How we source PCI compliance cost figures
Cost ranges on this site are based on public reference material across the PCI compliance landscape. The publishers below are representative of the kind of source that informs our positioning, not an exhaustive extraction map per figure. A specific figure on a specific page is not necessarily anchored to a single named publisher.
Sources
- PCI Security Standards Council published guidance. PCI DSS standard text, Self-Assessment Questionnaire (SAQ) types and applicability guidance, prioritised approach guidance, and v4.0 transition documentation.
- QSA firm public day-rate guidance. Publicly-published day-rate ranges and engagement-pricing disclosures from major QSA firms (Coalfire, A-LIGN, SecurityMetrics, Trustwave, Schellman, NCC Group and others).
- ASV vendor public pricing. Approved Scanning Vendor public pricing pages (ControlScan, Trustwave, SecurityMetrics, Qualys, et al.) for quarterly external scan service pricing.
- Penetration testing public rate guidance. Publicly-published rate cards from UK and US pentesting firms with PCI-aligned offerings.
- Card-network published penalty schedules. Visa, Mastercard, American Express and Discover non-compliance fee disclosures (where published openly) and acquirer pass-through fee structures.
- Practitioner survey data. Public PCI compliance budget surveys and write-ups from industry publications (CSO Online, Dark Reading, ISMG, and similar).
How ranges are constructed
For each cost line, we collect data points across the named source landscape, normalise to current-year USD, exclude clear outliers, and report a working band rather than a single point estimate. Point estimates over-claim precision; the full distribution carries small samples in the tails.
What we deliberately do not publish
- Specific QSA fee tariffs. Major QSAs redact specific fees in writing. We publish the band, not the named-firm specific quote.
- Customer-named contract pricing. Specific merchant compliance budgets are not published even where they are known.
- Side-by-side QSA feature grids. We publish positioning notes but not feature-comparison grids; QSA firm scoping practice changes regularly and static grids go stale.
Update cadence
Cost ranges update only when the underlying reality changes. Triggers:
- PCI DSS major-version transitions (v4.0 to future versions).
- PCI Security Standards Council fee or scope changes.
- Material movement (10%+) in QSA day-rate ranges over a 12-month sample.
- Card-network published penalty schedule changes.
Cosmetic date bumps are not made.
Editorial position
This site is operated by Digital Signet, an independent AI-development studio. We do not act as a QSA, do not sell tokenisation or scope-reduction services, do not run a penetration testing practice, and do not accept paid placements from any vendor in the PCI compliance space. See /about for the operator and the wider network.
Editorial direction is set by Oliver Wakefield-Smith. Drafts are produced via Digital Signet's autonomous AI development methodology and reviewed against the editorial framework before publication.
Contact
For methodology questions, corrections, or scenarios that don't fit cleanly: [email protected].