Is there such a thing as a PCI DSS certificate?

Not in the way ISO 27001 has one. PCI DSS validation ends in a self-assessment questionnaire or a Report on Compliance, each with an Attestation of Compliance, which your acquiring bank or card brand receives. A Qualified Security Assessor completes a Report on Compliance; a self-assessment is completed by your own organisation and signed by an officer. What buyers call a PCI certificate is usually that attestation. SecureRoot is not a QSA and signs neither the Report on Compliance nor the Attestation of Compliance. Our work sits on both sides of the assessment: we scope the environment, run the gap assessment, help you remediate and assemble the evidence package indexed by requirement, so the assessment that follows confirms controls already in place rather than finding them missing.

Why do you not publish a single price for PCI DSS?

Because the spread between engagements is too wide for a range to help you. A merchant validating with a short self-assessment behind a hosted payment page needs a fraction of the work a payment service provider preparing for a Report on Compliance does, and one figure would mislead both. The quote depends on your merchant or service provider level, the number of systems and locations in the cardholder data environment, how much segmentation and remediation is needed, and whether the outcome is QSA-led. So we scope first, then quote a fixed price in writing against a written scope. The one layer we can band is the penetration testing Requirement 11.4 asks for, which is priced like any other test on this site, per surface, with the retest included.

Is the QSA's fee inside your quote?

No, and it never is. The Qualified Security Assessor must stay independent of whoever built your controls, so you contract with them directly and they quote their own fee. The same is true of the Approved Scanning Vendor that runs your quarterly external scans, and of any tooling. We do not mark these fees up, bundle them or collect them, which is exactly why the fee we quote can be fixed in writing. What our fee covers is the programme in front of the assessment: scoping, the gap assessment, remediation support, the evidence package, and supporting you and your QSA through fieldwork, which ends with an attestation you and the QSA sign and we do not.

Does a penetration test make us PCI DSS compliant?

No, and anyone who says so is overselling it. Requirement 11.4 makes penetration testing one requirement among many: external and internal tests at least every 12 months and after any significant change, plus segmentation tests where segmentation reduces your scope, every 12 months for merchants and every six months for service providers. Quarterly scans by an Approved Scanning Vendor are a separate requirement again. A test proves that those controls hold against an attacker; it does not build the access control, logging, multi-factor authentication or vendor management the other requirements ask for. That is the compliance programme, and the formal outcome is still a self-assessment or a Report on Compliance from a QSA. The test is evidence that feeds it, priced on its own band.

How long does a first PCI DSS validation take?

Usually three to five months, and what stretches it is remediation rather than assessment. Scoping and card data flow mapping takes one to two weeks, the gap assessment two to three, control remediation six to twelve, evidence collection two to three and assessment preparation one to two, before a QSA's fieldwork where a Report on Compliance is needed. A merchant with a fully outsourced payment page and a short self-assessment can finish in weeks rather than months. Segmentation, multi-factor authentication and logging changes need engineering time and change windows, which is why the remediation phase has the widest range and why your own team's availability decides where you land in it. We commit to dates after the gap assessment, once the real size of the work is known.

Cost guide

PCI DSS Certification Cost in India: Four Bills, and Who Sends Each

There is no PCI DSS certificate and no single PCI DSS price. Validation ends in a self-assessment or a Report on Compliance, and the money arrives as up to four separate bills from up to four different firms. This page names each bill, who sends it and what moves it, and gives the one figure that can honestly be banded.

Request an assessment Book a scoping call

Updated November 10, 2026

SecureRoot Risk Advisory LLP is not a Qualified Security Assessor and signs neither the Report on Compliance nor the Attestation of Compliance. We run the programme in front of the assessment and the testing it leans on, which is why two of the four bills below are ours to quote and two are not.

The four bills

What a PCI DSS validation costs, layer by layer

A quote that names one number for PCI DSS has either left layers out or folded a third party’s fee into its own. Ask which of these four it covers.

The compliance programme
SecureRoot, or whichever consultancy you choose: scoping, card data flow mapping, the gap assessment, remediation support, an evidence package indexed by requirement, and preparation for the SAQ or the QSA.
What it costs
Scoped against your SAQ type or ROC path, then quoted in writing. 3 to 5 months to a first validation; weeks for a short SAQ.
What moves it
Your merchant or service provider level, how many systems and locations sit in the cardholder data environment, how much segmentation and remediation is needed, and whether the outcome is a self-assessment or a QSA-led Report on Compliance.
Penetration and segmentation testing
A qualified tester with organisational independence. Requirement 11.4 asks for external and internal tests at least every 12 months and after any significant change, and for segmentation tests every 12 months, or every six for service providers.
What it costs
Priced like any penetration test: ₹50,000 to ₹4 lakh per surface ($500 to $4,200), retest included. Most PCI engagements run two to four weeks of testing.
What moves it
How many externally and internally reachable systems the cardholder data environment has, and whether segmentation testing is in scope.
Quarterly external scans
An Approved Scanning Vendor, every quarter, with rescans until high-risk issues are resolved.
What it costs
Quoted by the ASV. It is a separate contract, and we neither mark it up nor collect it.
What moves it
Set by the ASV. Ask for it while you scope, so it is in the budget before the first quarter starts.
The assessment itself
Either your own organisation, on a self-assessment questionnaire signed by an officer, or a Qualified Security Assessor (or an internal security assessor) producing a Report on Compliance, with an Attestation of Compliance beside it.
What it costs
A self-assessment has no assessor fee. A Report on Compliance is quoted by the QSA, contracted and paid by you directly, and never inside our fee.
What moves it
Which path your acquiring bank and the card brands put you on, mainly by annual transaction volume. For a Report on Compliance, the QSA sets its own fee.

Your own team's time: producing evidence, sitting in walkthroughs and making the remediation changes. It appears on no invoice and is usually the larger of the two costs outside our fee. The same split runs through every framework on our pricing page, and the testing layer is worked through in PCI DSS penetration testing.

Lowering it

Scope is the one lever you fully control

Our programme and the testing are both sized by the cardholder data environment, so shrinking it shrinks both, and it shortens the questionnaire you or your assessor work through.

Keep card numbers off your own servers. A hosted payment page, an iframe from a compliant payment provider, or tokenisation moves most requirements to the provider, and the SAQ that follows is far shorter than the one for a merchant whose servers touch card data.
Use what the RBI already requires. Since 1 October 2022 its card-on-file tokenisation rules stop anyone but the issuer and the card network storing card data, which removes most stored-card scope for Indian merchants and payment aggregators. It does not remove PCI DSS: systems that receive, process or transmit card data stay in scope.
Segment what must stay in scope. Network segmentation separates the systems that handle card data from the rest, so fewer systems need the controls, and the segmentation test is what proves the separation holds.

Which self-assessment questionnaire each payment flow lands on is set out in PCI DSS scope reduction and SAQ types, and the order to work through the requirements in our PCI DSS compliance checklist.

Timeline

Where three to five months go

A first validation, before the QSA’s fieldwork where a Report on Compliance is needed. Remediation has the widest range because it is engineering work in your change windows, not ours.

Scoping and card data flow mapping: 1 to 2 weeks
Gap assessment: 2 to 3 weeks
Control remediation: 6 to 12 weeks
Evidence collection: 2 to 3 weeks
Assessment preparation: 1 to 2 weeks

Questions

What buyers ask about PCI DSS cost

Is there such a thing as a PCI DSS certificate?
Not in the way ISO 27001 has one. PCI DSS validation ends in a self-assessment questionnaire or a Report on Compliance, each with an Attestation of Compliance, which your acquiring bank or card brand receives. A Qualified Security Assessor completes a Report on Compliance; a self-assessment is completed by your own organisation and signed by an officer. What buyers call a PCI certificate is usually that attestation. SecureRoot is not a QSA and signs neither the Report on Compliance nor the Attestation of Compliance. Our work sits on both sides of the assessment: we scope the environment, run the gap assessment, help you remediate and assemble the evidence package indexed by requirement, so the assessment that follows confirms controls already in place rather than finding them missing.
Why do you not publish a single price for PCI DSS?
Because the spread between engagements is too wide for a range to help you. A merchant validating with a short self-assessment behind a hosted payment page needs a fraction of the work a payment service provider preparing for a Report on Compliance does, and one figure would mislead both. The quote depends on your merchant or service provider level, the number of systems and locations in the cardholder data environment, how much segmentation and remediation is needed, and whether the outcome is QSA-led. So we scope first, then quote a fixed price in writing against a written scope. The one layer we can band is the penetration testing Requirement 11.4 asks for, which is priced like any other test on this site, per surface, with the retest included.
Is the QSA's fee inside your quote?
No, and it never is. The Qualified Security Assessor must stay independent of whoever built your controls, so you contract with them directly and they quote their own fee. The same is true of the Approved Scanning Vendor that runs your quarterly external scans, and of any tooling. We do not mark these fees up, bundle them or collect them, which is exactly why the fee we quote can be fixed in writing. What our fee covers is the programme in front of the assessment: scoping, the gap assessment, remediation support, the evidence package, and supporting you and your QSA through fieldwork, which ends with an attestation you and the QSA sign and we do not.
Does a penetration test make us PCI DSS compliant?
No, and anyone who says so is overselling it. Requirement 11.4 makes penetration testing one requirement among many: external and internal tests at least every 12 months and after any significant change, plus segmentation tests where segmentation reduces your scope, every 12 months for merchants and every six months for service providers. Quarterly scans by an Approved Scanning Vendor are a separate requirement again. A test proves that those controls hold against an attacker; it does not build the access control, logging, multi-factor authentication or vendor management the other requirements ask for. That is the compliance programme, and the formal outcome is still a self-assessment or a Report on Compliance from a QSA. The test is evidence that feeds it, priced on its own band.
How long does a first PCI DSS validation take?
Usually three to five months, and what stretches it is remediation rather than assessment. Scoping and card data flow mapping takes one to two weeks, the gap assessment two to three, control remediation six to twelve, evidence collection two to three and assessment preparation one to two, before a QSA's fieldwork where a Report on Compliance is needed. A merchant with a fully outsourced payment page and a short self-assessment can finish in weeks rather than months. Segmentation, multi-factor authentication and logging changes need engineering time and change windows, which is why the remediation phase has the widest range and why your own team's availability decides where you land in it. We commit to dates after the gap assessment, once the real size of the work is known.

Primary Sources

Where the Figures on This Page Come From

Every deadline, threshold and control count above is taken from the instrument itself. These are links to the primary text, not to a summary of it.

PCI DSS v4.0.1, the self-assessment questionnaires and the Attestation of Compliance forms (document library)
PCI Security Standards Council · Link checked 2026-11-10
Qualified Security Assessors: the council's list and programme
PCI Security Standards Council · Link checked 2026-11-10

Tell us how card data reaches you, and we will price the layers that are ours

Bring your level, your payment flow and the date your acquirer is waiting on. You get a written scope, a fixed price for the programme and the testing, and a straight answer on which third parties you also need. More on the programme itself is on our PCI DSS compliance services page.