Search for PCI compliance services and you’ll get a page of enterprise security firms quoting engagements that cost more than a delivery van. Most of them are selling to companies with a compliance department. If you run a bakery with 4,000 card transactions a year, almost none of it applies to you.
The useful version of this question is narrower: what are the actual categories of outside help, what do they cost, and which ones does a small merchant need to pay for?
For most businesses in this bracket the honest answer is one paid service and a handful of free resources. Here’s how to tell which one you need and how to recognize the pitch that’s aimed at somebody else.
The Bottom Line
- Most small merchants need exactly one paid service: quarterly ASV scanning, typically $100–$500 per quarter (SecurityMetrics).
- QSA engagements averaging around $15,000 are built for Level 1 merchants, not for a Level 4 business (Sprinto).
- Your processor may already include scanning and SAQ tooling in the fee you’re paying. Check before buying it twice.
- The PCI Security Standards Council publishes the official ASV and QSA lists free, plus a set of small-merchant guides.
- Tokenization and hosted checkout reduce your obligations more cheaply than any compliance product can.
Save 80% of delivery management time
We handle everything:
- Dedicated operations manager
- Real-time tracking dashboard
- Automated customer notifications
- Urgent issue resolution
The five categories of PCI compliance services
Everything sold in this market falls into one of five buckets. They solve different problems and sit at wildly different price points.
| Category | What it does | Typical small-merchant cost | Do you need it? |
|---|---|---|---|
| ASV scanning | Quarterly external vulnerability scans from an approved vendor | $100–$500 per quarter | Yes, if any in-scope system faces the internet |
| Processor-bundled compliance programs | SAQ wizard, scanning, sometimes breach coverage, via your payment provider | Often bundled; sometimes a monthly fee on your statement | Usually the cheapest route; check what you already have |
| SAQ / compliance platforms | Guided questionnaire tooling, evidence storage, policy templates | Subscription, varies widely | Only if the questionnaire is beyond you |
| QSA assessments | Independent assessor produces a Report on Compliance or reviews your SAQ | Around $15,000 on average; ROCs run far higher | Only at Level 1, or if your acquirer demands it |
| Scope-reduction technology | Tokenization, hosted checkout, P2PE terminals, pay-by-link | Often included with your processor | Yes; this is where the biggest reductions come from |
Cost ranges from SecurityMetrics and Sprinto.
Before deciding what to buy, be clear on which merchant level you’re in and what you’re obliged to produce. Why PCI compliance matters for small businesses covers the levels, and what merchants must prove to validate covers the SAQ and attestation side. Buying services before you know your level is how merchants end up with an enterprise contract for a Level 4 obligation.
ASV scanning: the one line item most merchants actually need
If any system in your cardholder data environment is reachable from the internet, PCI DSS requires quarterly external vulnerability scans from an Approved Scanning Vendor. Not your host’s built-in security dashboard, not a free online scanner. It has to be an organization on the Council’s approved list.
The Council defines an ASV as “an organization with a set of security services and tools (‘ASV scan solution’) to conduct external vulnerability scanning services to validate adherence with the external scanning requirements of PCI DSS Requirement 11.3.2,” and it publishes the full directory in a free, searchable list of Approved Scanning Vendors that you can filter by company, product, and region. The Council notes the list is updated frequently and advises verifying a vendor’s status before you engage them.
Practical guidance when buying:
- Check your processor first. Many payment providers bundle ASV scanning into an existing compliance program. Buying it separately is the most common way small merchants pay twice.
- Confirm what’s being scanned. The scan has to cover the IP addresses and domains actually in scope. A clean report on the wrong targets is worthless, and it’s a mistake nobody catches until after a breach. Note that this cuts the other way from everyday privacy advice: techniques for masking your IP address are useful for general browsing, but an ASV needs your real external addresses to scan them, and a VPN or proxy sitting in front of an in-scope system is something to disclose to the vendor rather than work around.
- Expect to fail the first one. Outdated TLS configurations and unpatched CMS plugins are routine findings. Remediation and a rescan are part of the process, not a sign you bought the wrong thing.
- Budget around $100–$500 per quarter for the scan itself (SecurityMetrics).
Merchants who fully outsource card handling and have nothing in scope facing the internet may not need an ASV at all. Confirm that with your acquirer before you sign anything.
When you need a QSA, and when you don’t
A Qualified Security Assessor is an independent organization qualified by the Council “to validate an entity’s adherence to PCI DSS,” and the Council maintains a searchable directory of QSA companies. One line on that page matters: the Council states plainly that qualification indicates only that the assessor has met its requirements, and that it “does not endorse these security solution providers or their business processes or practices.” Being on the list means qualified, not recommended.
You need a QSA if you’re a Level 1 merchant, over 6 million transactions annually, or if your acquiring bank specifically requires an assessor-led review. Otherwise you don’t. Levels 2 through 4 validate with a self-assessment questionnaire, and that covers essentially every independent food, floral, catering, and wholesale business.
The numbers explain why the distinction matters. QSA assessments average roughly $15,000, and a full Report on Compliance for a large merchant runs from $35,000 into six figures (Sprinto). Against that, a small merchant running the self-assessment route with scanning and remediation generally lands somewhere between $500 and $3,000 a year (Sprinto).
If a proposal for a small delivery business is quoting five figures, the first question to ask is which merchant level the scope was priced for. Sometimes the answer is that the assessor assumed you store card data, and the real fix is to stop doing that.
The free PCI resources to use before you buy anything
The Council publishes a set of small-merchant materials that cover a surprising amount of ground at no cost. All of these are free downloads from its merchant resources page:
- Guide to Safe Payments — plain-language guidance on payment risks and security fundamentals, available as a digital download or in spiral-bound form.
- Common Payment Systems — visual breakdowns that help you identify which payment system type you’re running, the risks attached to each, and the protections that apply. Useful when you’re trying to work out which SAQ fits.
- Questions to Ask your Vendors — a list of vendor categories with the specific questions to put to each about how they protect payment data. Read this one before any sales call.
- Glossary of Payment and Information Security Terms — plain explanations of the vocabulary, which removes a lot of the intimidation from the rest.
- PCI Firewall Basics — a one-page infographic on firewall configuration.
- Data Security Essentials Evaluation Tool — an online self-evaluation with accompanying forms for a preliminary read on where you stand.
The Council also publishes three short infographics on strong passwords, secure remote access, and patching, the three areas that account for most small-merchant compromises.
Separately, the official self-assessment questionnaire downloads are free. Any vendor charging you for access to the questionnaire itself is charging for a public document.
Scope reduction beats any service you can buy
The highest-return spending in PCI compliance isn’t a compliance service at all. It’s changing how card data moves so that fewer requirements apply.
Three things do most of the work, and your processor probably offers all three:
- Hosted checkout or embedded payment fields, so card numbers go from the customer’s browser straight to the processor and never touch your server.
- Tokenization for repeat customers, so standing wholesale accounts and weekly orders don’t require you to store a card number. Your systems hold a token that’s useless to anyone who steals it.
- Pay-by-link for phone orders. Instead of a customer reading a card number aloud, you send a link during the call and they enter it themselves. This takes the phone line, the employee, the workstation, and any call recording out of scope in one move (Shuttle).
The difference in obligation is substantial: merchants who fully outsource card handling qualify for the shortest questionnaire, while those storing card data electronically land in the longest (Secureframe). Same business, same revenue. The work of meeting the PCI DSS requirements shrinks or grows almost entirely based on these three decisions.
Ask your processor what it already includes before you price any of it separately. A lot of small merchants are paying a non-compliance fee on their statement while sitting on unused tooling that would resolve it.
How to evaluate a PCI compliance vendor
A few questions separate a service sized for you from one sized for somebody else:
- Which merchant level did you price this for? If the answer isn’t Level 4, the quote isn’t yours.
- Is this included with my payment processor already? Ask the processor, not the vendor.
- What exactly is in scope for the scan? Specific IPs and domains, named.
- Is the SAQ tooling optional? The questionnaires are free public documents; you’re paying for guidance, not access.
- What happens when a scan fails? Rescans should be included. If each one is billable, the annual cost isn’t what you were quoted.
- Are you on the Council’s current list? For an ASV or QSA, verify it yourself in the directory rather than taking the logo on the website at face value.
Frequently asked questions
Do I need to pay for PCI compliance services at all?
Possibly not much. If you have internet-facing systems in scope you need an ASV scan, which is typically $100–$500 per quarter (SecurityMetrics). Everything else is free: the questionnaire, the Council’s small-merchant guides, the assessor and scanning directories. Many processors bundle the scan and an SAQ wizard into what you already pay.
What’s the difference between an ASV and a QSA?
An Approved Scanning Vendor runs the external vulnerability scans required by PCI DSS. A Qualified Security Assessor is an independent organization qualified to validate an entity’s adherence to PCI DSS, generally through an on-site assessment. Both are listed by the PCI Security Standards Council, which notes that listing is qualification, not endorsement.
How much should PCI compliance cost a small business per year?
For a Level 4 merchant on a self-assessment route, published estimates generally run from around $500 to $3,000 annually, covering scanning, questionnaire work, and remediation (Sprinto). Environments that store card data or run custom checkouts cost more, which is itself an argument for not storing card data.
Is a “PCI compliance certificate” from a vendor worth anything?
It’s the vendor’s own document, not a Council credential. What carries weight is the Attestation of Compliance you sign alongside your questionnaire. Vendor certificates can be a convenient summary for a client’s procurement team, but nobody should be paying a premium for one.
Can my payment processor handle PCI compliance for me?
It can handle a large share of it and often includes the tooling, but it can’t do all of it. You remain the merchant of record, you still attest annually, and you’re still responsible for card data that moves through parts of your business the processor never sees: phone orders, paper, staff devices. Ask specifically what’s included and what stays with you.
Buy the scan, use the free guides, fix the flows
For most small businesses taking cards, the PCI services decision comes down to three moves. Ask your processor what its program already covers. Buy an ASV scan if you need one and it isn’t bundled. Download the Council’s small-merchant guides, which cost nothing and answer most of what’s left.
Then spend your actual effort on scope: hosted checkout, tokenized repeat customers, pay-by-link instead of card numbers read down the phone. Every dollar there removes obligations permanently, which is more than any compliance subscription does for the same money.
