PCI DSS Compliance Support

PCI DSS (Payment Card Industry Data Security Standard) is a global framework that applies to any organisation that stores, processes or transmits cardholder data. This includes retailers, e-commerce sites, SaaS providers, and service providers handling payment cards, regardless of transaction volume. Compliance is required by the major card brands (Visa, Mastercard, American Express, Discover, JCB) through your acquiring bank or payment service provider.

The cost of PCI DSS compliance depends on your merchant level, the complexity of your cardholder data environment, and which Self-Assessment Questionnaire (SAQ) applies to your business. Smaller merchants using fully outsourced payment processing (SAQ A) face significantly lower costs than those storing card data on their own systems. Evolve North provides tailored, proportionate quotes after an initial scoping conversation, so you only pay for what you genuinely need.

Most organisations achieve PCI DSS compliance within three to six months, though simple SAQ A scopes can be faster and complex environments may take longer. The timeline depends on your starting position, the gaps identified during the initial assessment, and how quickly technical and policy changes can be implemented. Evolve North begins with a gap analysis to give you a clear, realistic roadmap and prioritised action plan.

A Self-Assessment Questionnaire (SAQ) is a validation tool for merchants and service providers who are eligible to self-assess their PCI DSS compliance, while a Report on Compliance (ROC) is a formal assessment carried out by a Qualified Security Assessor (QSA) for larger merchants. The right route depends on your merchant level and how you handle card data. Evolve North helps you identify the correct SAQ type and supports you through completion and Attestation of Compliance (AOC).

Yes, you still need PCI DSS compliance even if you use a third-party payment processor, though your obligations are usually much lighter. Businesses that fully outsource payment handling typically qualify for SAQ A, the shortest questionnaire, but you remain responsible for protecting the redirect or iframe integration and maintaining basic security controls. Evolve North helps you confirm your correct SAQ and avoid common scoping mistakes.

An ASV (Approved Scanning Vendor) scan is an external vulnerability scan conducted by a vendor authorised by the PCI Security Standards Council, required quarterly for most merchants with internet-facing systems in scope. The scan identifies vulnerabilities that could expose cardholder data and must produce a passing result to support compliance. Evolve North offers PCI ASV scanning alongside consultancy for a coordinated approach.

PCI DSS requires penetration testing at least annually and after any significant change to the cardholder data environment, covering both the network layer and application layer. Testing must validate segmentation controls where used to reduce scope. Evolve North provides PCI-aligned penetration testing delivered by qualified testers, ensuring results meet the standard and give you actionable remediation guidance.

Evolve North’s PCI DSS services are delivered by certified PCI Professionals (PCIP) with over a decade of hands-on experience supporting UK organisations. Our consultants combine deep PCI expertise with broader Governance, Risk and Compliance (GRC) knowledge, so PCI DSS fits into your wider security strategy rather than sitting in isolation. To discuss your requirements, call 01748 905 002 or email info@evolvenorth.com.