Search for help with PCI DSS and you can buy almost anything.
A consultant. A compliance platform. A QSA engagement. An ASV scan. Penetration testing. Managed security. A payment provider promising to reduce scope. An impressive dashboard that turns green when enough documents have been uploaded.
They all appear somewhere under the broad label of PCI DSS compliance solutions. They are not the same thing.
That sounds obvious until a company buys compliance software while its real problem is network segmentation. Or hires a consultant who produces an excellent gap report but nobody was budgeted to fix the gaps. Or assumes its payment provider "handles PCI," only to discover that several requirements never left the merchant's side of the table.
There is no PCI DSS appliance you can install on Friday and find yourself compliant on Monday morning.
Different problems need different people and tools. Before choosing one, name the problem first.
Free resource
Not sure where your PCI DSS gaps are yet?
Review all 12 requirement groups, separate control status from evidence status, and track owners, gaps, remediation dates, and supporting evidence in the editable tracker.
Download the PCI DSS Compliance Evidence ChecklistThis is the first distinction worth making.
A company searching for a "PCI DSS solution" might actually need help with scope, formal assessment, vulnerability scanning, penetration testing, evidence management, remediation, or ongoing control operation.
Those are different jobs. Some require specific PCI SSC qualifications. Some need engineers. Some need software. Some need all three at different stages.
The trouble starts when the buying process treats them as interchangeable.
Buying "a PCI solution" before defining which row you are in is a bit like walking into a hardware store and asking for "something for the house." You will probably leave with an object. Whether it fixes the leak is another matter.
A good PCI compliance consultant helps with CDE scoping, payment flows, gap analysis, control mapping, remediation planning, documentation, evidence preparation, and the awkward discussions where three departments each believe another department owns Requirement 12.
This is especially useful early in the process.
A consultant should help answer questions such as
But the word "consultant" tells you very little about formal qualification.
Someone can know PCI DSS extremely well without being a Qualified Security Assessor. And being hired as a PCI DSS consultant does not automatically give that person authority to perform the independent assessment your compliance program may require.
That distinction is worth checking before signing anything.
PCI SSC defines Qualified Security Assessor companies as independent security organizations that have been qualified by the Council to validate an entity's adherence to PCI DSS. PCI SSC also maintains a public list of qualified companies.
If somebody says they can "certify your PCI compliance," ask what qualification they hold and who will actually sign the assessment.
This is a boring procurement question right up until it becomes an expensive one.
Qualified Security Assessors are trained and qualified through PCI SSC to perform PCI DSS assessments. Whether your organization is required to use a QSA depends on the compliance program that applies to you, including requirements set by payment brands, acquirers, or other compliance-accepting entities. Some organizations validate through an applicable SAQ instead.
That means two mistakes are possible.
Those roles need some daylight between them.
For organizations that need both preparation and independent assessment, a cleaner model is often:
readiness and remediation → evidence preparation → independent assessment
Q-Sec follows that model; our PCI DSS compliance services handle readiness, implementation, remediation, and audit support, while our independent QSA partner performs the formal assessment and signs the applicable report.
You want technical help and independent judgment. Trying to turn them into the same thing can make everybody's life unnecessarily interesting.
An Approved Scanning Vendor has a defined role. PCI SSC describes an ASV as an organization approved to perform external vulnerability scanning used to validate the applicable PCI DSS external scanning requirements. The ASV scan solution itself is tested and approved through PCI SSC's program.
That is important work. It is also not a full PCI DSS assessment.
PCI SSC has an FAQ addressing exactly this: completing an ASV scan does not mean all other PCI DSS requirements were reviewed or found to be in place.
So if a vendor says:
"Congratulations, you passed your PCI scan."
Good.
Congratulations on passing the scan.
We still have eleven other requirement groups sitting at the table.
There is another current wrinkle for e-commerce merchants. PCI SSC clarified in June 2026 that applicable SAQ A merchants with webpages that redirect to a third-party payment provider or contain an embedded third-party iframe still have ASV scanning responsibilities for the merchant webpages under the current SAQ A requirements.
Outsourcing payment processing can reduce scope. It does not cause your website to become metaphysically unrelated to payment security.
A good penetration testing provider can help satisfy the testing work around Requirement 11.4, find exploitable weaknesses, validate segmentation, document findings, and retest remediation.
That does not make the pentest report a complete PCI DSS program.
It proves something specific. And specific evidence is good evidence.
If Requirement 11.4 is the problem you are solving, use the PCI DSS Penetration Testing Playbook rather than a generic compliance guide. It covers scope, testing domains, segmentation, methodology, readiness, and evidence expected around the engagement.
Q-Sec also has a detailed guide to PCI DSS penetration testing requirements if you need the technical background before scoping the test.
The important bit is simple: do not buy a penetration test when the real problem is "we have no idea whether our CDE scope is correct." Testing the wrong scope with great technical skill is still testing the wrong scope.
Consulting can tell you what needs to change.
At some point somebody has to log into the environment and change it.
Firewall rules need editing. Logging needs configuring. Vulnerabilities need remediation. Access needs tightening. Monitoring needs operating every day after the assessment meeting is over.
This is where a technical PCI DSS service provider or managed security team can be the right answer.
The buying question changes from, "Can you tell us what is wrong?" to, "Can you help us fix and operate it?"
That is a much more useful distinction than consultant versus provider as marketing labels.
For example, Q-Sec's PCI DSS compliance services cover scoping and gap assessment, remediation and hardening, continuous monitoring, QSA audit support, penetration testing, ASV scanning, and documentation support. The independent QSA work remains with its audit partner.
I like that split because it answers a question organizations often discover too late: "Who owns the work after the gap report arrives?"
A 93-page PDF full of red cells is not remediation. It is a very detailed description of your new to-do list.
In normal buying language, a PCI DSS service provider might mean "a company that provides PCI DSS-related services."
Inside PCI DSS, "third-party service provider" (TPSP) has a more specific meaning.
It can include organizations that store, process, or transmit payment account data for another entity, but also providers whose services can affect the security of the customer's CDE. PCI SSC's guidance covers providers that may have access to the CDE or provide services affecting its security even when they do not directly handle payment account data.
That distinction matters because outsourcing does not simply move PCI DSS responsibility into somebody else's building.
PCI SSC states that even merchants that outsource all payment processing remain responsible for checking that the provider is PCI DSS compliant for the relevant services, maintaining written responsibility agreements, monitoring compliance status at least annually, and understanding shared responsibilities.
And if a TPSP claims its own PCI DSS compliance, the customer should understand exactly what was covered.
PCI SSC expects TPSPs to provide evidence showing that the assessed scope included the services relevant to the customer and which requirements were examined. Where applicable, an AOC can be part of that evidence.
There is even a practical responsibility-matrix approach in PCI SSC guidance for documenting which requirements sit with the provider and which remain with the customer.
This is the part that gets lost in the sentence, "Don't worry, our vendor is PCI compliant."
I would worry a little. Not dramatically. No need to cancel lunch. Just ask for the AOC, check the covered services, and find the responsibility matrix.
Free resource
Before buying another PCI DSS “solution,” check what is missing
The PCI DSS Compliance Evidence Checklist helps you separate control gaps from evidence gaps, see who owns what, and track remediation across all 12 requirement groups.
Download the checklistTeams often compare vendors too early. They ask for demos, prices, certifications, dashboards, and sample reports. Nobody has written down what failure they are actually trying to correct.
So the shortlist ends up comparing organizations that do entirely different jobs.
A simpler starting point works better:
Name the problem before naming the provider
| Your actual problem | Start here |
|---|---|
| We are unsure what systems are in the PCI DSS scope | Scoping specialist / consultant |
| We need to know where our control gaps are | Gap assessment |
| We need independent formal assessment | QSA, where required |
| We need external vulnerability scanning | ASV |
| We need Requirement 11.4 testing | Penetration testing provider |
| We cannot manage evidence and recurring reviews | Evidence tracker or compliance software |
| We have known technical gaps and need them fixed | Technical PCI DSS / managed security provider |
| Our provider responsibilities are unclear | TPSP review and responsibility matrix |
| We need help across readiness, remediation, and assessment support | Broader PCI DSS compliance service |
That table will save more time than watching another 45-minute compliance platform demo. Possibly more money too.
There are many reasonable vendor questionnaires. I would start with seven questions that are slightly less polite and more useful.
1. What exact PCI DSS problem are you solving for us?
"PCI compliance" is not a sufficient answer. Ask for the specific work: scoping, assessment, scanning, testing, remediation, evidence management, control operation, or some combination.
2. What qualification do you hold?
If formal validation is part of the engagement, verify QSA status. If ASV scanning is required, verify ASV status. PCI SSC maintains public listings for both QSA companies and ASVs. A logo on a sales deck is quicker to obtain than a qualification.
3. What will we have at the end?
A gap report? Implemented controls? An AOC? A ROC? Passing ASV reports? A penetration test report? An evidence repository? A managed service still operating six months later? Deliverables are more useful than promises.
4. Which work remains ours?
This question is particularly important with software and TPSPs. Ask what your own team must configure, approve, review, retain, remediate, monitor, and submit. If the answer is "we handle everything," I would ask again, SLOWER.
5. Who fixes the gaps you find?
Some providers assess. Some advise. Some implement. Some do all three in different parts of the engagement. Find out before the first gap workshop, not after it.
6. How do you handle evidence?
Ask where evidence lives, how it is mapped, how current it must be, who owns it, and how findings connect to remediation. This is where attractive demos sometimes become considerably less attractive.
7. What happens next year?
PCI DSS is not a one-time construction project. Systems change. Suppliers change. People change. Evidence ages. New vulnerabilities appear. If the proposed service ends the moment the assessment document is signed, make sure somebody internally owns what happens after that.
You can outsource a lot of PCI DSS work.
You can outsource payment processing. You can use a QSA. You can hire an ASV. You can bring in pentesters. You can buy compliance software. You can run security through a managed provider.
What you cannot outsource is understanding what your organization is responsible for.
PCI SSC is quite clear on this with third parties: using a TPSP does not remove the merchant's obligation to understand and manage its own responsibilities.
That principle reaches beyond TPSPs.
Someone inside the organization still has to know:
A vendor can help immensely. A vendor cannot care about your PCI DSS program on your behalf. That job stubbornly remains yours.
There is a quick way to find out what sort of help you need.
Choose controls from several PCI DSS requirement groups and ask the owners to produce current supporting evidence. Not the controls everybody prepared last week.
Pick a few awkward ones. Try a firewall review. A user-access review. A vulnerability remediation record. A third-party AOC. A logging review. A penetration test retest.
Then look at what fails.
That is why we built the PCI DSS Compliance Evidence Checklist as a working readiness document rather than another explanation of the 12 requirements. It lets you track the control and the proof separately.
For the assessment process itself, read PCI DSS Audit and Assessment.
A consultant gives you expertise and direction. A QSA provides qualified independent assessment where required. An ASV performs the applicable external vulnerability scanning. A penetration testing provider tests security under Requirement 11.4. Compliance software helps organize recurring work and evidence. A technical security provider helps implement or operate the controls. A TPSP can take responsibility for defined services and requirements, but its responsibilities need to be documented and understood.
Most organizations eventually use more than one of these.
That is normal. The expensive mistake is buying one and expecting it to quietly become all the others.
Need help with the implementation side?
Q-Sec works on PCI DSS readiness, scoping, technical remediation, continuous security monitoring, evidence preparation, and assessment support, with independent QSA assessment handled by its audit partner.
See Q-Sec PCI DSS compliance servicesA PCI compliance consultant usually helps organizations get to grips with what they need to do to get compliant, identifies the areas where they're falling short, flags up any work that needs doing, and gets them ready to meet the rules. General consultants aren't automatically qualified to do all of a PCI SSC-qualified QSA's job.
PCI DSS compliance software helps organizations manage all the controls, evidence, and paperwork required to prove they're compliant, as well as schedule regular checks and track any remediation that needs to be done. It can make a lot of the administrative side of things a lot easier, but it's worth noting that it can't actually implement the technical controls or do the validation for you.
Not everyone does. The compliance requirements vary depending on which scheme you're signed up to — some places will let you complete a Self-Assessment Questionnaire (SAQ) while others require an actual QSA (Qualified Security Assessor) to come in and do the whole thing. The best advice is to go straight to your payment brand or acquirer for guidance on what exactly you have to do.
If you're looking for an ASV, you're looking for a company that has been approved by PCI SSC to do the external vulnerability scans that are part of the compliance process. Passing an ASV scan doesn't mean you're entirely compliant with the rest of PCI DSS, though.
Not always. When people say PCI DSS service provider, they're often just meaning a company that sells PCI-related services, whereas a TPSP (Third Party Service Provider) is a specific type of third party that handles payment data or can affect the security of your CDE (Card Data Environment).
Definitely not. Even if you're using a payment provider that is itself PCI compliant, you still retain a number of responsibilities, including keeping an eye on them, having a contract in place, checking that they're still compliant every year, and doing your own validation.
Yes, it's possible to find a supplier that will handle all of your PCI DSS compliance needs, from consulting and remediation to pentesting and monitoring. Just be aware that if you need to get formally assessed, then you may need to bring in someone else to do that bit independently. Make sure you know which bits they'll do directly and which will need to be outsourced to a partner before you start shopping around.