Free guide · PCI DSS v4.0.1

What PCI DSS compliance actually costs

There is no list price for PCI DSS compliance, because cost tracks scope rather than company size. The spend falls into four buckets: validation effort (SAQ or ROC), mandatory testing (quarterly ASV scans, annual penetration testing where applicable), remediation of gaps, and ongoing operations. Cutting scope cuts every bucket at once.

Find your SAQ All guides

What is free

Selecting the correct SAQ, and completing a self-assessment for readiness — on this platform, at no cost.

The PCI DSS standard, SAQ documents and supporting guidance from the PCI SSC Document Library.

Scope reduction itself: switching to a hosted payment page or a validated P2PE solution is usually a configuration and contract decision, not a licence purchase.

What is normally paid

Quarterly external vulnerability scanning by an Approved Scanning Vendor, where you have internet-facing systems in scope.

Annual internal and external penetration testing under Requirement 11.4, where applicable to your SAQ.

A QSA engagement where you need a signed SAQ and Attestation of Compliance, or a Report on Compliance.

Tooling you may not already have: log management with automated review, MFA, file integrity or change detection, anti-malware.

What drives the number up

Electronic storage of account data — it removes every short-form SAQ and pulls encryption, retention and key management into scope.

A flat network where the whole estate is connected to the cardholder data environment.

Multiple payment channels that cannot each satisfy the same SAQ criteria.

Evidence that does not exist yet, which turns an assessment into a remediation programme.

How to reduce it honestly

Outsource acceptance so the payment page comes only and directly from a compliant provider.

Segment the cardholder data environment and validate the segmentation by testing.

Delete legacy card data and stop capturing what you do not need.

Get scope and SAQ selection right before you buy anything — the wrong SAQ is the most expensive mistake here.

Turn the reading into an answer

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Written by Haumaru Whānau QSAs. PCI DSS content paraphrased from PCI DSS v4.0.1 and PCI SSC published guidance; payment brand programmes are set by the brands and your acquirer. Independent summary; not endorsed by PCI SSC.