Service
A PCI readiness assessment so your assessor finds no surprises
A PCI readiness assessment prepares you for the formal assessment. It goes beyond listing gaps: it reduces scope, organises evidence and rehearses the questions your assessor will ask.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
What a PCI readiness assessment includes
Readiness covers the whole path to assessment day. Therefore it combines several steps that are often bought separately.
- Scope reduction, where possible
- A ranked gap list against version 4.0.1
- A remediation plan with owners and dates
- An evidence package organised by requirement
- A dry run of assessor questions
Readiness compared with a gap assessment
A gap assessment tells you what is missing. Readiness, by contrast, gets you to the point where the assessment can start with confidence.
| Gap assessment | Readiness assessment | |
|---|---|---|
| Output | Ranked gap list. | Gaps, plan, evidence and rehearsal. |
| Scope reduction | Recommended. | Worked through with you. |
| Ends with | A report. | An assessment-ready environment. |
PCI readiness assessment self-check
Tick what is already true.
Your result appears here as you tick, so you can see what is still open.
Why a PCI readiness assessment saves money
Assessor time is expensive. So arriving with organised evidence and a smaller scope shortens fieldwork. Also, fixing gaps before the assessment avoids findings that delay your attestation.
Cost and timing
Gap analysis and readiness generally run between $8,000 and $40,000, depending on scope. Typically, fixing what a gap analysis finds takes three to six months. Therefore start well before your acquirer's deadline. The standard is in the PCI SSC document library.
Book early in the year where you can. Compliance work clusters before year end, so assessors and consultants both get busier then.
Where our work stops
We prepare you and coordinate with your assessor. However, we are not a QSA, so we never perform the assessment or sign anything.
Also agree with your acquirer which route applies before readiness starts. A questionnaire and a QSA assessment need different evidence, so knowing the route early avoids rework and wasted evidence.
PCI readiness assessment questions
When should a PCI readiness assessment start?
At least three to six months before your deadline, because remediation takes time.
Do we need one if we self-assess?
It helps, because the questionnaire still requires true answers and evidence.
Does a PCI readiness assessment include a mock audit?
It includes a dry run of assessor questions, although only a QSA performs the real assessment.
Will you choose our QSA?
No. We introduce independent firms, and you choose.
Related guides
Start your PCI readiness assessment
Tell us your deadline and payment methods. We reply in writing with a budget range.
Ask us anything