can be most of the company, with every file server and finance laptop needing hardening, logging, scanning and a place in the assessor's sample.

Segmentation contains the sprawl: isolating the CDE behind tested network controls cuts the components carrying requirements, and with them remediation, internal workload and assessment effort. It costs something too: design, firewall or cloud changes, and penetration tests proving the isolation holds, yearly for merchants and six-monthly for service providers.

Data discovery often matters more than any product: card numbers turn up in inboxes, spreadsheets, call recordings and tickets, and deleting what nobody needs is almost always cheaper than protecting it. PCI DSS scoping and segmentation: shrinking the CDE sets out the method.

The cost drivers at a glance

Use the table below to test any budget or quotation.

Tokenisation, P2PE and outsourcing: paying to shrink the scope

Scope reducers cost money too, so weigh their fees and integration work against the controls and testing they remove from every future year.

Tokenisation

Systems holding only tokens, unable to reach card data or reverse the tokens, can leave the CDE. Whatever issues tokens or turns them back into card numbers stays in scope, so a provider's vault usually removes more work than your own.

P2PE and hosted payment pages

The Council states that merchants using a PCI-listed P2PE solution have fewer applicable requirements. Online, a payment page served by a compliant provider keeps card data off your servers, though your website keeps some requirements, under v4.x possibly including quarterly ASV scans. Which SAQ applies to you: eligibility explained covers the questionnaire that follows.

Outsourcing

Outsourcing moves work, not accountability. Requirement 12 still expects a provider list, written agreements, a yearly check of each provider's compliance status and a record of who manages which requirements. Check before signing that the provider's AOC covers the services you use; if it does not, expect that part to be examined in your own assessment.

Your level, your route and the assessor's invoice

Card brands set merchant and service-provider levels, largely by annual transaction count, and for merchants the acquirer applies them; Do you need PCI DSS? Merchant levels, service providers and who decides covers the detail. Mastercard, for example, expects an annual ROC from its highest-volume merchants and requires Level 2 merchants completing SAQ A, SAQ A-EP or SAQ D to engage a QSA or a Council-certified ISA as well. The route changes who tests your controls, not which controls you need.

Service providers carry more: their own levels, one questionnaire (SAQ D for Service Providers), extra requirements and customers who ask for the AOC.

The QSA company, an independent firm qualified by the Council, sets its own fee, which belongs on a separate line. That fee follows scope, sites, sample sizes, on-site or remote fieldwork, retesting and any customised-approach controls, which need testing procedures of the assessor's own design. Where the brands and your acquirer accept an ISA-completed ROC, an ISA saves external days but costs Council training and staff time; Choosing a QSA: what to ask before you sign compares offers.

Quarterly external scans by an Approved Scanning Vendor scale with your internet-facing systems, and a failed quarter needs a rescan. Penetration tests are due at least yearly and after significant change, by a qualified tester, internal or external, who is organisationally independent of the systems tested. Both are priced separately by whoever performs them.

Remediation and internal effort

A gap analysis turns the twelve requirements into a costed work list, as PCI DSS gap analysis: what it covers and what you get describes. Under v4.0.1, the heavier items often include requirements mandatory since 31 March 2025: multi-factor authentication for all non-console access into the CDE, automated log review and control of payment page scripts.

Internal effort is the line most budgets forget. System owners, developers, HR, procurement and the executive who signs the AOC all give time, and then a calendar takes over: daily log reviews, six-monthly access reviews, quarterly scans, yearly tests, training and scope confirmation. Work recorded as it happens costs far less than evidence rebuilt before the assessor arrives; The PCI DSS annual cycle: quarterly scans, annual validation and business as usual covers that rhythm.

What a Sterling quote covers, and what it never includes

Sterling prices from your payment channels, sites, systems, providers, existing controls and validation route, then states everything that is included in writing, listing what is delivered, who does what and what is assumed or excluded. The fee covers scoping and data-flow mapping, the gap analysis, remediation under Design™ (guided) or Drive™ (managed), policies and targeted risk analyses, an internal assessment before the QSA arrives or the SAQ is signed, fieldwork support and the agreed Sustain™ support.

It never includes:

• the QSA's fee, its ROC, or a signature on any SAQ or AOC;
• the technology remediation needs, from MFA to tokenisation services;
• your people's time, which Drive™ reduces but cannot remove;
• a "PCI certificate", because none exists: acquirers and customers rely on the AOC.

PCI DSS compliance cost: questions buyers ask