PCI DSS timeline: how long compliance takes, stage by stage, from scoping to the AOC

How long PCI DSS compliance takes, in one paragraph

Plan in months. A small merchant with an outsourced payment page can finish a first validation in about three; a service provider with several data centres, legacy platforms and many vendors should expect nine or more. The gap is rarely effort alone: PCI DSS asks for controls that repeat on a schedule, and an assessor samples their output, so those routines must have run before the assessment can close. Where a contract or card brand programme sets a date, the plan works backwards from it.

For the price side, see PCI DSS compliance cost: what moves the price, and for each validation document, PCI DSS validation step by step: ROC, SAQ and AOC.

The seven stages and their realistic ranges

These are planning ranges for a first validation. Stages overlap.

The four factors that move the calendar most

Scope size

Every system component that stores, processes or transmits cardholder data, and everything connected to it, sits inside the assessment. A wide scope multiplies the evidence required and the sample a QSA draws. The fastest projects are those that shrink the environment first, which is the subject of PCI DSS scoping and segmentation: shrinking the CDE.

Segmentation

Segmentation is optional, but without it the whole network is in scope. Designing it takes firewall changes; proving it takes a segmentation test, and a failure sends the team back to the rule base. Allow at least one full cycle of design, change, test and retest before the assessment.

Legacy systems

Platforms that cannot support current authentication, logging or patching most often stretch remediation. Replacement, isolation or a compensating control each take time to decide and document. Compensating controls also need assessor review time; PCI DSS compensating controls and the customised approach explains what that review involves.

Third parties

Hosting providers, gateways and managed security firms each need a current AOC and an agreed split of responsibilities. Chasing these can take weeks, and a provider without an AOC may have to be replaced or brought into your own assessment.

SAQ route versus ROC route: how the timelines differ

Which route applies is set by your acquirer and, for service providers, by the card brands and your customers' contracts; the rules are explained in Do you need PCI DSS? Merchant levels, service providers and who decides and Which SAQ applies to you: eligibility explained.

On the SAQ route your organisation assesses itself and an executive signs the attestation. With no assessor to book and no report review, the last two stages can shrink to a few weeks; the preparation cannot. The controls the questionnaire lists still have to be in place and running, the quarterly scans still apply where the SAQ includes them, and an attestation signed before the controls exist puts the organisation, and the executive whose signature is on it, in a difficult position with the acquirer.

On the ROC route a QSA company tests each requirement, interviews the people who run the controls and writes a Report on Compliance, which then passes through the QSA company's own quality review before the AOC is signed. Well-organised evidence is the variable you control, and it shortens fieldwork.

Why some requirements need evidence over time

A document can be written in a day; a routine cannot be proved in a day. Several requirements are defined by frequency, and the assessor looks for their trail:

• Quarterly scans. External scans by an ASV and internal vulnerability scans are expected every three months, with high-risk findings resolved and rescanned.
• Daily log review. Security events must be reviewed every day, and the evidence is a history of reviews and the actions they triggered.
• Recurring tests. Penetration and segmentation tests and the scope confirmation recur on a cycle and after significant change.

For the quarterly scans, the PCI Security Standards Council states that an ongoing compliant programme shows passing scans for each of the previous four quarters. For an initial assessment the standard allows fewer, provided the assessor confirms that the most recent scan passed, that a documented procedure requires scanning every three months, and that earlier findings were fixed and rescanned. So a first assessment needs at least one clean scan and a working routine before fieldwork; after that, a missed quarter cannot be recovered. Run the first ASV scan early in remediation, while failures can still be fixed.

QSA and tester lead times

QSA companies schedule assessors weeks and often months ahead,. Three habits help. Choose the QSA company once the gap analysis has shown the size of the work, and agree provisional fieldwork dates then; Choosing a QSA: what to ask before you sign covers the selection. Book the penetration test for a date after the main remediation, with a retest window already reserved. Ask how long the QSA company's report quality review takes, because the AOC waits for it.

A worked calendar: a mid-sized e-commerce service provider

Take a provider running a hosted checkout platform for online retailers from two cloud regions, with an older reporting database holding historical card numbers and six third parties. A customer contract requires a ROC and AOC. One realistic plan runs about eight months.

Purging the historical data rather than protecting it, and booking the assessor in month two, saved the most time. Later cycles are far shorter; see The PCI DSS annual cycle: quarterly scans, annual validation and business as usual.

PCI DSS timeline: questions buyers ask