PCI DSS Pricing Report 2026: Every Published Cost Figure, Cited
Nobody publishes their PCI invoice. So we collected every published cost figure we could find -- ten named sources, each with its scope and a link -- and laid them side by side. No averages invented, no surveys fabricated.
The numbers
Every row names its source -- no figure stands on our say-so alone. Source dates are the publication or last-update date we could verify; see the price-source ledger at the bottom for how each was collected.
| Cost item | Published range | Source | Source date | Scope / context |
|---|---|---|---|---|
| ROC assessment fee (QSA company) | $30,000–$200,000 | Linford & Company (firm-published) | 2026 | Fee depends on CDE scope and system complexity |
| ROC assessment fee (Level 1) | $20,000–$70,000+ | Accorp Partners | 2025 | Full Level 1 ROC; varies with environment complexity, locations, remediation |
| ROC assessment fee (Level 1) | $20,000–$75,000 / year | Basis Theory | 2026 | In-house cardholder environment; excludes build costs |
| ROC assessment fee (Level 1) | $25,000–$100,000+ | TrustNet | 2026 | Large enterprise, on-site QSA-led ROC |
| ROC assessment fee (Level 1) | $40,000–$70,000 | ValueMentor | 2026 | Level 1 on-site audit; average complexity $20k–$30k |
| ROC assessment fee (Level 1) | $50,000–$150,000 | Centraleyes | 2025 | QSA audit for businesses processing millions of transactions |
| ROC assessment fee | £35,000–£150,000+ | RedSecLabs (firm-published) | 2026 | Fixed-fee quotes after scoping; CDE complexity and maturity drive the band |
| QSA assessment (basic) | ~$15,000 | Compyl | 2026 | Basic certified-QSA assessment; complex assessments $100k+ |
| QSA/ROC assessment (market range) | $15,000–$100,000 | Akurateco | 2026 | Typical public market range across merchant sizes |
| QSA-led ROC | $30,000–$200,000 | UnderDefense | 2026 | Level 1 QSA-led ROC within $200K–$1M year-1 total program cost |
| QSA-assisted SAQ | up to $40,000 | Linford & Company (firm-published) | 2026 | Time-and-material or fixed fee depending on SAQ type |
| SAQ with QSA guidance | $3,000–$15,000 | Accorp Partners | 2025 | SAQ-based self-assessment with QSA guidance |
| SAQ support (market range) | $50–$10,000 | Akurateco | 2026 | Typical public market range for SAQ support |
| Penetration testing | $15,000–$75,000 | UnderDefense | 2026 | Annual pen test, Level 1 program |
| Penetration testing | $5,000–$30,000 | Akurateco | 2026 | Per test; climbs with apps, APIs, environments, mobile surfaces |
| Penetration testing | $5,000–$20,000 / year | Basis Theory | 2026 | Level 1 program |
| ASV scanning | $100–$500 / quarter | Akurateco | 2026 | Quarterly external scans by an Approved Scanning Vendor |
| Quarterly network scans | $500–$5,000 / year | Basis Theory | 2026 | Level 1 program |
| Compliance tooling | $20,000–$100,000 / year | UnderDefense | 2026 | Automation tooling, Level 1 program |
| Level 1 year-1 total program | $200,000–$1M | UnderDefense | 2026 | QSA fees + remediation + tooling + staff; remediation is 60–70% of spend |
- ROC fee: published 2025–2026 sources put a Level 1 Report on Compliance fee between $20,000 and $200,000+ -- one QSA company publishes $30k–$200k itself (Linford & Company, 2026).
- Typical mid-market band: mid-size ROC engagements are most often quoted $20,000–$100,000 -- our synthesis of the cited sources' overlapping ranges, not an independently measured average.
- SAQ path: QSA-assisted SAQ engagements run $3,000–$15,000 (Accorp Partners, 2025) -- roughly a quarter to a third of a ROC fee.
- Remediation is the biggest line: published sources put remediation, tooling, and staff at 60–70% of total first-year spend (UnderDefense, 2026) -- most "cost of PCI" discussions undercount by half.
- Pen testing: $5,000–$30,000 per test (Akurateco, 2026); ASV scans: $100–$500 per quarter.
See where your environment lands. Tell us your merchant level and scope once -- matched assessors send scoped, comparable quotes. Free · 2 minutes · no obligation.
Get scoped quotesWhat the data actually tells us
- ROC fees cluster $20k–$100k for mid-size engagements across the sources; the $150k+ tail is large-enterprise scope.
- The SAQ/ROC gap is enormous. Validating via SAQ instead of ROC -- where your acquirer allows it -- is the single biggest cost decision in PCI.
- Scoping drives everything. Sources independently agree: CDE size and complexity, not the assessor's brand, determine where you land in the range.
- v4.x raised the floor. The newly enforced requirements (script inventory, tamper detection, MFA everywhere, risk analyses) added first-year remediation work across the board in this cycle.
Methodology
What is this report?
A compilation of every published PCI DSS cost figure we could find from named, linkable sources, collected September 2026. It is a meta-analysis of published claims, not a survey we ran and not an average we computed.
How were sources selected?
Sources had to (1) name a dollar range or figure, (2) be publicly accessible, and (3) be attributable to a real company or author. Vendor and assessor blogs are included and labeled as such -- several sources sell adjacent services.
Why do the ranges differ so much?
Different scopes. A $3k SAQ engagement and a $200k+ Level 1 ROC program are both 'PCI costs.' The ranges below are only comparable when the scope matches -- read the scope column.
What isn't here?
Anything we couldn't source. We don't publish 'average PCI cost' as a single number because the underlying populations differ too much to average honestly.
How current is this?
Sources dated 2025–2026, collected September 2026. We plan to refresh this report annually; the methodology section will note what changed.
Sources
- Linford & Company — “What is the cost of a PCI DSS assessment?” — ROC: $30k–$200k (fee depends on CDE scope and complexity) · QSA-assisted SAQ: time-and-material or fixed fee up to $40k
- Accorp Partners — PCI QSA Services FAQ — SAQ with QSA guidance: $3,000–$15,000 · Full Level 1 ROC: $20,000–$70,000+
- UnderDefense — “PCI DSS Audit Preparation and Automation: Checklist, Tools, and Cost Breakdown for 2026” — Level 1 year-1 total: $200K–$1M · QSA-led ROC: $30K–$200K · Pen testing: $15K–$75K · Tooling: $20K–$100K/yr
- Akurateco — “PCI DSS Cost: Pricing Breakdown and Budgeting Guide” — SAQ support: $50–$10,000 · QSA/ROC assessment: $15,000–$100,000 · ASV scans: $100–$500/quarter · Pen test: $5,000–$30,000
- Basis Theory — “PCI Compliance Levels” — Level 1 assessment: $20,000–$75,000/yr · Quarterly scans: $500–$5,000/yr · Pen test: $5,000–$20,000/yr
- ValueMentor — “What Is a QSA and Why Do You Need One for PCI DSS?” — Average-complexity QSA assessment: $20,000–$30,000 · Level 1 on-site: $40,000–$70,000 · Large enterprise: $100,000+
- TrustNet — “PCI DSS Compliance Costs & Budgeting Guide (Part 3)” — Level 1 on-site QSA-led ROC: $25,000–$100,000+
- Centraleyes — “How Much Does PCI DSS Compliance Cost in 2025?” — Level 1 QSA audit: $50,000–$150,000
- Compyl — “How Much Does PCI Compliance Cost?” — Basic QSA assessment: ~$15,000 · Complex/large-enterprise: $100,000+
- RedSecLabs — PCI DSS QSA Company FAQ — SAQ consultancy: £8,000–£35,000/yr · ROC: £35,000–£150,000+ (fixed-fee after scoping)
Price-source ledger
How each figure above was collected and verified, in one place. An append-only log of verifications and corrections lives on our methodology page.
| Source | What we took from it | Source date | How verified |
|---|---|---|---|
| Linford & Company -- PCI assessment cost page | ROC $30k–$200k; QSA-assisted SAQ up to $40k | 2026 (page live) | Figures read directly from the firm's page; firm-published, quoted verbatim |
| Accorp Partners -- PCI QSA Services FAQ | SAQ with QSA guidance $3k–$15k; Level 1 ROC $20k–$70k+ | 2025 | Figures read directly from the page; ranges quoted verbatim |
| UnderDefense -- PCI DSS Audit 2026 guide | Level 1 year-1 total $200K–$1M; QSA-led ROC $30K–$200K; pen test $15K–$75K | 2026 | Figures read directly from the page; ranges quoted verbatim |
| Akurateco -- PCI DSS Cost guide | SAQ support $50–$10k; QSA/ROC $15k–$100k; ASV $100–$500/qtr; pen test $5k–$30k | 2026 | Figures read directly from the page; ranges quoted verbatim |
| Basis Theory -- PCI Compliance Levels | Level 1 assessment $20k–$75k/yr; scans $500–$5k/yr; pen test $5k–$20k/yr | 2026 | Figures read directly from the page; ranges quoted verbatim |
| ValueMentor -- What Is a QSA | Avg complexity $20k–$30k; Level 1 $40k–$70k; enterprise $100k+ | 2026 | Figures read directly from the page; ranges quoted verbatim |
| TrustNet -- PCI compliance costs guide (Part 3) | Level 1 ROC $25k–$100k+ | 2026 | Figures read directly from the page; ranges quoted verbatim |
| Centraleyes -- PCI DSS compliance cost 2025 | Level 1 QSA audit $50k–$150k | 2025 | Figures read directly from the page; ranges quoted verbatim |
| Compyl -- PCI compliance cost | Basic QSA assessment ~$15k; complex $100k+ | 2026 | Figures read directly from the page; ranges quoted verbatim |
| RedSecLabs -- PCI QSA company FAQ | SAQ consultancy £8k–£35k; ROC £35k–£150k+ | 2026 | Figures read directly from the page; firm-published, quoted verbatim |
Vendor and assessor blogs are included and labeled -- several sources sell adjacent services. No source was paid, and no figure is our estimate.
Get your own number
Published ranges are a starting point. Get scoped quotes from QSA firms for your actual environment.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.