How long does PCI DSS take?
It depends on one question: do you self-assess, or does a QSA assess you? Here are both paths, step by step.
- Self-assessment (SAQ)
- About 4 to 8 weeks
- For most startups. You fill in your SAQ and sign an Attestation of Compliance (AOC).
- QSA assessment (ROC)
- About 4 to 8 months
- For Level 1. A Qualified Security Assessor tests you and writes a Report on Compliance.
- After that
- Every year
- A new SAQ or ROC each year, and a passing external scan every quarter.
Counted from the day you start. Your acquirer or the card brands decide which path you need. SAQ A can take days.
14-day free trial. No credit card.
Where the time goes
Both paths start the same way. The size of your card data environment decides most of the time.
Scroll sideways to see the whole chart.
- You and Strac Comply
- An approved scanning vendor scans
- You sign your AOC
Bars show a typical case. The bracket shows the earliest and latest week.
Scroll sideways to see the whole chart.
- You and Strac Comply
- Scanners, testers and your QSA
- Your QSA writes the ROC
Bars show a typical case. The bracket shows the earliest and latest week.
Five steps to your PCI DSS attestation
Strac Comply gets you ready and keeps your evidence. A QSA, or you with your SAQ, attests to your compliance.
Step 1: Sign up, connect and set your scope
Week 1You, with your acquirer
Ask your acquirer which level you are and which form you file. Then map where card data goes. A hosted payment page or tokenization makes your scope much smaller.
Step 2: Close the gaps
1 to 4 weeks for an SAQYou, with Strac Comply
Put the PCI DSS v4.0.1 requirements for your scope in place. For example:
- MFA for all access to card data systems (8.4.2)
- Control the scripts on your payment page (6.4.3, 11.6.1)
- Review your logs automatically (10.4.1.1)
- Approve your security policies
Step 3: Pass your scans
1 to 2 weeksAn approved scanning vendor
For your first assessment, one passing quarterly external scan is enough, if your policy requires quarterly scans and you fixed and rescanned what failed (11.3.2). Some SAQs and a ROC also need a yearly penetration test (11.4).
Step 4: Self-assess, or be assessed
About 4 to 8 weeks in all for an SAQYou, or your QSA
With an SAQ, you answer the questionnaire and an officer signs the AOC. At Level 1, a QSA tests your controls and writes a ROC and an AOC. That path takes about 4 to 8 months in all.
Step 5: Keep it current
Every quarter and every yearYou, with Strac Comply
Pass an external scan every quarter, and file a new SAQ or ROC every year. Strac Comply keeps collecting evidence between assessments.
What nobody can promise you
Your acquirer decides your path
Your acquirer or the card brands set your level and your form. A QSA decides if you pass a ROC.
Strac is not a QSA or an ASV
Strac Comply prepares you and keeps your evidence. It does not assess or scan for the card brands.
There is no PCI certificate
The result is an Attestation of Compliance (AOC). A page that says "PCI certified in weeks" means a signed SAQ.
Questions founders ask
Do I need an SAQ or a ROC?
Most startups file an SAQ. A ROC is for Level 1: merchants with more than 6 million card transactions a year, and service providers with more than 300,000. Your acquirer can ask for a ROC at a lower level too.
Do I need four quarters of passing scans for my first assessment?
No. For your first assessment, one passing quarterly scan is enough, if your policy requires quarterly scans and you fixed and rescanned what failed. After that, you need a passing scan every quarter.
Can I get PCI DSS in a few weeks?
An SAQ, yes: about 4 to 8 weeks, and SAQ A can take days. A Level 1 ROC takes about 4 to 8 months, because a QSA tests your controls and writes the report.
What makes PCI DSS faster?
A smaller scope. Use a hosted payment page or tokenization so card data never touches your systems. Then fewer requirements apply.
Does Strac do the assessment?
No. Strac is not a QSA or an approved scanning vendor. Strac Comply gets you ready, maps your evidence to PCI DSS v4.0.1 and keeps it current.
How often do I repeat PCI DSS?
Every year: a new SAQ or ROC. Every quarter: a passing external scan. SAQ D and a ROC also need a yearly penetration test.
How long does each framework take?
Typical times for a startup that uses Strac Comply, from the day you start.
SOC 2
About 4 months
To a first Type II report. A Type I takes about 1 to 2 months.
See the SOC 2 timelineISO 27001
About 3 to 6 months
To a certificate, after a Stage 1 and a Stage 2 audit.
See the ISO 27001 timelineHIPAA
About 2 to 4 months
To a documented Security Rule program. There is no official certification.
See the HIPAA timelinePCI DSS
About 4 to 8 weeks
For a self-assessment (SAQ). A Level 1 assessment by a QSA takes about 4 to 8 months.
You are reading this one
Your scope decides your timeline. Start today.
Connect your systems, map your card data and see your gaps on day 1.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing · PCI DSS in Strac Comply