PCI DSS for US MSPs and IT Services Firms: What Merchant Clients Require

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• A fixed quote

  A fixed quote follows a free gap assessment, so you know the full cost before you commit.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

The outcome: a clear answer on whether your services are in PCI DSS scope, and current validation evidence your US merchant clients can hand straight to their assessor or acquirer. We do the preparation; a Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required, and for SAQ-eligible merchants and service providers we prepare and support the SAQ.

Most US MSPs never touch a card number. Their clients do, and that is enough. The PCI Security Standards Council states that PCI DSS applies to entities that store, process or transmit cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment, including service providers^[1]. If your technicians run a US retailer's firewalls, servers, point-of-sale network or payment application, you can affect that environment.

• US merchant questionnaires. Clients ask whether you are a third-party service provider and for a current Attestation of Compliance; the Council's FAQs address relying on one^[4].
• US contracts. Clauses requiring written acknowledgement of the PCI DSS requirements you manage.
• Your client's assessor. Requests for your access approvals and session logs during their own assessment.
• US RFPs. PCI DSS validation scored or mandatory for providers with access to payment systems.

The outcome: you validate once, by the right route, against the right version.

• Version. The Council's document library lists PCI DSS v4.0.1^[5]. We work to the version your assessor or acquirer specifies.
• Route. Whether you need a QSA assessment or an SAQ is decided by how the card brands and your clients' acquirers classify your service. The Council publishes SAQs for SAQ-eligible merchants and service providers^[3]. We confirm the route with the requiring party before any evidence is collected.
• Coverage. Clients relying on your validation want it current and covering the services they buy^[4]. What we recommend for most US MSPs (Sterling's recommendation): validate the specific service lines clients use, not a generic company description.

The outcome: a scope no larger than it needs to be, agreed with whoever validates it.

For each service you sell to clients who take payments, we sort it into one of three groups.

• Handles card data. Hosted payment apps, call recording that captures spoken card numbers, hosted order entry. In scope.
• Manages in-scope systems. Firewall management, patching, remote administration, log monitoring, scanning and backup of a client's payment environment. In scope, even if no card data reaches you.
• No connection. Office help desk and collaboration tools. Out, provided the separation is real and written down.

Shrinking scope usually costs less effort than defending a broad one: dedicated staff and jump hosts for payment work, strong segmentation, and client-side tokenization or validated point-to-point encryption where it fits^[3].

The outcome: one evidence pack answers every client's assessor the same way. These are Sterling's plain-English themes, not the standard's numbered requirements.

1. Responsibility matrix. For every client: which requirements you meet, which they meet, which are shared. Assessors ask for it first. 2. Secure remote access. Jump points, MFA, unique accounts and session logging; shared vendor logins are the classic finding. 3. Segmentation and firewall rules. Reviewed on a schedule, changes approved and recorded. 4. Need-based access. Ends when the need ends. 5. Patching and scanning. Timely updates and a record of how findings were closed. 6. Logging. Protected, reviewed and kept for the period the standard requires. 7. Hardened configuration. No vendor-default passwords. 8. Incident response. A tested plan with fast client notification.

The outcome: we clear these before anyone external looks.

• "We never see cards, so we're out." Managing the payment network is enough.
• Whole company in scope. Segregating payment work is quicker.
• No responsibility matrix. Every client's assessor asks the same questions and gets different answers.
• Year-end scramble. Log review, access review and scanning run all year.

The outcome: a successful, on-time validation with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. The people who consult never audit you.

1. Free gap assessment and scoping. We map services, card-data flows and the validation your clients expect. A fixed quote follows a free gap assessment. 2. Scope reduction. Segmentation, dedicated jump hosts, separate staff pools. 3. Remediation. We prepare policies, procedures and the responsibility matrix, and guide your engineers through closing gaps against PCI DSS v4.0.1^[5]. 4. Evidence and internal review. Effivity, our GRC automation platform, tracks tasks and evidence. 5. Validation. A QSA performs the assessment and Report on Compliance where one is required^[2]; for SAQ-eligible merchants and service providers we prepare and support the SAQ^[3]. We coordinate everything; you deal with Sterling alone.

A US client waiting on your Attestation of Compliance? Choose Get started and a Sterling expert will respond.

PCI DSS is validated in one of two ways, depending on how you handle card data and what your acquirer or card brand requires. A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required^[1]; for SAQ-eligible merchants and service providers we prepare and support the SAQ.

Either way, you work with Sterling from first scoping call to final submission. We coordinate:

• scoping: where card data is stored, processed or transmitted, and how to shrink that footprint;
• a gap assessment against the current version of the standard;
• the policies, procedures and technical control improvements needed to close the gaps;
• evidence collection and an internal review before anyone external looks at your environment;
• the assessment itself, including scheduling, evidence requests and follow-up questions.

What you receive is a validation of compliance, documented in the form your acquirer or card brand accepts. Our experts bring 30+ years of experience, and Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.

^[1] Become a Qualified Security Assessor (QSA). PCI Security Standards Council. accessed October 23, 2026.

• PCI DSS: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• PCI DSS SAQ vs ROC: Which Route Your US Business NeedsUnited States
• PCI DSS SAQ Types Explained: Which One Your US Business NeedsUnited States
• SOC 2 for US MSPs and IT Services Firms: What Buyers RequireUnited States
• ISO/IEC 27001 for US MSPs and IT Services Firms: What Clients RequireUnited States
• Sterling in the United StatesUnited States

1. PCI Data Security Standard (PCI DSS): who it applies to and where to find qualified assessors. PCI Security Standards Council. accessed October 23, 2026.

2. Become a Qualified Security Assessor (QSA). PCI Security Standards Council. accessed October 23, 2026.

3. Maintaining payment security: SAQs for SAQ-eligible merchants and service providers. PCI Security Standards Council. accessed October 23, 2026.

4. PCI SSC FAQs (including third-party service provider Attestation of Compliance questions). PCI Security Standards Council. accessed October 23, 2026.

5. Document Library (PCI DSS v4.0.1 listed as featured document). PCI Security Standards Council. accessed October 23, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.