PCI DSS Compliance ServicesScoping, Gap Assessment, and SAQ Readiness for Merchants and Service Providers

PCI DSS v4.0.1 is the current version of the Payment Card Industry Data Security Standard, published by the PCI Security Standards Council in June 2024 as a limited revision to v4.0. v4.0.1 superseded v4.0 in December 2024. Of the 64 new requirements introduced in v4.0, 51 were future-dated and went into effect on March 31, 2025. They are now in force for every assessment cycle. The most-tested controls in scope are MFA for all CDE access (Req 8.4.2), authenticated internal vulnerability scans (Req 11.3.1.2), tamper detection on payment pages (Req 11.6.1), and the new annual cryptography review (Req 12.3.3).

SAQ selection is driven by your acceptance channels and how cardholder data flows through your environment, not by your transaction volume alone. SAQ A is for fully-outsourced card-not-present merchants. SAQ A-EP applies when your e-commerce site partially controls the payment page, which is most custom checkouts even when Stripe or Authorize.Net handles the actual transaction. SAQ B-IP fits small retail with PTS-approved internet-connected terminals. SAQ C-VT and SAQ C cover virtual terminals and integrated payment applications. SAQ D is the catch-all when no narrower SAQ applies. The qualifying analysis we run in Phase 2 of an engagement produces the documented selection your acquirer will accept.

Most merchants below 6 million Visa or Mastercard transactions per year are eligible to self-assess with an SAQ. Above that threshold, the card brands typically classify a merchant as Level 1 and require an annual on-site assessment by a Qualified Security Assessor that produces a Report on Compliance. Service providers face their own thresholds (300,000 transactions per year for Level 1 service provider designation under Visa). On-Site Technology runs the readiness program; we do not write ROCs ourselves. When an engagement crosses into ROC scope we coordinate with QSA partners through our network, and the OST team continues to operate the program around the audit.

v4.0.1 is a limited revision, not a major release. It clarifies wording in roughly 60 places, refines the SAQ A eligibility criteria (specifically around scripts loaded into the payment page), updates several testing procedures to remove ambiguity, and corrects formatting errors. There are no new requirements in v4.0.1 beyond what v4.0 already published. The substantive deadline shift to March 31, 2025 for the 51 future-dated v4.0 controls is unchanged. Organizations already aligned to v4.0 do not need to re-engineer; they need to confirm the SAQ A clarifications do not change their SAQ qualification.

A SAQ Self-Service Prep engagement for a fully-outsourced e-commerce merchant typically runs 3 to 5 weeks. A Guided Readiness engagement for an SAQ A-EP, B-IP, C-VT, or C merchant lands in 8 to 14 weeks depending on the size of the gap and the speed of remediation. An Assessment-Ready Program for a service provider or Level 1 merchant operates as a quarterly retainer with the QSA-led audit timed to the merchant’s renewal cycle. The pace is usually set by remediation work the IT and engineering teams own, not by drafting time.

Pricing is contact-gated because the variables move every quote: number of acceptance channels, transaction volume, current state of the policy library, current MFA and encryption posture, whether a QSA-led assessment is in scope, and the urgency. The Tier 1 SAQ Self-Service Prep is the typical entry point and the smallest commitment. The Tier 3 Assessment-Ready Program is the long-term engagement model. Talk to us through the form on this page and we will scope a proposal within one to two business days, typically.

No. We are not listed by the PCI Security Standards Council as a QSA company or as an Approved Scanning Vendor, and we do not represent ourselves as either. OST is a readiness and program-management partner. We run the gap assessment, build the policy library, prepare the evidence, and walk you through SAQ completion. When a Report on Compliance or quarterly external scan is required, we coordinate with QSA companies and ASV partners through our network. That separation is intentional; it keeps our incentives aligned with getting your environment compliant rather than billing for the audit.

Yes. PCI DSS readiness work (CDE scoping, gap assessment, policy authoring, SAQ guidance, evidence preparation) is delivered remotely via Teams or Zoom and is available to merchants and service providers across the United States. We have deepest engineering capacity in Northern NJ, the NYC metro, Pennsylvania, and South Florida, which becomes useful when on-site network segmentation work or terminal-environment validation is needed in those regions. For purely remote engagements, location is not a constraint.

PCI DSS is a contractual obligation between you and your acquiring bank, not a law in most jurisdictions. Acquirers can fine non-compliant merchants between $5,000 and $100,000 per month, raise transaction-processing rates, downgrade transaction interchange categories, or revoke the merchant account entirely. After a breach, the card brands can assess fines that have run into the millions, and your acquirer is contractually entitled to pass those through. The compliance program is also what most cyber insurers now require during renewal, so non-compliance cascades into premium increases and coverage limits.

Significantly. PCI DSS controls populate the Identify, Protect, Detect, and Respond functions of NIST CSF 2.0 cleanly. The Security and Confidentiality Trust Services Criteria of SOC 2 reuse PCI control evidence almost verbatim in the CC6, CC7, and CC8 series. The HIPAA Security Rule access control, audit, and transmission security safeguards (45 CFR 164.312) align with PCI Requirements 7, 8, 10, and 11. We design engagements so the policy library and evidence package serve every audit cycle the merchant chases, not just the SAQ. Cybersecurity context lives on our Managed Cybersecurity Services page.

The hinge is whether your website page that hosts the payment form (or the iframe that contains it) controls any aspect of the cardholder data flow, including the JavaScript loaded onto that page. SAQ A applies when the payment page is fully delivered by a PCI DSS validated third party and your merchant pages contain no scripts that interact with the form. SAQ A-EP applies when your site partially controls the payment page, which most custom checkouts do, even ones that route to Stripe or Authorize.Net for the actual transaction. SAQ A is roughly 22 controls; SAQ A-EP is roughly 191 controls. Picking SAQ A when SAQ A-EP applies is one of the most common compliance failures and is the failure mode the v4.0.1 SAQ A clarifications were written to address.

Yes, through partner ASVs. We coordinate the quarterly scans, collect the reports, drive remediation of any findings against documented timelines, and store the evidence in your audit-ready vault. We are not the ASV ourselves; the ASV is a PCI SSC-listed partner. The merchant of record contracts with the ASV; OST manages the program around the scan, including authenticated internal vulnerability scans (Req 11.3.1.2) which are typically run on tooling we operate.