PCI DSS Assessments
At Insight Assurance, we deliver third-party PCI DSS assessments designed to help organizations evaluate their security posture and meet the requirements of the Payment Card Industry Data Security Standard (PCI DSS).
Whether you process, store, or transmit or could affect the security of cardholder data, our PCI practice provides the clarity and confidence needed to demonstrate compliance and reduce exposure to payment-related risks.
What Is PCI DSS?
PCI DSS is a globally recognized framework developed by the Payment Card Industry Security Standards Council (PCI SSC). It outlines technical and operational requirements for protecting cardholder data and applies to any entity that handles it or affects its security.
A PCI DSS assessment helps organizations validate their security controls and demonstrate responsible handling of sensitive financial data — supporting both compliance and customer trust.
Why Conduct a PCI DSS Assessment?
Key Benefits:
Stronger Data Protection
Regulatory Alignment
Customer Confidence
Risk Reduction
Revenue Enablement
Our PCI DSS Assessment Services
- PCI Scoping Assessment
- Gap Analysis
- Ad Hoc Consulting
- Remediation Consulting
- PCI Technical Program Management
- Staff Augmentation
- On-site and/or Remote QSA-led Testing
- Pre- and Post-Assessment Year-Round Support
Frequently Asked Questions
Who is required to comply with PCI DSS?
PCI DSS applies to any organization that stores, processes, or transmits cardholder data — or that could affect the security of that data. This includes merchants, payment processors, service providers, and technology companies whose platforms touch payment card data in any way. Compliance requirements and the level of assessment required vary based on transaction volume and the organization’s role in the payment ecosystem. Service providers that handle cardholder data on behalf of merchants are subject to their own PCI DSS obligations independent of their merchant clients.
What is the difference between a Self-Assessment Questionnaire (SAQ) and a QSA assessment?
A Self-Assessment Questionnaire (SAQ) is a self-evaluation tool available to eligible merchants and service providers that meet specific criteria — typically lower transaction volumes and limited cardholder data environments — resulting in a signed SAQ or ROC. A QSA-led assessment is an independent evaluation conducted by a PCI SSC-certified Qualified Security Assessor. The type of validation required depends on transaction volume, card brand mandates, and acquiring bank requirements. Higher-volume merchants and service providers are typically required to engage a QSA. Insight Assurance is a certified QSA firm and can lead both SAQ guidance and full QSA assessments.
What is a Report on Compliance (ROC) and when is it required?
A Report on Compliance (ROC) is the formal output of a QSA-led PCI DSS assessment, documenting the scope, testing performed, and findings for each requirement. It is required for Level 1 merchants and Level 1 service providers and is submitted to acquiring banks or card brands as evidence of compliance. The ROC is accompanied by an Attestation of Compliance (AOC) — a summary document signed by both the assessed organization and the QSA. Organizations not required to produce a full ROC may instead complete an SAQ with an AOC.
What version of PCI DSS is currently in effect?
PCI DSS v4.0.1 is the current active version, with full enforcement in effect as of March 2025. Version 4.0.1 introduced updated requirements around multi-factor authentication, encryption, and continuous monitoring, along with a new customized approach that allows organizations to meet the intent of a requirement through alternative controls where the defined approach is not feasible. Organizations should confirm their compliance posture and documentation reflect v4.0.1 requirements.
What is PCI DSS scoping and why does it matter?
Scoping is the process of defining which systems, networks, and people are in scope for a PCI DSS assessment — those that store, process, or transmit cardholder data, or that could impact the security of that environment. Accurate scoping is foundational to the assessment: overly broad scope increases the volume of evidence required and the cost of compliance; insufficient scope creates gaps that can result in a failed assessment or exposure in the event of a breach. A scoping assessment is typically the first step of any PCI DSS engagement.
What is the difference between PCI DSS and other security frameworks like SOC 2 or ISO 27001?
PCI DSS is a mandatory industry standard enforced by card brands and acquiring banks, specifically focused on protecting cardholder data — and importantly, PCI DSS is an assessment, not an audit. An assessment evaluates an organization’s controls against a defined standard at a point in time, while an audit documents the way things are actually operating over a period. SOC 2 is a voluntary attestation framework issued under AICPA standards, addressing broader security, availability, and privacy controls for service organizations. ISO 27001 is an internationally recognized certification for information security management systems. All three share meaningful control overlap — particularly around access management, encryption, logging, and incident response — and many organizations pursue more than one. Evidence gathered for one framework can often be applied toward another, reducing duplication of effort.
What is network segmentation and why does it matter for PCI DSS?
Network segmentation is the practice of isolating the cardholder data environment (CDE) from other parts of the network. While not technically required by PCI DSS, effective segmentation significantly reduces the scope of the assessment by limiting which systems are subject to PCI controls. Without segmentation, all systems that can communicate with the CDE may be considered in scope — substantially increasing both compliance complexity and cost, as well as assessment complexity and cost. Segmentation is one of the most impactful architectural decisions an organization can make before beginning a PCI DSS assessment.
How often does PCI DSS compliance need to be validated?
PCI DSS compliance must be validated annually. In addition to annual assessments, certain requirements are ongoing — including quarterly vulnerability scans by an Approved Scanning Vendor (ASV), penetration testing at least annually and after significant changes, and continuous monitoring of the cardholder data environment. Compliance is not a point-in-time status but an ongoing operational requirement.
Why Choose Insight Assurance?
Independent Assessments
Deep Expertise
In-House Team
AI-Enhanced Workflows
Clear, Practical Reporting
Ready to Protect Cardholder Data?
We provide independent PCI DSS assessments and consulting that help strengthen your payment environment, validate controls, and reduce risk.