Nobody can quote you a PCI DSS compliance cost from the name of your company. Two merchants in the same industry, with the same card volume, can be an order of magnitude apart, and the reason has almost nothing to do with the standard.
The number is set by decisions you made before PCI entered the conversation: where card data lives, how your checkout is built, and how flat your network is. This article sets out the seven things that move the figure, the costs that get left out of every budget, and the two architectural moves that reduce it more than any amount of negotiating.
- Scope is the price. Everything else is a rounding error next to how many systems are in it.
- The validation path matters more than the card volume. A questionnaire and a Report on Compliance are different projects.
- The recurring costs outlive the first year: four ASV scans, penetration testing, training, evidence collection.
- Internal hours are the largest line in most budgets and the one nobody counts.
- Taking data out of scope beats securing more of it, every time.
What a PCI DSS compliance cost is actually made of
PCI DSS is a set of controls, not a product. What you pay is the sum of three separate things, and only one of them is a fee anyone can quote you up front.
- 1 Assessment. The QSA engagement, or the internal effort of completing a self-assessment questionnaire honestly.
- 2 Remediation. Everything you have to change to pass. This is the volatile one, and it is invisible until somebody scopes you.
- 3 Operation. The controls that have to keep running afterwards, forever.
A quote that covers only the first is not a PCI DSS compliance cost. It is a line item.
The seven things that move the number
- 1 Scope. The count of systems, applications, networks and people that touch account data or can affect its security. Every requirement is applied to every one of them. A flat network where any workstation can reach the payment server puts the whole estate in scope, and that single fact can multiply the project several times over.
- 2 Validation path. Whether you file a questionnaire or produce a Report on Compliance. This is decided by your level and your acquirer, not by preference, and it changes the depth of evidence for every control.
- 3 Checkout architecture. A hosted payment page the customer is redirected to, an embedded iframe, or a form you render and post yourself. These are three different worlds of obligation, and the third is the expensive one.
- 4 Physical footprint. Card-present terminals bring Requirement 9 with them: device inventories, tamper inspections, training for whoever handles them. Cost scales with the number of locations, not with revenue.
- 5 Segmentation maturity. Segmentation reduces scope, but only if you can prove it works. Each segmentation test is a cost; not having segmentation is a bigger one.
- 6 Remediation debt. Legacy systems that cannot take MFA, applications storing data they should never have stored, logging that was never centralized. This is where budgets break, and it is entirely a function of the past.
- 7 Recurring obligations. Quarterly external scans, internal scans, annual penetration testing, segmentation testing, awareness training, policy review. Year two is cheaper than year one, but it is not free.
The costs that never make it into the budget
These are the lines that turn an approved figure into an overrun. None of them appear on a proposal.
- Internal hours. Engineers pulled off roadmap work to gather evidence, rewrite configurations and sit in interviews. In most projects this exceeds every external fee combined.
- Evidence collection. Screenshots, exports, approvals, sampling. It is unglamorous, it cannot be automated at short notice, and it takes weeks.
- Retests. A penetration test that finds an exploitable vulnerability requires the fix and a retest. Budget for one; you will often need it.
- The lost quarter. A failed ASV scan that is never rescanned clean leaves a hole in your four-quarter record that cannot be filled afterwards.
- Carrying the wrong scope for a year. If scoping is rushed at the start, you pay for the excess every single quarter until the next assessment.
The cheapest assessor is rarely the cheapest project. Scope is where the money is, and an assessor who agrees to an under-scoped assessment is selling you a finding you will pay for later, with interest.
The two moves that actually reduce it
Everything else is marginal next to these, because both of them attack scope rather than controls.
You cannot be assessed on data you do not hold, and you cannot be assessed on a network the cardholder data environment cannot reach.
Stop holding the data. Tokenization replaces the card number with a reference that is worthless if stolen. Redirecting the payment page, or embedding one served entirely by a compliant provider, moves the capture out of your systems. Both have an implementation cost and both reduce the standing obligation permanently.
Segment properly. Isolating the cardholder data environment from the rest of the estate takes work once and reduces what is assessed every year afterwards. It also needs its own test to be credible, which is a real cost, and still cheaper than assessing everything.
Why year one is the expensive one
The first assessment pays for the backlog. Scoping has never been done properly, the policies were written for a different company, and half the controls exist but have no evidence behind them.
From year two the shape changes. The assessment itself is similar, remediation falls away if you kept up, and what remains is the operating cost: the scans, the tests, the training, the evidence calendar. A PCI DSS compliance cost that stays flat year on year usually means somebody is deferring remediation rather than doing it.
Questions that will get you a usable estimate
If you are asking anyone to size this, these are the five that determine the answer. Nobody can price the work without them.
- 1 Has anyone documented where account data actually flows? Not where it is supposed to flow.
- 2 Which validation path has the acquirer confirmed in writing?
- 3 Is the cardholder data environment segmented, and has that been tested?
- 4 How is the payment page served, exactly? Redirect, iframe, or your own form.
- 5 What is the oldest system in scope, and can it take modern authentication?
Two of those answers come from outside the standard. Your merchant level is set by the card brands, and which questionnaire you qualify for depends on how your checkout is built. Settle both before anyone quotes you.
Where we fit
We do not publish a price for this, and anyone who publishes one without seeing your scope is quoting a different company. What we can do is the part that determines the figure.
The quarterly external scan is a fixed, recurring obligation under Requirement 11.3.2, and only a listed Approved Scanning Vendor can attest it. Nordstern holds that listing with global scope, certificate 50955001-01, and the scan has pass criteria of its own. Before that, the scoping work and the evidence calendar sit with PCI DSS consulting inside the wider PCI DSS practice, and the checklist we work from is organized around evidence rather than around the standard. Talk to the team and we will tell you what moves your number.
Sources
- PCI Security Standards Council, document library: PCI DSS v4.0.1 and the Self-Assessment Questionnaire Instructions and Guidelines, which set the validation paths referred to above.
