PCI DSS Compliance: What It Involves, What It Costs and How Long It Takes

PCI DSS is the payment card industry’s data security standard. It works differently from the ISO standards many readers already know, and seeing how differently is the first step. The rules reach merchants in India and every other country, since they flow from the card brands.

Is PCI DSS compliance a certification?

No, not in the ISO sense. No accredited certification body issues a three-year certificate with surveillance audits. PCI DSS is a contractual requirement that flows from the card brands through acquiring banks to merchants and service providers. What you submit depends on your level.

You show compliance through validation, usually once a year. Validation is a point-in-time check against a standard that expects controls to work every day. That gap is where most organisations struggle.

Who sets your level, and how do you prove it?

Your acquirer decides. Level depends on transaction volume and on what the card brands and your acquiring bank require. Confirm both your level and your validation route with the acquirer, not with a consultant and not by guessing from volume, because acquirers can add requirements beyond the baseline.

Larger merchants and service providers are usually assessed by a Qualified Security Assessor, who produces a Report on Compliance and an Attestation of Compliance. Smaller merchants usually complete a Self-Assessment Questionnaire, chosen by how they accept payments, plus the attestation. Internet-facing systems also need scans by an Approved Scanning Vendor.

What does the standard require?

Twelve requirements, grouped under six control objectives. They cover network security, protecting stored data, encryption in transit, malware defences, secure systems and software, access control, authentication, physical access, logging, security testing and a security policy. PCI DSS version 4.0.1 is the current version.

Where ISO 27001 asks you to assess risk and decide, this standard often tells you what to do. Version 4 added a customised approach for meeting an objective another way. It needs heavy documentation and analysis, so it is not a shortcut. The PCI Security Standards Council retired version 4.0 on 31 December 2024, after version 3.2.1 on 31 March 2024. Requirements first marked as future-dated became mandatory on 31 March 2025.

What is the cardholder data environment, and why does scope come first?

The cardholder data environment is every place card data is stored, processed or transmitted, plus the systems connected to them. Scope decides the size of the work, the fees and the engineering effort. Reduce it before securing anything, so you protect only what you need to hold.

Imagine a Pune online retailer that assumed card data sat only on its checkout page; a trace finds it in call recordings and a test database. After a move to a hosted payment page and deletion of the old copies, three systems remain in scope.

What stages make up the PCI DSS compliance timeline?

Eight stages, from agreeing your level with the acquirer to submitting the attestation. A small merchant using an outsourced payment page and a questionnaire may need two to five months. A mid-sized firm with its own card environment often needs six to twelve. Service providers and first assessments with heavy remediation can take twelve to twenty-four months.

The stages run in order: agree level and route with the acquirer, scope the environment, reduce scope, assess gaps against the current version, remediate, collect evidence, complete the assessment, and submit the attestation. Evidence has to be gathered continuously, since an assessor samples across a period, not a single day. Remediation drives the timeline. Segmentation, logging and secure development are engineering programmes, not paperwork.

What drives PCI DSS compliance cost?

Cost follows scope and remediation. The main lines are assessor fees where an assessment is required, quarterly scanning fees where systems face the internet, readiness consultancy, technology and internal engineering effort. Engineering is usually the largest line and the least budgeted.

Technology covers logging and monitoring, file integrity monitoring, vulnerability management, segmentation, and encryption or tokenisation. The firm that performs your remediation should not assess it without careful thought about independence, so ask this directly. Firms that keep PCI DSS compliance cost down cut what touches card data early. The costliest secure everything they hold, rather than asking what they need to hold. Compliance is not optional for any business that takes card payments. The only choice is how much scope to carry.

Where do organisations fall short?

Most failures start with an assumption. Scope is assumed, segmentation is assumed to work, and supplier duties are assumed to sit elsewhere. The biggest weakness is treating compliance as an annual event, so logging stops, patching slips and access reviews lapse once the assessor leaves.

• Scope by assumption: Card data hides in call recordings, email, logs, backups, test environments and spreadsheets.
• Untested segmentation: If it keeps systems out of scope, adequate testing must prove it.
• Unclear supplier duties: Each requirement needs a documented owner.
• Storing what you don’t need: Card verification codes and full track data must never be stored after authorisation, yet both still turn up in logs and databases.
• Live card data copied into test environments.

Controls that run for the assessment and then lapse explain why breaches still reach organisations that were compliant at their last validation.

How do PCI DSS consultants play a main role?

PCI DSS consultants scope the environment, run the gap assessment, plan remediation and prepare evidence before the assessor arrives. They do not set your level, and they do not perform the assessment.

If an adviser also acts as one of your ISO certification consultants, ask which PCI DSS tasks they will do and which they leave to an assessor.

How can MSCi help with PCI DSS compliance?

We are a consultancy with 40+ years of experience in ISO consultation, and we prepare companies for assessments and audits. For PCI DSS, that means scoping, gap assessment and remediation planning. We do not issue a Report on Compliance or an Attestation of Compliance.

An engagement with MSCi usually starts by tracing where card data truly sits, then reducing scope and running a gap assessment against the current version. We then write a remediation plan with owners and dates, help you agree supplier duties in writing, and support evidence collection through the year.

Frequenty Asked Questions

1. Is PCI DSS compliance mandatory for a small business?

Yes, if you accept card payments. Your acquirer sets what you must submit, and smaller merchants usually complete a Self-Assessment Questionnaire.

2. Who validates PCI DSS compliance?

Larger merchants and service providers use a Qualified Security Assessor. Smaller merchants usually self-assess with the questionnaire that fits how they take payments, then submit an Attestation of Compliance to the acquirer.

3.How long does the PCI DSS compliance timeline run?

A small merchant with an outsourced payment page may need two to five months. Complex environments and first assessments with heavy remediation can take twelve to twenty-four months.

4. What is included in PCI DSS compliance cost?

Assessor fees where required, scanning fees, readiness consultancy, technology and engineering effort. Engineering is usually the largest and least budgeted line.

5. Can MSCi make us PCI DSS compliant?

MSCi prepares you through scoping, gap assessment and remediation planning. It does not issue a Report on Compliance or an Attestation of Compliance, and your acquirer confirms your level and route.

6. Does PCI DSS compliance need renewing every year?

Validation is generally annual. The controls themselves must work all year, which is why evidence is collected continuously.