If your business accepts credit or debit cards, your bank expects you to prove every year that card data is protected. That proof is PCI DSS compliance. We assess you, help you fix what is missing and sign the report your bank asks for.
Why it applies to most businesses
- Taking cards is enough to be in scope, even through a terminal or an online checkout.
- Your merchant agreement requires it; your bank can charge fees or stop processing if you cannot show it.
- A card breach costs far more than an assessment: investigation, fraud losses, notices to customers.
Who will ask you for it
- Your acquirer (merchant bank)Asks for a yearly Attestation of Compliance.
- Card brandsSet your validation level and rules.
- Enterprise clients and partnersWant proof before they connect you to their payment flow.
- Your board and insurerWant to know the risk is managed.
- 01
Scope
We map where card data enters, moves and is stored, and shrink that area where we can.
- 02
Assess
Our QSAs test each requirement on site and remotely, and explain every gap in plain language.
- 03
Fix
You remediate with your team or ours, and we track every finding to closure.
- 04
Certify
We sign the Report on Compliance or validate your questionnaire, then schedule scans and renewal.
What you can hand to them
Click a document to see a sample. All sample documents
- Report on Compliance (ROC) or validated Self-Assessment Questionnaire
- Attestation of Compliance for your acquirer and partners
- Quarterly external scan reports
- A dated plan for anything still open
Your card brand or acquirer sets your merchant or service provider level from your yearly transaction volume. We confirm it during scoping, then match the service.
Level 1
Report on Compliance
For merchants and service providers with the highest card volumes.
- Gap and strategic analysis led by a QSA
- Guidance while you put missing controls in place
- Formal assessment, Report on Compliance (ROC) and signed Attestation of Compliance (AOC)
Base scope: up to 2 locations (remote by default), 1 card data environment, 1 legal entity, up to 50 systems.
Level 2
SAQ review and attestation
For service providers and Level 2 merchants.
- QSA review of your Self-Assessment Questionnaire
- Evidence review and clarifications with your team
- Signed Attestation of Compliance
Base scope: 1 location (remote by default), 1 card data environment, 1 legal entity, up to 25 systems.
Levels 3 and 4
SAQ review
For smaller merchants whose acquirer wants a QSA to review the questionnaire.
- QSA review of your questionnaire and evidence
- Signed Attestation of Compliance, if your acquirer requires it
- Done remotely
Base scope: 1 location, 1 card data environment, 1 legal entity, up to 15 systems (Level 3) or 10 (Level 4).
Levels 3 and 4
Self-service with Accel PCI
Do it yourself online, with our experts on call.
- The right questionnaire, pre-filled, with the attestation
- One-hour onboarding with a customer success expert
- Dashboard, to-do list, policy templates and training material
Every QSA engagement includes
- A readiness check before the assessment, to confirm documents and people are ready
- The Ubitrak Audit Portal for tasks, evidence and status, included for the first year
- Travel time (travel expenses are billed separately)
What changes the scope
- More locations or on-site visits
- More card data environments
- More legal entities or business units
- More systems than the base, or unusual complexity
- Extra rounds of remediation and retesting
- Expedited delivery or custom board reporting
Add when you need it
- Quarterly vulnerability scans and ASV scans
- Penetration and segmentation tests
- Card data discovery (Card Recon)
- Security awareness training (requirement 12.6)
- Secure coding training for developers
Frameworks
Delivered by
- UbitrakPCI QSA company since 2011.
- Accel PCIPCI compliance portal for merchants and service providers.
- KW ConsultingAdvisory, IT projects and remediation.
- Accel GRCGovernance, risk and compliance portal: Law 25, PCI DSS, SOC 2, ISO 27001, PIPEDA, GDPR.
Industries
Commonly bundled with
- Security testingPenetration tests and scans.
- Privacy and security programLaw 25 and governance with Accel GRC.
- Fix what the audit foundRemediation by KW Consulting.
Related insights
Post-quantum cryptography: why your first step is a cryptographic inventory
NIST's post-quantum standards are final and Canada has a federal migration roadmap to 2035. Why the first step is a cryptographic inventory, and how…
Read the insight →AI in the payment environment: what the PCI SSC’s new AI guidance means for your scope
The PCI SSC published Security Considerations for AI Systems on 2026-09-15. AI is scoped like any other technology. Where chatbots, agents and shadow AI…
Read the insight →You can’t lose what you don’t keep: reducing PCI scope by not storing card data
The most effective PCI DSS control is often the data you never hold. How hosted payment pages, tokenization and segmentation shrink your cardholder data…
Read the insight →