QSA assessment cost
Direct-processing merchants need annual QSA assessments; SAQ merchants self-assess. QSA assessment cost depends on environment complexity, transaction volume, and the QSA firm.
| Merchant Level | Volume | Assessment Type | Cost (2026) |
|---|
| Level 1 | Over 6M Visa transactions/year | Annual on-site QSA assessment + ROC | $50,000 - $250,000 |
| Level 2 | 1M-6M Visa transactions/year | Annual SAQ + quarterly network scan | $5,000 - $25,000 internal |
| Level 3 | 20K-1M ecommerce or 1M other | Annual SAQ + quarterly network scan | $2,000 - $10,000 internal |
| Level 4 | Under 20K ecommerce or other thresholds | Annual SAQ + quarterly network scan | $1,000 - $5,000 internal |
Source: PCI SSC merchant level definitions and QSA pricing surveys, 2026.
How to reduce PCI scope
Three scope-reduction levers cut cost dramatically: tokenization, network segmentation, and validated P2PE solutions. Tokenization replaces PAN with a token that has no value outside the merchant's environment, eliminating that system from PCI scope. Network segmentation isolates the CDE from the rest of the corporate network. Validated P2PE solutions move the merchant's CHD handling into a PCI-listed hardware and software combination that dramatically reduces SAQ scope.
Internal links
See related compliance guides: PCI DSS compliance cost, Cyber insurance application checklist, and Stripe vs Adyen vs Braintree.
FAQs
See FAQ section above for PCI DSS 4.0 deadline guidance, future-dated requirements detail, SAQ selection, QSA assessment cost, and scope-reduction tactics.
PCI DSS 4.0 documentation requirements
PCI DSS 4.0 documentation requirements expanded versus v3.2.1. New requirements include targeted risk analyses for customized approaches and updated evidence for emerging technologies.
| Document | Purpose | Update Frequency |
|---|
| System Security Plan (SSP) | Documents all security controls in scope | Annual review + change-driven updates |
| Network Diagram | Shows CDE boundaries and data flows | Annual review + change-driven updates |
| Information Security Policy | Governs all security practices | Annual review |
| Risk Assessment | Documents threats, vulnerabilities, likelihood, impact | Annual |
| Penetration Test Report | Documents pen test methodology, findings, remediation | Annual + significant changes |
| Targeted Risk Analyses | Justifies customized approaches for specific requirements | Per customized requirement |
Source: PCI SSC documentation requirements, 2026.
FAQ expansion
Q: Does PCI DSS 4.0 require annual penetration testing? Yes. PCI DSS 4.0 requires penetration testing at least annually and after any significant change to the CDE. Tests must cover all CDE components and perimeter networks, follow a defined methodology, include both application and network layers, and result in a documented remediation plan.
Q: What is a customized approach in PCI DSS 4.0? A customized approach allows organizations to meet the intent of a requirement using alternative methods. Each customized approach requires a targeted risk analysis that demonstrates the alternative provides equivalent or greater security. Customized approaches were introduced in PCI DSS 4.0 to allow innovation while maintaining security intent.
Q: Can small merchants self-assess PCI DSS? Yes. Most Level 2-4 merchants self-assess using the appropriate SAQ (A, A-EP, B, B-IP, C-VT, C, P2PE, D). SAQ completion does not require a QSA. Level 1 merchants (over 6M Visa transactions/year) must complete an annual on-site QSA assessment and submit a Report on Compliance (ROC).
Fazlur Rahman
