Which PCI certification path fits you?
Six questions, two minutes. We’ll point you at the right certification path -- SAQ self-assessment, QSA-led readiness, or full ROC -- based on your volume, acquirer requirements, and how card data touches your systems.
Why the path matters more than the price
Most PCI budget disasters aren’t about overpaying an assessor -- they’re about buying the wrong engagement: a ROC when an SAQ would do, or a cold-start ROC that fails because nobody did readiness first. Answer honestly; the quiz below routes you to the path that fits your situation, with typical costs and timelines for each.
The 2-minute quiz
1. How many card transactions does your business process per year?
2. Do you store, process, or transmit card data on behalf of other businesses (a service provider)?
3. What has your acquirer (or a card brand) told you they require?
4. Has your environment been through a PCI assessment before?
5. How does card data touch your systems?
6. What's driving your timeline?
How scoring works
Each answer is worth 0–2 points (max 12). 0–4: your profile fits the SAQ path. 5–8: QSA-validated SAQ or a readiness assessment. 9–12: a full ROC with a QSA. This is a routing aid, not an assessment opinion -- confirm your required validation with your acquirer in writing.
Know your path? Get quotes
Assessors scope fees around your path. Tell us where you stand and get matched.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.