Renewing Your PCI Certification: The Annual Cycle

The AOC is valid for one year. Here's how to make year two -- and every year after -- cheaper and calmer than year one.

What renews every year

• The validation itself: a fresh ROC or SAQ and a newly signed AOC, every 12 months.
• Quarterly ASV scans -- four passing scans a year, failures remediated and rescanned.
• Annual penetration testing (ROC path): network, application, and segmentation testing.
• Policy reviews, access recertifications, and risk analyses -- the governance layer most teams let lapse by month nine.

Year two is different

Renewal assessments reuse your scoping, evidence habits, and remediation muscle. Fieldwork typically shrinks (3–8 weeks vs 4–12), and fees often come down -- the assessor isn't learning your environment from zero. The trap: treating renewal as ‘the same thing again’ while the environment changed underneath you. New systems, new vendors, new locations all need scoping before fieldwork, not during it.

The continuous-compliance habit

The organizations with the cheapest renewals do a little PCI every month: review logs, track remediation, collect evidence as controls operate. The most expensive do nothing for ten months and then run a fire drill. If your QSA offers continuous evidence collection or a compliance portal, use it -- the discipline is worth more than the tooling.

Keeping scope tight

Scope is the silent budget killer across renewals: every new integration, cloud account, and office that touches the CDE adds testing surface. Make scope review part of change management -- any project that touches card data gets a PCI scope check before it ships. One undiscovered in-scope system found during fieldwork can restart testing.

When to re-bid your assessor

You can change QSA firms between annual cycles with no penalty beyond a new statement of work. Re-bid when: fees rose without scope growth, the team turned over, re-testing disputes soured the relationship, or your path changed (SAQ to ROC). Get competing quotes 3–4 months before your AOC expires -- we'll match you with assessors -- and let the incumbent compete too.