PCI Compliance Cost in 2026: SAQ A to ROC, Line by Line

PCI compliance cost runs from a few hundred dollars a year for a small merchant whose payment provider handles every card number, to six or seven figures for a Level 1 organization validating with a Report on Compliance (ROC). What sets the number is less your merchant level than your validation route, meaning your Self-Assessment Questionnaire (SAQ) type or a ROC, and how many systems sit in your cardholder data environment (CDE). The questionnaire itself costs nothing to download. The money goes to scans, penetration testing, assessor fees, tooling, remediation and staff time.

This guide prices each line and separates processor fees from the cost of compliance. For testing and scanning it uses our published prices: the PCI work is described on our PCI DSS penetration testing page, every service is on the pricing page, and the penetration test alone is broken down in PCI penetration testing cost.

PCI compliance cost at a glance

Published estimates disagree by an order of magnitude because they count different things. SecurityMetrics, a PCI assessment and scanning firm, puts a small business with a small scope at about $300 a year. BD Emerson, which states it is not a Qualified Security Assessor (QSA) company, puts year one at $2,700 to $16,000 for a small SAQ A e-commerce merchant and $325,000 to $1.27 million for a Level 1 ROC, excluding staff time and processing fees. Both are 2026 figures: the SecurityMetrics page was last updated on October 12, 2026, and BD Emerson labels its numbers as planning ranges as of October 2026.

The low figures count only what you pay to validate an environment already in good shape. The high figures add a gap assessment, one-time remediation and tooling, the largest lines in a first year.

The recurring lines follow from how you take payments, with the testing and scanning each route requires at our starting prices:

Your situation	Route	What you pay for every year	Testing and scanning at our prices, from
Online store, checkout fully hosted by the provider (redirect or its embedded form)	SAQ A	Quarterly scans by an Approved Scanning Vendor (ASV), the processor’s program fee	No penetration test required; ASV scans quoted
Online store whose own page serves part of the payment page	SAQ A-EP	ASV scans, an external test, a checkout application test (see e-commerce penetration testing)	$9,400: external $4,200 plus web application $5,200; ASV scans quoted
Standalone IP terminals, or a payment system on one site’s network, the usual case in hotel and restaurant PCI testing	SAQ B-IP or SAQ C	ASV scans (SAQ C adds internal scans), segmentation testing if segmentation limits scope	Segmentation testing from $6,000 within an internal test; SAQ C quarterly internal scans $6,000; ASV scans quoted
Retailer whose own systems receive or store card data	SAQ D	Quarterly internal and ASV scans, full Requirement 11.4 testing, tooling, often assessor time	$21,400: external, internal with segmentation and web application ($15,400) plus quarterly internal scans ($6,000); ASV scans quoted
Payment platform in the cloud, Level 1 service provider	ROC	All of the above, QSA fees, segmentation testing every six months	$22,000: cloud $6,800, web application $5,200, API $4,000, internal scans $6,000. Add $6,000 for an internal test with the first segmentation test if you rely on segmentation; the second segmentation test six months later, ASV scans and the ROC are quoted

Internal scan figures assume up to 250 devices. Where a row says ASV scans or the ROC are quoted, they are delivered through our PCI partner, Sovereign Secure. If your SAQ does not require a penetration test, we will say so rather than sell you one. To total your own scope, use the penetration testing cost calculator.

PCI compliance cost by level

Your level is set by each card brand from your annual transaction count. It decides which document you submit and who signs it, not which controls you need: every merchant must meet the same standard.

Level	What you typically submit	Published cost estimates
Level 1 merchant	An annual ROC, usually by a QSA	$325,000 to $1.27 million in year one (BD Emerson); $70,000 or more for enterprises (SecurityMetrics)
Level 2 merchant	An annual SAQ; Mastercard requires a QSA or an Internal Security Assessor (ISA) for several SAQ types	$94,000 to $350,000 in year one on SAQ D validated with a QSA (BD Emerson)
Level 3 and 4 merchants	An SAQ, annually for Visa Level 3, otherwise when the acquirer or brand asks	About $300 to $10,000 a year for a small business (SecurityMetrics); $2,700 to $16,000 in year one on SAQ A (BD Emerson)
Level 1 service provider	An annual ROC	A Level 1 ROC, plus service provider requirements and, if segmented, six-monthly segmentation tests
Level 2 service provider	SAQ D for Service Providers	SAQ D costs, plus QSA fees for a listing on Visa’s service provider registry

Each brand’s thresholds are in our guide to PCI compliance levels and SAQ types.

An ISA is your own employee, qualified by the Council for assessor work, for published fees of $4,000 at the non-member rate plus $1,600 to requalify every 12 months (fee schedule checked November 2026). The person’s time costs far more, so an ISA pays off only for large, recurring assessments.

What drives PCI DSS compliance cost: the components

PCI DSS v4.0.1 is the version in force, and every line below maps to a requirement in it.

Scoping and gap assessment

Requirement 12.5.2 requires you to confirm your PCI scope at least every 12 months and after significant change (every six months for service providers, under 12.5.2.1). The first time, that usually means a gap assessment by a consultant or QSA. Later years cost less because the data flows are already mapped.

Remediation

The most variable line: SecurityMetrics puts it at $100 to $10,000 for a small business and $10,000 to $500,000 for an enterprise. Typical items, mostly one-time fixes, are unsupported systems, flat networks, missing multi-factor authentication and weak logging.

Security tooling, and what March 2025 added

PCI DSS v4.0 introduced 64 new requirements, and 51 of them were future-dated until March 31, 2025. Several now drive tooling budgets:

Requirement	What it asks for	Where the money usually goes
6.4.2	An automated solution that detects and prevents web-based attacks on public-facing web applications	A web application firewall or equivalent
6.4.3 and 11.6.1	Authorization of every payment page script, and detection of unauthorized changes to payment pages	Client-side script monitoring, or engineering time
10.4.1.1	Automated audit log reviews	A SIEM or managed logging
5.4.1	Automated protection of staff against phishing	Email security filtering
8.4.2	Multi-factor authentication for all non-console access into the CDE	MFA licenses and rollout
11.3.1.2	Authenticated internal vulnerability scans	Scanner credentials and setup

The January 2025 revision of SAQ A removed 6.4.3 and 11.6.1 from that questionnaire and added an eligibility criterion instead. Our PCI compliance checklist explains how those controls work for everyone else.

Vulnerability scanning: two scans, two budgets

External ASV scans (11.3.2) run at least every three months by a company on the Council’s list of Approved Scanning Vendors, with rescans until the result passes. SAQ A merchants owe them too: the Council’s FAQ 1604, published June 2026, confirms they cover merchant pages that redirect to the provider or embed its payment form. SecurityMetrics puts small-business vulnerability scanning at about $100 to $200 per IP address, without saying per scan or per year, and BD Emerson budgets $200 to $1,000 for ASV scans in year one for a small SAQ A merchant. We arrange ASV scans too, through our PCI partner, Sovereign Secure, quoted separately. Why the scan never replaces the test is covered in ASV scan vs penetration test.

Internal scans (11.3.1) also run every three months, authenticated, with high-risk and critical findings fixed and rescanned, and need no ASV. Our analyst-validated vulnerability scanning service is $1,500 per scan for up to 250 devices and $2,500 for up to 1,000, with a free re-scan, so quarterly coverage of 250 devices is $6,000 a year (see vulnerability scanning pricing).

Penetration testing and segmentation testing

Requirement 11.4, the line companies most often underbuy, covers external, internal and application-layer testing, segmentation testing where segmentation reduces scope, and a retest of what you fixed; our guide to PCI DSS penetration testing requirements goes through each part. A typical merchant needs an external network penetration test, an internal test with network segmentation testing and a checkout application test, from $15,400 at our fixed prices with the retest included; service providers add a second segmentation test six months later (11.4.6). PCI penetration testing cost prices each component. BD Emerson budgets $15,000 to $55,000 for this line at a Level 2 SAQ D merchant.

The assessment itself

An SAQ costs staff time, plus assessor time where your brand requires it. A ROC is a QSA engagement: SecurityMetrics puts a QSA assessment at about $15,000 on average and an enterprise onsite audit at about $40,000, while BD Emerson budgets $50,000 to $200,000 in QSA fees for a Level 1 ROC. Locations, systems, payment channels, sampling and onsite days drive the fee.

Training and staff time

Requirement 12.6.3 requires security awareness training on hire and at least every 12 months, covering phishing and social engineering (12.6.3.1); SecurityMetrics estimates about $70 per employee for training and policy work. Staff time is the line most published ranges leave out: evidence, the SAQ or QSA support, scan findings and the scope document. For a small merchant that is days; for a Level 1 program it is at least one person’s job.

Year one vs every year after: what recurs

Cost line	Year one	Every year after
Scoping and gap assessment	Data flows mapped, gaps listed	Scope confirmed (12.5.2), far less work
Remediation	The largest and least predictable line	Small, unless scope changes or testing finds something new
Tooling	Purchase and rollout	Subscriptions and upkeep
ASV and internal scans	Four quarters	Four quarters, same cost
Penetration and segmentation testing	Full Requirement 11.4 scope	The same scope again
Training and staff time	Policies written, staff trained	Annual refresh and evidence collection

BD Emerson publishes later-year ranges beside its year-one figures: $1,700 to $8,000 for a small SAQ A merchant, $62,000 to $198,000 for a Level 2 SAQ D merchant with a QSA, and $205,000 to $695,000 for a Level 1 ROC, lower mainly because remediation is a one-time cost. Scans and testing do not shrink; the at-a-glance figures recur every year.

A worked PCI budget for an SAQ A-EP online store

Take a store with one checkout application whose own page serves part of the payment page, so it validates with SAQ A-EP and signs the Attestation of Compliance (AOC) its acquirer asks for.

Line	Annual cost	Basis
External network penetration test	$4,200	Our published price, retest included
Checkout web application test	$5,200	Our published price, retest included
Quarterly ASV scans	Quoted	Delivered through our PCI partner, Sovereign Secure
Processor program fee	Set by your merchant agreement	The Wells Fargo example below is $10.00 per month per merchant ID
Training	About $70 per employee	The SecurityMetrics estimate above
SAQ, evidence and scan follow-up	Staff days	Your own team

That is $9,400 of fixed testing before scans, fees and staff time. Year one adds whatever the gap assessment finds, often the payment page script controls (6.4.3 and 11.6.1) if they are not in place yet.

The PCI compliance fee on your merchant statement

Two different fees appear on merchant statements, and neither is the cost of compliance.

The PCI compliance (or program) fee is your processor’s charge for running its compliance program, often including a portal where you complete the SAQ. Wells Fargo, for example, publishes a PCI Compliance Program fee of $10.00 per month per merchant ID (as of November 2026). It is a term of your merchant agreement, not a PCI Council rule, so whether it can be waived is between you and your processor: compare it before you sign. Paying it does not make you compliant.

The PCI non-compliance fee is charged when you miss your validation deadline. Checkout.com publishes its schedule: $150 a month at Level 4, $300 at Level 3, $360 at Level 2 and $600 at Level 1, charged after a 60-day grace period and stopped once you validate (schedule as of November 2026). At Level 4 that is $1,800 a year, more than many SAQ A merchants spend on compliance itself.

Card brand assessments are separate again. The PCI Security Standards Council does not manage compliance programs or impose consequences for non-compliance; each card brand defines its own. Brands assess the acquirer, which passes the charge to the merchant under the merchant agreement. Our overview of data breach fines and penalties covers that chain.

After a breach

Most acquiring banks require a breached business to complete a forensic investigation, at its own cost. SecurityMetrics estimates it at $8,000 to $30,000 for a Level 4 merchant and $10,000 to $100,000 at Level 1, with card brand compromise fees from $5,000 to more than $5 million on top.

How to lower PCI compliance cost

Nearly every saving comes from shrinking the CDE. The Council’s scoping and segmentation guidance calls network segmentation one method of cutting the systems in scope and gives others, such as outsourcing card handling to a third-party service provider or using a PCI-listed point-to-point encryption (P2PE) solution; it adds that tokenization and encryption can shrink the CDE.

1. Take card data off your web server. A full redirect or the provider’s embedded form usually moves an e-commerce merchant to SAQ A, which has no penetration test, provided you meet every SAQ A eligibility criterion, including the 2025 one on script attacks. The ASV scans stay.
2. Use validated P2PE terminals in stores. SAQ P2PE has no scanning or penetration testing requirements.
3. Tokenize stored card numbers so systems holding only tokens can fall out of scope.
4. Prove your segmentation before the assessor arrives. An untested segmentation claim pulls the whole network into scope; a segmentation test costs far less.
5. Buy testing with the retest included, since 11.4.4 requires fixes to be verified, and never buy a scan labeled as a penetration test: the QSA will reject it.

If you also hold SOC 2, one penetration test scoped to cover the CDE and the SOC 2 system can serve both; our guide to SOC 2 cost prices that side, and ISO 27001 certification cost does the same for ISO.

What Invadel provides, and what it does not

Who supplies each line:

Cost line	Who provides it	Invadel
Scoping, choosing the SAQ	You, your acquirer, a consultant or QSA	We map your payment setup to the SAQ and the testing it requires
Remediation	Your engineers or IT provider	Not provided; the free retest verifies your fixes
Tooling (WAF, SIEM, script monitoring, MFA)	Product vendors	Not sold; our testing checks whether it works
Internal scans (11.3.1)	You or a scanning provider	From $1,500 per scan, free re-scan included
ASV scans (11.3.2)	A PCI SSC-listed ASV	Delivered through our PCI partner, Sovereign Secure; quoted separately
Penetration and segmentation testing (11.4)	A qualified, organizationally independent tester	From $4,000 per component, free retest, attestation letter
ROC (Level 1)	A QSA company, or an ISA where the brand allows	Delivered through our PCI partner, Sovereign Secure; quoted at scoping
Training, policies, program management	You, a training provider or a consultant	Not provided
Forensic investigation after a breach	A PCI Forensic Investigator	Not provided

We run the Requirement 11.4 penetration test and the internal scans ourselves; ASV scans and Report on Compliance assessments are delivered through our PCI partner, Sovereign Secure.

Our penetration testers are senior in-house employees, never subcontractors. See what the QSA receives on our sample report page.

If you are still comparing vendors for the testing line, our guide to PCI penetration testing companies is the next read.

Frequently asked questions

How much does PCI compliance cost for a small business? On SAQ A, where the provider handles all card data, expect the low end: SecurityMetrics puts a small business with a small scope at about $300 a year for the SAQ, scans and training, before any processor program fee. If your own site serves part of the payment page (SAQ A-EP), the required testing starts at $9,400 a year at our prices; if your systems receive or store card data (SAQ D), testing plus quarterly internal scans start at $21,400.

How much does a PCI ROC cost? SecurityMetrics puts an average QSA assessment at about $15,000 and an enterprise onsite audit at about $40,000, while BD Emerson budgets $50,000 to $200,000 in QSA fees for a Level 1 ROC; locations, systems and payment channels in scope set the number. In year one the whole Level 1 program costs several times that.

Can I do PCI compliance myself? Mostly, below Level 1: Level 2 to 4 merchants self-assess with an SAQ, though Mastercard requires a QSA or an ISA at Level 2 for several SAQ types. ASV scans must come from a listed ASV, and any required penetration test needs a qualified, organizationally independent tester. Our guide to PCI compliance levels and SAQ types shows which SAQs need one.

How much do ASV scans cost? BD Emerson budgets $200 to $1,000 for ASV scans in year one for a small SAQ A merchant, and SecurityMetrics puts small-business vulnerability scanning at about $100 to $200 per IP address, without stating a period. Internal scans, which need no ASV, are $1,500 per scan for up to 250 devices at our prices.

What does PCI compliance cost per month? Divide the annual figure, because little of it is billed monthly. The SecurityMetrics low end of about $300 a year is $25 a month for a small SAQ A merchant, before the processor’s program fee. An SAQ A-EP store paying $9,400 a year for required testing is at about $780 a month.

What does PCI compliance cost in year two? Less than year one, because the gap assessment and most remediation are one-time. BD Emerson puts each later year at $1,700 to $8,000 for a small SAQ A merchant against $2,700 to $16,000 in year one. Scans and penetration testing recur at the same cost.

Can I get PCI compliant for free? Not quite. The standard and the SAQ cost nothing to download, but SAQ A merchants still owe quarterly ASV scans, and many processors charge a program fee. The closest thing to free is keeping card data off your systems entirely and filing on time, so you never pay a non-compliance fee.

The short version

PCI compliance cost is set by your validation route and the size of your CDE: a few hundred dollars a year for a fully hosted checkout on SAQ A, tens to hundreds of thousands for SAQ D, and six figures or more for a Level 1 ROC. Shrink the scope first, file on time, and buy the Requirement 11.4 testing as fixed components with the retest included, from $15,400 for a typical merchant on our pricing page. Our PCI DSS penetration testing page shows what that covers, and you can send us your payment setup for a written fixed price.