If you need a Qualified Security Assessor for PCI DSS, do not budget from transaction volume alone. The larger cost driver is the environment the assessor must actually test: payment channels, systems touching the cardholder data environment, locations, segmentation, third parties, evidence quality, and whether penetration testing or readiness work sits inside the quote.
One provider’s published examples list $45,000–$60,000 for the assessment of a multi-channel retailer with 10 locations, and $100,000–$150,000 for a complex multi-business-unit ROC. These are that provider’s scenarios, not PCI SSC fees, merchant eligibility decisions or market-wide averages. Required testing and other excluded work must be priced separately unless explicitly bundled.
The first money-saving question is therefore not, “Which QSA is cheapest?” It is: Do we need a QSA-led ROC at all, and exactly what must be inside that assessment? Confirm that with your acquirer or other compliance-accepting entity before requesting quotes.
Table of Contents
The Budget Decision Starts With ROC vs SAQ
A merchant that needs a full Report on Compliance is buying a materially different service from a merchant eligible to complete a Self-Assessment Questionnaire. Treating both as “PCI audits” makes quote comparisons almost useless.
The current PCI DSS standard is PCI DSS v4.0.1. Its future-dated requirements have been effective since March 31, 2025, so a 2026 assessment should not be priced or scoped as though those controls were still optional future work.
| Validation situation | What you may be buying | Budget implication |
|---|---|---|
| Merchant eligible for an SAQ and permitted to self-assess | Internal assessment, possibly with limited advisory support | A full QSA assessment fee may be unnecessary |
| Merchant using an SAQ but needing independent assistance or validation | QSA advisory or QSA-assisted assessment | Cost depends heavily on SAQ type and requested assurance |
| Merchant required to produce a ROC | Formal PCI DSS assessment and ROC | Expect substantially more assessor testing and reporting effort |
| Merchant with multiple channels, locations, entities, or complex CDEs | Broader ROC, sampling, interviews and technical validation | Cost can move well into the high five figures or beyond |
PCI SSC itself does not decide which reporting method your organization must submit. Compliance-accepting entities, typically payment brands and acquirers, determine the validation and reporting method. That distinction can change a budget by tens of thousands of dollars.
For example, Mastercard’s current Site Data Protection program places merchants into validation levels and requires an annual ROC for Level 1 merchants, while lower levels generally use SAQs subject to the program’s additional rules. Your own acquirer should still confirm the route that applies to your merchant account.
What Does a PCI DSS QSA Assessment Cost in 2026?
There is no PCI SSC price schedule for merchant QSA engagements. QSA companies price their own services, and many do not publish standard rates because two merchants processing similar transaction volumes can create radically different assessment workloads.
One useful public reference comes from a QSA service provider publishing detailed 2026 pricing scenarios. Its PCI DSS pricing examples include the following figures:
| Published example | Assessment scope | Published planning range |
|---|---|---|
| Mid-sized retailer ROC | Multiple payment channels, internal cardholder data, networks and 10 physical locations | $45,000–$60,000 for the assessment |
| Penetration test in that retailer example | Separate PCI-related penetration testing | $15,000–$20,000 before the example’s bundled discount |
| Complex enterprise ROC | 10+ business units, multiple payment channels and multiple cardholder data environments | $100,000–$150,000 |
These numbers are best used as scenario anchors, not a universal QSA price list. They belong to one provider’s published model, and another QSA may structure scope, staffing, travel, retesting and technical testing differently.
They do illustrate the pattern that matters: the price does not rise neatly with card transaction count. It rises with assessment effort.
The Six Variables That Change a QSA Quote Most
Before asking three QSA firms for prices, describe these six variables consistently. Otherwise, you may receive three numbers for three different projects.
1. Cardholder Data Environment Size
A merchant with a handful of tightly isolated PCI systems creates less assessor work than one with hundreds of servers, workstations, databases, security appliances and cloud resources connected to the cardholder data environment.
Ask your team for an actual inventory of in-scope system components before requesting a quote. “We have 500 employees” tells the QSA much less than “the CDE contains 24 servers, two payment applications, 18 network devices and one segmented cloud environment.”
2. Number of Payment Channels
Card-present retail, e-commerce, telephone payments, recurring billing and other payment flows may introduce different systems and controls. Adding another channel can therefore expand interviews, diagrams, sampling and technical evidence even when total transaction volume barely moves.
3. Segmentation and Scope Quality
Good segmentation can keep ordinary corporate systems outside the CDE. Poorly documented segmentation can do the opposite, because an assessor needs evidence that the boundary actually works.
This is one reason scope work can have unusually high financial value. Removing twenty irrelevant systems from an annual assessment can save effort not only this year, but during every subsequent validation cycle.
4. Locations, Business Units and Legal Entities
Multiple stores do not automatically mean every store receives identical fieldwork, but more locations can expand sampling and coordination. Separate business units, acquired companies, international sites and independently managed payment stacks can add far more effort than a simple location count suggests.
5. Evidence Readiness
A mature merchant can hand the assessor current network diagrams, data flows, asset inventories, policies, risk analyses, access-control evidence, scan results, penetration-test reports and responsibility records without a treasure hunt. A merchant that starts locating owners only after fieldwork begins creates more assessor time and more internal labor.
Evidence readiness does not make missing controls disappear. It does make the assessment less expensive to administer.
6. What the Quote Includes
Two proposals that both say “PCI DSS ROC” may still be thousands of dollars apart because one includes technical testing, remediation validation and repeat reviews while the other prices them separately.
Use This Budget Model Instead of a Single QSA Number
A safer PCI budgeting model separates the formal assessment from everything needed to become assessable.
Realistic annual PCI budget = QSA assessment + required security testing + remediation + internal labor + external tools/services + travel or special fieldwork + contingency for scope change
This matters because the assessor’s invoice can be the smaller half of a difficult first-year PCI project.
| Budget component | Question to ask | Common reason it grows |
|---|---|---|
| QSA assessment | Exactly what systems, locations and requirements are being assessed? | Scope expansion or additional sampling |
| Readiness work | Is readiness included or contracted separately? | Immature documentation or uncertain scope |
| Penetration testing | Is required testing included in the assessment price? | Multiple networks, applications or segmentation boundaries |
| ASV scanning | Are Approved Scanning Vendor services included? | Additional external assets or separate provider contract |
| Remediation | Who pays to implement missing controls? | Logging, authentication, segmentation or application changes |
| Retesting | How many verification cycles are included? | Controls that fail on the first review |
| Internal labor | Which teams must gather evidence and attend interviews? | Distributed ownership and manual evidence collection |
| Travel and onsite work | Is travel included or reimbursed separately? | Multiple physical locations or countries |
For a first assessment, keep remediation money outside the QSA fee rather than assuming the assessor’s quote represents the complete cost of becoming compliant.
Worked comparison: the lower headline quote can cost more
This is an invented arithmetic example, not a provider quote or market rate. Assume both proposals cover the same accepted ROC scope and deadline. Proposal A lists $35,000 for assessment, but adds $10,000 for required testing, $3,000 travel and $2,000 for one agreed revalidation cycle: $50,000. Proposal B includes those items at $45,000 and adds $2,000 travel: $47,000. Under these assumptions B costs $3,000 less.
Replace every figure with dated written terms. If testing or revalidation is unnecessary for your engagement, remove it from both comparisons. If a necessary item is “TBC,” the total is incomplete; do not enter zero. Compare currency, tax treatment, evidence deadlines and the same number of review cycles before selecting either proposal.
| Check | How to use it |
|---|---|
| First-year payable total | Assessment + required excluded services + agreed expenses + applicable tax; count a bundled service only once. |
| Internal effort | Estimate your own staff hours separately. A cheaper proposal can shift evidence preparation to your team. |
| Scope gate | Confirm the required validation route with the compliance-accepting entity before applying the cost comparison. Price cannot make an unsuitable route acceptable. |
A Narrow ROC Can Cost Less, but Do Not Self-Declare the Scope
Some merchants have environments that resemble one of the narrower SAQ use cases even though another party requires a ROC. That can create an opportunity to reduce assessment effort, but there is a large trap here.
PCI SSC updated FAQ 1331 in August 2026 to clarify that merchants should not simply use SAQ eligibility criteria as their own shortcut for deciding which PCI DSS requirements apply in a ROC. The approach needs to be explicitly reviewed, discussed and agreed with the merchant’s compliance-accepting entity.
In practical budget language: do not request a cheap “SAQ-sized ROC” and assume your acquirer will accept it later. Get the reporting method and any reduced-applicability approach confirmed before you sign the QSA statement of work.
That one email can prevent an expensive second assessment.
What a QSA Quote Should Say Before You Compare Prices
A useful proposal should let you reconstruct what the assessor believes your environment looks like. If you cannot do that from the statement of work, the headline fee has very little purchasing value.
- Validation deliverable: ROC, AOC, QSA-supported SAQ, readiness report or another clearly named deliverable.
- PCI DSS version: PCI DSS v4.0.1 for a current assessment.
- In-scope payment channels: retail, e-commerce, MOTO and any other flows.
- Environment: systems, applications, networks, cloud environments and major third parties included.
- Locations: sites considered in scope and expected fieldwork or sampling.
- Technical testing: whether penetration testing, segmentation testing or ASV scanning is included.
- Remediation verification: how many review or retest cycles are included.
- Travel: whether expenses are included, capped or billed separately.
- Scope changes: what triggers a change order.
- Schedule: assumptions about evidence delivery, interviews and reporting.
Normalize those items before selecting a provider. A $35,000 quote plus separately billed testing, travel and retesting may cost more than a $45,000 engagement that includes them.
What You Can Do Internally Before Paying a QSA
Merchants often pay assessor rates for questions their own teams could have resolved first. A short internal scoping exercise can make the first QSA conversation much more productive.
- List every way customers can pay by card.
- Draw where cardholder data enters, travels, is stored and exits.
- Identify every system that stores, processes or transmits payment account data.
- Identify systems that can affect the security of those systems.
- List payment processors and other third-party service providers.
- Document segmentation boundaries rather than merely asserting that segmentation exists.
- Ask your acquirer which validation method it expects.
If that exercise reveals that you qualify for an SAQ and your acquirer accepts self-assessment, buying a full QSA-led ROC simply for reassurance may be poor value.
If the exercise reveals multiple CDEs, poorly understood data flows or disputed scope, paying for a focused readiness or scoping engagement before formal assessment may be cheaper than discovering the same problems halfway through a ROC.
Where Paying More for a QSA Is Rational
The lowest quote is attractive only when it covers the work you actually need. Paying more can make sense when the additional fee buys something that reduces execution risk.
- The assessor has relevant experience with your payment architecture, such as retail, large e-commerce, hospitality or multi-cloud environments.
- A senior QSA stays materially involved rather than appearing only for kickoff and signature.
- The scope and sampling approach are explained before contracting.
- Remediation validation is included rather than metered after every finding.
- The provider can coordinate required technical testing without creating duplicated work.
- The engagement has enough capacity to meet a hard acquirer or customer deadline.
- The QSA can explain where the standard ends and where your acquirer’s reporting requirements begin.
Conversely, a premium price is difficult to justify when the provider cannot explain its scope assumptions, refuses to identify exclusions, or bundles unrelated consulting into a merchant environment that is already assessment-ready.
Verify the QSA Before Signing the Contract
A polished compliance proposal is not evidence that a company is currently qualified to perform PCI DSS assessments. PCI SSC maintains the official Qualified Security Assessor directory and recommends checking assessor status when engaging a QSA.
Qualification means the organization has met PCI SSC program requirements. PCI SSC also makes clear that qualification is not an endorsement of the provider’s business practices, pricing or service quality.
Before signing, verify the QSA company and then request a sample deliverable structure, named assessment lead, service scope, testing assumptions, retest policy and data-handling terms. You are buying both technical validation and a report that another organization must accept.
Your 15-Minute PCI QSA Budget Check
You can get surprisingly close to the right budget category without calculating every control. Fill in these fields before talking to a QSA:
| Question | Your answer | Why it matters |
|---|---|---|
| ROC or SAQ? | Confirm with acquirer | Changes the assessment model |
| How many payment channels? | Count distinct flows | Changes systems and testing |
| How many CDEs? | Identify separately managed environments | Multiple CDEs increase effort |
| How many systems? | Use in-scope inventory, not employee count | Drives evidence and sampling |
| How many locations? | Physical and relevant hosted locations | May change sampling or travel |
| Is segmentation proven? | Yes, no or uncertain | Can shrink or expand scope sharply |
| Is evidence ready? | High, medium or low | Affects assessor and internal effort |
| Is technical testing included? | Specify ASV, pentest and segmentation testing | Prevents quote gaps |
Send the same answers to each provider. This turns three vague QSA quotes into three comparable commercial proposals.
Frequently Asked Questions
Is a QSA mandatory for every PCI DSS merchant?
No. PCI DSS applies broadly to entities that store, process or transmit cardholder data or can affect the security of the CDE, but the validation method is determined through the applicable payment-brand and acquirer compliance programs. Many merchants validate using an SAQ rather than a QSA-led ROC.
Does being a Level 1 merchant automatically mean I need to hire an outside QSA?
Do not assume the answer solely from the phrase “Level 1.” Check the rules governing your merchant account. For example, Mastercard’s current program requires an annual ROC for Level 1 merchants but allows the ROC AOC to be signed through specified validation routes that include a QSA, an eligible ISA, or in some circumstances an executive officer. Your acquirer can tell you which option it will accept.
Why can two PCI DSS QSA quotes differ so much?
One proposal may assume a segmented CDE, limited sampling and assessment-ready evidence while another includes additional locations, readiness assistance, penetration testing or remediation validation. Compare assumptions and exclusions before comparing totals.
Should I pay for PCI readiness before the formal assessment?
It can be worthwhile for a first ROC, a materially changed environment or a merchant that cannot confidently define its CDE. A mature renewal with current evidence and stable scope may gain little from buying a separate readiness project every year.
Can outsourcing card payments eliminate PCI DSS costs?
Outsourcing can reduce PCI DSS scope, sometimes dramatically, but it does not automatically remove the merchant’s PCI responsibilities. The payment implementation, third-party responsibilities, applicable SAQ criteria and validation requirements still need to be established correctly.
What to Send Three QSA Firms Before You Ask for a Quote
Before procurement sends an RFP, prepare a one-page scope brief containing your required validation method, payment channels, CDE diagram, approximate in-scope system count, locations, third-party processors, segmentation approach, previous assessment status and the date your next validation is due.
Then ask each QSA to return the price alongside five answers: what is included, what is excluded, which technical tests are separate, how remediation revalidation is billed, and what would trigger a change order.
That is a better PCI DSS QSA budget than a generic internet average. It ties spending to the environment the assessor must actually validate and exposes the expensive surprises before the contract is signed.
Last reviewed: 2026-10
If penetration testing is quoted separately from the assessment, compare the scope against our guide to small business penetration testing cost before approving the additional budget.
PCI DSS is only one part of the security budget. Use our security tool stack cost calculator to separate recurring tooling costs from the QSA assessment fee.
If your organization is budgeting for several compliance programs at once, compare the cost structure with our SOC 2 cost guide for SaaS startups.
Organizations selling into the U.S. defense supply chain may also need to budget independently for CMMC compliance costs rather than treating PCI DSS and CMMC as one assessment project.
If customer due diligence is consuming significant internal compliance time, our guide to security questionnaire automation explains when automation may reduce repetitive evidence work.