How Much Does PCI DSS Compliance Cost?

Every organisation aiming to achieve PCI DSS compliance has an area of common concern; what will be the total actual cost of the whole process of achieving and then further maintaining compliance on a regular basis? Estimating the exact cost of a PCI DSS assessment and validation is not an easy task as it requires a complete understanding of the scope of work and all the variables involved in the process. Other than that, the cost of compliance also varies from merchant to merchant and depends heavily upon the nature of the business, annual processed transactions, IT infrastructure, and card storage and processing methods deployed within the organisation.

Creating a Checklist before Calculating Cost is the Key to Correct Cost Estimation

As an organisation seeking the costs associated with achieving PCI DSS compliance, consider the following checklist before you begin:

1. Develop a detailed understanding of the flow of storing, processing and transmitting cardholder data. Cardholder data scanning tools can help determine which areas specifically contain the data and which processes are involved in cardholder data transactions throughout the organisation.
2. Update your network diagram to ensure that none of the cardholder data flow areas go unidentified. A complete network diagram must include all firewalls, switches, routers, intrusion detection systems, servers, laptops, desktops and all other endpoints.
3. Create a complete list of all data flows in your organisation. Here you need to make sure that none of the flow areas are left out and that all organisational assets are put into consideration. This will allow you to identify your organisation’s Cardholder Data Environment (CDE).
4. Document a list of all your organisational assets. It must include all the systems, databases, applications and files in your network along with details of each asset.
5. Develop a list of all the personnel who are directly or indirectly involved in dealing with the cardholder data. These individuals must be identified at all levels of cardholder data flow i.e. during storing, processing or transmitting the cardholder data.
6. Create a list of all third parties that are concerned with the cardholder data environment. These include, but are not limited to, your transaction processors, web hosting providers, POS maintenance vendors, Managed Security Service Providers, etc.
7. Ensure that you have developed a comprehensive information security policy that encircles all the security aspects of the organisation such as access control policy, password control policy, surveillance system audit policy, document security, incident response policy, system and network security and outsourcing policy, to name a few. The information security policy must be communicated, understood and regulated at all levels of the organisation.

The above checklist will serve as a guide to help you determine the costs associated with PCI DSS compliance. If you feel that you are unable to meet the above requirements, get help from a Qualified Security Assessor (QSA) who is specially trained to perform PCI DSS compliance assessments.

Creating a List of all Cost Incurring Activities

Now that you have marked off all the points in the checklist, you need to create a list of all the activities that incur costs associated with PCI compliance. These can be direct cost-incurring internal activities or external activities directly or indirectly taking part in the cardholder data transactions.

Defining the Scope of Cardholder Data Environment (CDE)

This is the first and most important step as without defining the correct scope, achieving PCI DSS compliance is not possible. It would not be wrong to say that as easy as it may sound, defining scope is the most difficult task for even the smallest of organisations. Scoping of CDE can be done both internally and externally. If you decide on doing it internally, you will need to assign this job to someone who has detailed understanding and expertise in cardholder data flow process. Using the documented data flow and developed network diagrams as described above in the checklist, you can determine the extent of the CDE of the organisation. If you are not sure about being able to define the entire scope of CDE, you can also hire an external Qualified Security Assessor or QSA, who has the skills and expertise to interview your staff and map out the cardholder data flow to define the scope. Even if you do it internally, depending on your level and your acquirer’s requirements, you may still need a QSA to validate that all the data flows have been accounted for. The costs associated with a QSA need to be considered as well.

Assessing the CDE for Vulnerabilities

Again, you can choose to perform the assessment internally or with the help of a QSA. To achieve the desired results, it is recommended to seek help from a QSA so that you can get professional gap analysis of the in-scope and out-of-scope activities and also about the vulnerabilities within the system. Assessment of CDE is required to identify all loopholes and vulnerabilities in your data flow process that can pose threat to the security of your cardholder data such as vulnerabilities in computer systems, servers, storage points, etc. Merchants (Levels 2, 3 and 4) and service providers (Level 2) that are not required to submit a Report on Compliance (ROC) can perform an internal assessment through a Self-Assessment Questionnaire (SAQ). SAQ is a validation tool and the type of questionnaire used varies from organisation to organisation and again you can use a QSA to assist with completing the Self-Assessment Questionnaire accurately.

Remediating the Vulnerabilities

In simple terms, remediation means to fix the vulnerabilities. Costs incurred on remediation vary extensively from organisation to organisation and depend upon different remediation paths taken by each. It also depends upon the extent of remediation required for each. At each step of remediation, you will bear the associated costs such as during network scanning with the help of software tools, on-site assessments or self-assessment process, classification and ranking of vulnerabilities in order of priority, application of patches and changes to insecure process, etc.

Performing an Assessment prior to Validation

Before you submit your PCI DSS validation documents, you have to carry out an in-depth assessment. You can do that by investing in the Internal Security Assessor (ISA) program of the PCI Security Standards Council and letting eligible employees, sponsored by your organisation, complete ISA training to perform internal assessments within the organisation. Likewise, you can also hire an external QSA to perform the assessment and present a report on whether you are ready for validation or not.

Validating Compliance

Finally, you are one step away from validating your PCI DSS compliance. Depending on your level, this means submitting a Report on Compliance prepared by a QSA or a completed SAQ, each with its Attestation of Compliance (AOC). Here also, you can either get the help of an ISA or a QSA, depending upon your organisational preferences. Whichever way you choose, costs will be incurred either way.

Maintaining PCI Compliance

Most of the time the maintenance of PCI DSS compliance is overlooked by organisations once compliance is validated. This can increase the yearly costs in the long run as it would require the whole process to be undergone every time compliance is desired. It is important to consider the maintenance as a key stage and undergo proper planning and budgeting for this activity. Validation is repeated every year, and PCI DSS v4.0.1 requires external vulnerability scans by an approved scanning vendor (ASV) at least once every three months. As they say, compliance is not a one-time process, it is an ongoing process which should never stop.

What Drives Assessment and Validation Costs at Each Level

Though remediation costs vary from one organisation to another because of the difference in remediation paths of each, assessment and validation costs depend largely on your level. For compliance with PCI DSS, payment card brands such as Mastercard and Visa have defined two types of organisations, i.e. merchants and service providers. Merchants are entities that accept payment cards of any one of the five founding payment brands of the PCI SSC (American Express, Discover, JCB, Mastercard and Visa) as a payment for goods and services. Service providers are companies that provide services that can have an impact on cardholder data security. Merchants are further broken down into 4 levels whereas service providers are broken down into 2 levels.

In Australia, your acquiring bank sets your merchant level. Westpac’s PCI DSS merchant levels, based on annual Visa or Mastercard transactions, are a typical example:

Visa defines two service provider levels:

• Level 1 service providers store, process or transmit 300,000 or more Visa transactions a year and validate with an annual on-site assessment by a QSA.
• Level 2 service providers handle fewer than 300,000 Visa transactions a year and validate with an annual SAQ D.

The biggest difference in cost comes from how you validate. A Level 1 merchant or service provider pays for an annual on-site assessment and Report on Compliance by a QSA, while organisations at lower levels can usually validate with an SAQ and pay mainly for quarterly scans, remediation and any expert help they choose. Within each level, your costs will rise or fall with the size of your cardholder data environment, the number of third parties involved and how much remediation you need.

For an accurate cost estimate, it is best for you to take help from a Payment Card Industry Data Security Standard Qualified Security Assessor (PCI DSS QSA) who can carry out the complete cost estimation process from the start, customised to your organisational functions and needs.

Frequently asked questions

Is PCI DSS compliance a one-off cost?

No. Compliance has to be validated every year, and PCI DSS v4.0.1 requires external vulnerability scans by an approved scanning vendor at least once every three months. Most organisations also need to confirm their PCI DSS scope at least once every 12 months and, where it applies to them, carry out external penetration testing at least once every 12 months, so budget for these as recurring costs.

Do small Australian businesses have to pay for PCI DSS compliance?

Yes. Every business that accepts card payments is expected to comply, whatever its size. Small businesses are usually Level 4 merchants, so Westpac, for example, asks them to complete an annual SAQ and quarterly vulnerability scans rather than a full QSA assessment. Their costs are mostly scans, any remediation and expert help, and these can be lower if card payments are outsourced to a compliant provider.

Does outsourcing card payments reduce PCI DSS costs?

It can. E-commerce merchants that fully outsource payment processing to a PCI DSS compliant provider may be eligible for SAQ A, which reduces the requirements they need to meet. Since January 2025, SAQ A also asks merchants to confirm their website isn’t susceptible to attacks from scripts that could affect their e-commerce systems. You remain responsible for managing your providers and checking their compliance.

Can a data breach add to PCI DSS costs?

Yes. Westpac, for example, says a data breach or inadequate security controls can lead to financial fines or penalties, and that it may require a merchant to engage a PCI-approved company to carry out a forensic investigation. These costs come on top of the cost of responding to the breach itself.

Do service providers face extra PCI DSS requirements?

Yes. Service providers must meet some requirements that merchants don’t, which adds to their compliance effort. Under PCI DSS v4.0.1 they must confirm their scope at least once every six months, test any segmentation controls at least once every six months and carry out reviews at least once every three months to confirm their security processes are being followed. Visa also expects Level 1 service providers to complete an annual on-site assessment by a QSA.