What Happens If You Fail a PCI Assessment?

Almost nobody passes a first assessment clean. Here's what ‘failing’ actually means in PCI -- and why it's a project phase, not a verdict.

There is no single ‘fail’

PCI assessments don't produce a pass/fail grade on the day. They produce findings: requirements where your controls didn't meet the standard. A handful of findings in a first ROC is normal; a report with zero findings on a first assessment would make an experienced QSA suspicious. What matters is what happens next.

The remediation window

After fieldwork, you get time to remediate before the QSA finalizes the report. Typical windows run weeks to a couple of months depending on finding severity and your acquirer's deadline. Critical findings (unpatched internet-facing systems, missing MFA on the CDE, card data where it shouldn't be) get fixed first; documentation gaps get fixed in parallel. Your internal owner should have engineering capacity pre-booked for this window -- findings competing with the product roadmap is how windows get missed.

Re-testing: get terms in writing

The QSA re-tests remediated controls before signing. Re-testing terms vary enormously: some firms include a round in the fixed fee, others bill hourly. This is the clause to negotiate before fieldwork -- surprise re-test invoices are among the most common PCI disputes. Ask: how many re-test rounds are included, at what rate beyond that, and with what turnaround?

What your acquirer can do

Consequences sit with your acquirer, not the QSA. Missed deadlines or unresolved material non-compliance can mean monthly non-compliance fees, elevated processing rates, or -- in persistent cases -- termination of card processing. In practice, acquirers work with merchants showing good-faith remediation progress; they punish silence and missed deadlines. Keep your acquirer informed: a remediation plan with dates beats quiet struggling every time.

How readiness prevents this

This entire cycle -- findings, remediation, re-testing -- is what a readiness assessment compresses into a low-stakes dry run. Findings discovered in readiness cost a fraction of findings discovered under ROC deadlines, because there's no clock, no re-test billing, and no acquirer watching. If this is your first assessment, readiness isn't optional diligence -- it's the cheapest insurance in the PCI process. The readiness path.