PCI DSS SAQ vs ROC: Which Route Your US Business Needs

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• A fixed quote

  A fixed quote follows a free gap assessment, so you know the full cost before you commit.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

The outcome. You know which route your US acquirer or customer will accept before you spend a dollar of effort, and you prepare once for either.

PCI DSS can be validated in two broad ways. With a Self-Assessment Questionnaire, your team answers for your environment and signs an attestation. With a Report on Compliance, or ROC, a Qualified Security Assessor examines your environment and writes the report, which carries its own attestation. Both lead to a statement that you meet the same requirements; what differs is who checks, how deeply and who accepts the result.

The PCI Security Standards Council describes QSA companies as independent security organizations it has qualified to validate an entity's adherence to PCI DSS^[2]. Its SAQ bulletin describes questionnaires as validation tools for SAQ-eligible merchants and service providers reporting on their own self-assessment^[3]. Put simply: an SAQ is you reporting on yourself; a ROC is an independent examiner reporting on you.

Neither result lasts forever. Validation repeats on the cycle your acquirer, card brand or customer sets, and your evidence must show how you operate in between.

The practical differences, in general terms. Your acquirer's or customer's instructions decide the details.

The outcome. A written instruction you can plan against, instead of a guess that costs a rework.

Founders often assume the choice is theirs. It is not. The Council's standards page says whether an entity must comply or validate is at the discretion of organizations that manage compliance programs, such as payment brands and acquirers^[1]. It also asks anyone completing an SAQ to contact the receiving party first, to confirm an SAQ is acceptable^[3].

• US merchants. The receiving party is normally the acquiring bank or payment processor.
• US service providers. It may be a card brand, an acquirer, or simply your largest customer, whose procurement team wrote a PCI clause into the contract.

These parties can accept a self-assessment from one vendor and require a ROC from another, and can change position as your volume or role changes. Get the instruction in writing: which route, which version, which documents, by what date.

The outcome. No surprise ROC request three weeks before a contract deadline.

These are patterns from Sterling's experience, not Council or card brand rules:

• A security addendum names it. A US customer's contract requires a Report on Compliance, not a self-assessment.
• Customers rely on you. You are a service provider and your customers lean on your validation for their own.
• Nothing shorter fits. Your environment would need the full-scope questionnaire, and the recipient prefers independent testing.
• Trust has been dented. A past incident or finding has made the recipient wary of self-reporting.
• You want speed in sales. An independent result shortens every future US vendor review.

The last point deserves weight. A ROC demands more than an SAQ, yet for a software vendor one report and its attestation can answer the PCI line in many questionnaires at once. The effort comes up front; the benefit repeats.

The Council publishes a list of qualified QSA companies and advises checking it each time you engage one, because status can change^[2]. In Sterling's experience the assessment runs in five stages:

1. Scoping. The QSA confirms where account data is stored, processed or transmitted and which systems can affect it. Errors here cost most, because a wrong boundary means a repeat. 2. Evidence request. Policies, diagrams, configuration evidence, logs, scan results, review and training records. 3. Testing. Interviews, configuration inspection and sampling against each requirement. 4. Findings and remediation. Gaps are noted; depending on the recipient, they may need closing before the report is final. 5. Report and attestation. The QSA writes the ROC on the Council's template and the signatories sign.

The Council released its ROC template for v4.0.1 in August 2024^[6], so a report written today should follow it. Three things make the difference: a scoping diagram that survives questioning, evidence gathered before it is requested, and a named owner for each requirement.

Version 4.x added a second way to meet requirements. The defined approach follows each requirement and testing procedure as written; the customized approach lets you design your own control against a requirement's stated objective. The Council says it is meant for risk-mature organizations, needs more initial effort and documentation, and is not a workaround for missing a requirement^[4]. An entity wanting it should consult its compliance-accepting entity, and the QSA must understand the custom controls well enough to derive tests^[4]. For organizations new to PCI DSS, the Council suggests the defined approach^[5]. Most US start-ups should stay there.

The outcome. A ROC delivered by the date in your US customer's contract, with Sterling running the preparation for you.

1. Gap assessment against the current 4.x text. 2. Scope reduction where architecture allows, for example tokenizing so card numbers never reach your systems. 3. Process gaps first: policies, access reviews, change control and incident response take calendar time to prove. 4. Internal review that mirrors the QSA's likely testing, so surprises arrive early. 5. QSA scheduling with enough lead time for your customer's or acquirer's date.

A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required; for SAQ-eligible merchants and service providers we prepare and support the SAQ. You deal with Sterling from first scoping call to final submission, and the people who consult on your controls never assess you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements. A fixed quote follows a free gap assessment.

This is Sterling's recommendation, not a requirement of the PCI Security Standards Council.

• Get the acquirer's or customer's accepted route in writing.
• Merchant with a hosted checkout? Plan for a questionnaire and keep scope small; see SAQ types explained.
• Service provider? Assume key US customers will eventually require a ROC, and run the gap assessment now so evidence builds as you grow.
• Use the defined approach for your first validation.
• Keep one scoping diagram and one evidence calendar for either route.
• If software is your product, read PCI DSS for SaaS; the PCI DSS hub shows the standard's overall structure.

Facing a PCI clause in a US contract? Get a proposal sized to your route and deadline.

PCI DSS is validated in one of two ways, depending on how you handle card data and what your acquirer or card brand requires. A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required^[1]; for SAQ-eligible merchants and service providers we prepare and support the SAQ.

Either way, you work with Sterling from first scoping call to final submission. We coordinate:

• scoping: where card data is stored, processed or transmitted, and how to shrink that footprint;
• a gap assessment against the current version of the standard;
• the policies, procedures and technical control improvements needed to close the gaps;
• evidence collection and an internal review before anyone external looks at your environment;
• the assessment itself, including scheduling, evidence requests and follow-up questions.

What you receive is a validation of compliance, documented in the form your acquirer or card brand accepts. Our experts bring 30+ years of experience, and Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.

^[1] Become a Qualified Security Assessor (QSA). PCI Security Standards Council. accessed October 23, 2026.

• PCI DSS: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• PCI DSS SAQ Types Explained: Which One Your US Business NeedsUnited States
• PCI DSS for US SaaS Companies: Scope, Roles and Buyer RequestsUnited States
• PCI DSS 4.0.1 Requirements in Plain English for US BusinessesUnited States
• Sterling in the United StatesUnited States

1. PCI Data Security Standard (PCI DSS). PCI Security Standards Council. accessed October 23, 2026.

2. Qualified Security Assessors. PCI Security Standards Council. accessed October 23, 2026.

3. Bulletin: SAQs for PCI DSS v4.0 are Now Available. PCI Security Standards Council. accessed October 23, 2026.

4. PCI DSS v4.0: Is the Customized Approach Right For Your Organization?. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

5. Eight Steps to Take Toward PCI DSS v4.0. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

6. PCI SSC Releases ROC Template for PCI DSS v4.0.1. PCI Perspectives Blog, PCI Security Standards Council. accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.