How Much Does PCI-DSS Compliance Actually Cost?
There is no single PCI-DSS price tag, and anyone who quotes you one number without first asking your merchant level, scope, and starting posture is guessing. Here is what drives cost, and what independently published estimates actually say — including where those estimates disagree with each other.
Why We Won’t Give You One Number
Unlike some frameworks, the PCI Security Standards Council does not publish official cost data, and there is no fixed government fee schedule to anchor to. Third-party estimates vary enormously depending on what they’re measuring — a Level 4 merchant filling out SAQ A themselves and a Level 1 merchant undergoing a multi-site QSA-led Report on Compliance are not remotely the same purchase, yet both get called “PCI compliance cost” in casual conversation.
Published industry estimates for total PCI-DSS cost span roughly $300 per year for the smallest self-assessed merchants up to $200,000 or more annually for large, complex Level 1 environments — a range wide enough that quoting the midpoint would mislead almost everyone reading it. The breakdown below is organized by what actually drives your number, not a single average.
Merchant Level: Self-Assessment vs. QSA Audit
This is the single biggest cost fork in PCI-DSS. See merchant levels for how your level is determined.
Figures synthesized from multiple independent industry publications (Centraleyes, ThePricer, Feroot, SISA, PoliWriter) current as of 2025–2026. These are market estimates, not audited data, and individual quotes vary meaningfully from vendor to vendor — treat the ranges as directional, not a quote.
In-House vs. QSA-Assessed, and What Each Actually Buys
A self-assessed SAQ can, in theory, cost nothing beyond staff time — the questionnaire itself is free, and a technically capable internal team can complete it without external help. In practice, most organizations still budget for quarterly ASV vulnerability scans (frequently quoted starting around $150/year for the smallest merchants and scaling up with the number of internet-facing IPs), and many bring in outside advisory support to avoid self-certifying incorrectly, given how easy it is to misjudge SAQ eligibility (see our SAQ types guide).
A QSA-led Report on Compliance is a fundamentally different purchase: a licensed Qualified Security Assessor tests evidence directly rather than accepting self-attestation, typically over several weeks of on-site or remote work. Published estimates for the QSA fee alone commonly fall in the $35,000–$100,000+ range for a standard engagement, with figures over $200,000 reported for the most complex, multi-cloud, multi-site environments.
Many organizations outsource ongoing PCI compliance management to a managed security provider rather than staffing it internally; publicly reported starting prices for that kind of managed support begin around $1,500/month, scaling with scope.
Scope Size and Remediation Need
Two organizations at the identical merchant level can see wildly different bills because of two variables that dominate everything else: how much of the environment is genuinely in scope, and how far the current security posture already is from meeting PCI-DSS controls before remediation begins.
Scope size. A tightly segmented cardholder data environment with a handful of systems costs dramatically less to assess than a flat network where every workstation and server is technically in scope. Segmentation work itself has an upfront cost, but it is consistently one of the highest-return investments in a PCI program because it shrinks every downstream cost — assessment fees, scanning fees, and the ongoing monitoring burden all scale with scope.
Remediation need. An organization with mature MFA, encryption, logging, and patch management already in place is largely paying for assessment and validation. An organization starting from a weak security baseline is paying for the underlying control implementation first — new network security controls, encryption projects, logging infrastructure, access control rework — and the assessment cost is almost a rounding error by comparison. Remediation cost estimates in published sources vary the most of any category, since it is entirely a function of gap size.
Non-Compliance Is Not Free Either
Card brands can levy recurring non-compliance penalties through the acquiring bank, and while the exact figures and escalation schedule vary by brand, acquirer, and contract, publicly reported penalty structures describe fines that start in the low thousands of dollars per month and escalate substantially the longer non-compliance continues. Those figures are set by acquirer and card-brand contracts we are not a party to, so treat any specific number you see quoted — including elsewhere on the web — as illustrative of the pattern (escalating, recurring, brand-specific) rather than a number that applies uniformly to every merchant agreement.
Separately, and more consequentially for most businesses: a confirmed cardholder data breach typically triggers forensic investigation costs, card-brand fines, potential Level 1 reclassification (see merchant levels), and reissuance costs for compromised cards — costs that consistently dwarf the price of the compliance program that would have prevented the breach.
Why We Don’t Publish a Fixed PCI Price Sheet
Given how much merchant level, scope, and starting posture move the number above, Armorstack does not publish a one-size PCI-DSS price table — anyone who does is either guessing on your behalf or quietly assuming a scope that may not match yours. Instead, VERITY runs a scoping conversation covering your merchant level, current segmentation, and existing control maturity, then returns a specific estimate for gap assessment, remediation, and ongoing CORE and SENTRY support tied to your actual environment.
That scoping conversation is free and non-binding, and it is the fastest way to replace an internet-average range with a number you can actually budget against.