PCI DSS compliance, scoped and delivered
We map how card data moves through your business, scope the right Self-Assessment Questionnaire with your acquiring bank, and close the gaps against PCI DSS v4.0.1. Fixed fee agreed up front, with QSA assessment support for Level 1 merchants.
What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) is the global security standard maintained by the PCI Security Standards Council for any organisation that stores, processes or transmits cardholder data. The current version is v4.0.1. Compliance is validated to your acquiring bank, usually through a Self-Assessment Questionnaire and, for the largest merchants, an assessment by a Qualified Security Assessor.
Who this is for
When PCI DSS compliance is the ask
PCI DSS obligations arrive through your merchant agreement, not through legislation. If any of these sound familiar, this is the engagement.
Your acquiring bank has asked for an Attestation of Compliance or a completed Self-Assessment Questionnaire.
E-commerce growth is moving you towards a higher merchant level, with stricter validation attached.
A breach, fraud spike or card brand notice has put your merchant account under review.
You take card payments online, in store or over the phone and have never formally assessed against the standard.
You want to shrink your cardholder data environment with tokenisation or a hosted payment page before the next assessment.
What you receive
What the engagement includes
Everything your acquiring bank or assessor will ask for, built and evidenced before they arrive.
Card data scoping
A map of how cardholder data enters, moves through and leaves your environment, and confirmation with your acquiring bank of which SAQ applies. Scope is the decision that most affects cost, and a small, defensible cardholder data environment is cheaper to protect.
Scope reduction
Tokenisation, hosted payment pages and network segmentation that shrink the cardholder data environment before controls are built, so you validate against a smaller target every year.
Gap assessment
Your current controls benchmarked against the 12 requirements of PCI DSS v4.0.1, with a ranked remediation plan that separates what blocks validation from what carries real risk.
Remediation & implementation
The policies, configurations and controls your SAQ or assessment asks for, implemented with your team and your IT provider, with evidence collected as we go rather than reconstructed at the end.
SAQ completion & attestation
The correct SAQ completed accurately, the Attestation of Compliance signed off, and both submitted to your acquiring bank in the format they expect.
QSA assessment support
For Level 1 merchants, we prepare the evidence, help you engage a Qualified Security Assessor and sit with you through the Report on Compliance until it is accepted.
The process
How the engagement runs
Most small and mid merchants reach validation in one to three months, depending on the gaps found at assessment. Level 1 merchants should allow longer, because Qualified Security Assessor booking lead times affect the end date.
Weeks 1–2
Scoping
Card data flows mapped, the cardholder data environment defined and the applicable SAQ confirmed with your acquiring bank. Scope reduction opportunities are identified here, where they are cheapest to act on.
Weeks 2–4
Gap assessment
Current controls assessed against the 12 requirements of PCI DSS v4.0.1. You get a ranked remediation plan and a fixed-fee quote for the work that follows.
Months 1–3
Remediation
Segmentation, MFA, vulnerability management, logging and policy work, implemented with your team. The size of this phase depends on the gaps found, not the calendar.
Validation
SAQ or QSA assessment
For most merchants, the completed SAQ and Attestation of Compliance go to the acquiring bank. Level 1 merchants go through a Report on Compliance with a Qualified Security Assessor, with us alongside.
Ongoing
Staying compliant
Validation repeats annually and external vulnerability scans run quarterly. We hand over a compliance calendar your team can run, or run it for you.
Already assessed against PCI DSS v3.2.1 or v4.0? Both versions are retired and v4.0.1 is the only active version of the standard. The path forward is an assessment against v4.0.1, and the controls you already run still count towards it.
Pricing
What PCI DSS compliance costs
One fixed consulting fee, quoted in writing after the gap assessment. No hourly billing.
The total cost of compliance has three lines, and only one of them is ours: our fixed consulting fee, any external validation fees (an Approved Scanning Vendor for quarterly scans, or a Qualified Security Assessor for a Level 1 assessment, both paid to them), and your own team's time. The consulting fee is scaled to the size of your cardholder data environment and the SAQ involved, which is why scope comes before price.
Every engagement starts with a cybersecurity gap analysis: you get a ranked remediation plan and a fixed quote for the work. If you want a read on where you stand first, the free cybersecurity gap assessment takes a few minutes.
How validation works
Compliance flows through your acquiring bank
PCI DSS is maintained by the PCI Security Standards Council, but it reaches you through the card brands and your merchant agreement. In practice, your acquiring bank tells you how to validate: for most Australian small and mid merchants that means completing the right Self-Assessment Questionnaire and closing the gaps against it. Only Level 1 merchants need an annual Report on Compliance from a Qualified Security Assessor.
Consultants prepare you; assessors attest you. We sit on the preparation side and never issue attestations ourselves, so the validation your bank accepts means something. If your volume puts you in QSA territory, we prepare the evidence, help you engage an assessor and manage the findings through to an accepted Report on Compliance. Our PCI DSS framework guide explains the merchant levels and questionnaire types in detail.
Why CyberNinja
Why organisations choose us
Scope first, build second
We shrink the cardholder data environment before building controls. A smaller scope means a shorter SAQ, less remediation and a lower compliance cost every year after the first.
Independent advice
We hold no reseller agreements and take no vendor margin, and we never issue attestations ourselves. The advice you get is the advice that fits you.
Fixed scope, fixed fee
The engagement is scoped with you after the gap assessment and quoted as a fixed fee in writing. No hourly billing, no surprise extras.
One security programme
PCI DSS controls overlap heavily with ISO 27001 and Essential 8. We build controls once so they serve every framework you answer to, and our vCISO service can run the ongoing cycle.
Want the standard itself first? Our PCI DSS v4.0.1 guide for Australian businesses covers what changed from v4.0 and what it means for your merchant agreement, and the knowledge base goes requirement by requirement.
FAQ
PCI DSS compliance FAQs
Prefer to read up first? Browse our Knowledge Base for compliance guides and articles.
Ready to get PCI DSS compliant?
Tell us what your acquiring bank has asked for and when they need it. We will scope the work and give you a fixed price, so you know the cost before you commit.