The cost of PCI DSS compliance cannot be answered in a single word, as it depends on several factors discussed below. Many businesses are guided, mainly by people in IT, towards a mistaken understanding of PCI DSS certification and consequently its cost.
Many therefore believe that performing ASV scans and completing an SAQ automatically means that the business complies with the standard.
PCI DSS compliance requires full compliance with all requirements arising from the SAQ that the business must meet.
Direct PCI DSS costs
- Certification level: Level 1 is the most expensive, requiring, among other things, an on-site audit by a QSA.
- Certification type: Type D is the most expensive option, requiring approximately 330 PCI controls and considerable effort by both the business and the auditor.
- Infrastructure size: The size of the in-scope infrastructure affects the cost by increasing the complexity of the environment.
- Public IPs: The number of public-facing systems affects the cost of ASV scans.
- Locations: The number of locations at which credit card transactions take place.
Indirect PCI DSS costs
- Security policy: The standard explicitly requires a complete security policy, applied in practice and backed by a full history. The business must either prepare it internally, with an internal cost, or commission a specialist company.
- Risk Assessment: An annual risk assessment is also required, which the business must perform internally or assign to an external partner.
- Penetration test: Some certification types require penetration testing.
- Hosting environment: Hosting online shops and other online businesses can also create new costs. As explained, PCI DSS compliance requires alignment with all requirements, which data centres or hosting providers that are not PCI compliant cannot meet.
This entails moving services to more reliable, certified providers that are also more expensive.
Cost optimization & Propper sizing
How can I reduce the cost and time of PCI DSS certification?
A specialist PCI DSS certification company such as Innotech can help reduce both certification costs and the time needed to complete the process through specialist services focused on correct segmentation of the PCI environment.
Let’s look at it together
Discuss your business needs with our team.
Talk to a PCI expertFind your certification type