How to Prepare for a PCI Audit: A Step-by-Step Plan for PCI DSS

How to prepare for a PCI audit comes down to five things: confirm whether you need a Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ), get your scope right, run a gap analysis early enough to fix what it finds, complete the required scans and penetration tests, and organise your evidence by requirement so the assessor can test it. For a first ROC, allow several months: most of that time goes on remediation and building a track record, not on paperwork.

Most delays are not caused by missing technology. They are caused by unclear scope, evidence that cannot be found and testing booked too late. This plan follows PCI DSS v4.0.1, whose future-dated requirements have been mandatory since 31 March 2025.

Key takeaways

• Confirm with your acquirer whether you need a ROC or an SAQ, and which SAQ.
• Scope is the foundation; an incomplete scope is the fastest route to a failed audit.
• Run a gap analysis early enough to remediate what it finds.
• Book scans and penetration tests months ahead, leaving time to fix and retest.
• Organise evidence by requirement and name an owner for each area.

How long does it take to prepare for a PCI audit?

It depends on your starting point. The timeline below suits a first ROC; a well-run renewal compresses it into weeks.

PCI audit requirements: what the auditor (QSA) needs

PCI audit requirements come down to evidence that every applicable PCI DSS v4.0.1 requirement is in place and has worked throughout the assessment period. Whether your PCI auditor is a QSA writing a Report on Compliance or validating your SAQ, expect to provide:

Download the free PCI DSS document index (Excel, no sign-up) to use as your evidence checklist. Its “Evidence for the period” sheet lists the scans, tests, reviews, logs and provider AOCs to keep for the assessment period, and the index lists every policy, procedure, diagram and record by requirement, with columns for owner, progress and location. For sampling, have complete lists ready (in-scope systems, users, changes and locations), because the assessor picks samples from them.

The steps below build this evidence in order. How often you face these PCI DSS audit requirements is set by your acquirer and the card brands; our PCI compliance audit page explains the cycle.

Step 1: Do you need a ROC or an SAQ?

Your acquirer, or the card brands for service providers, decides how you validate. Level 1 merchants and Level 1 service providers generally need a ROC completed by a Qualified Security Assessor. Smaller organisations usually complete an SAQ, although some acquirers ask for a QSA-led assessment anyway. Our guide to PCI compliance levels explains the thresholds.

Before anything else, confirm:

• Your merchant or service provider level.
• The validation document you must submit, and which SAQ if applicable. Our guide on which PCI SAQ you need walks through the options, and our free PCI compliance check suggests your likely SAQ.
• Your submission deadline.
• Whether any payment channels or entities are to be assessed separately.

Step 2: Is your scope right?

Scope covers all people, processes and technology that store, process or transmit cardholder data, plus systems that connect to them or can affect their security. That includes systems many organisations forget: directory services, logging servers, patch management, jump hosts and administrators’ workstations.

Prepare current network and data flow diagrams (1.2.3 and 1.2.4), an inventory of in-scope system components (12.5.1), a list of service providers with their Attestations of Compliance and a responsibility matrix (12.8), and evidence that segmentation works if you rely on it. Requirement 12.5.2 requires a documented scope confirmation at least every 12 months, which is the assessor’s natural starting point. Our PCI DSS scoping guide explains the method.

Step 3: Where are your gaps?

Compare your controls and evidence with every applicable requirement, using a PCI compliance checklist or a QSA-led gap analysis. Do it early; a gap found a week before fieldwork is a finding, not a fix. Our free PCI DSS compliance roadmap template turns the gaps you find into a plan with owners and deadlines.

Areas where v4.0.1 commonly produces gaps:

• Targeted risk analyses for requirements where you set the frequency (12.3.1).
• Documented roles and responsibilities for each requirement area.
• MFA for all non-console access into the cardholder data environment (8.4.2).
• Authenticated internal vulnerability scanning (11.3.1.2).
• Automated log review (10.4.1.1).
• Payment page script management (6.4.3 and 11.6.1).
• Awareness training covering phishing and social engineering (12.6.3.1).

Step 4: What should you fix first?

1. Reduce scope where you can, through tokenisation, outsourcing or better segmentation.
2. Fix high-risk technical gaps, such as missing MFA, unsupported systems and weak segmentation.
3. Start controls that need a track record, such as quarterly scans, six-monthly reviews and log review.
4. Formalise policies and procedures so they match what people actually do.
5. Complete targeted risk analyses and other v4.0.1 documentation.

If the list is long or your team is stretched, a PCI DSS consultant can run the remediation programme while the assessment stays independent.

Step 5: Are your scans and penetration tests done?

Testing takes time to schedule, and findings take time to fix.

• External scans. At least quarterly by a PCI SSC Approved Scanning Vendor, with passing results. We deliver ASV scans through our PCI SSC Approved Scanning Vendor partner.
• Internal scans. At least quarterly, authenticated where systems accept credentials, with high-risk and critical findings resolved and rescanned.
• Penetration testing. Internal and external tests at least every 12 months and after significant change, following a documented methodology (11.4). Our PCI DSS penetration testing is scoped to Requirement 11.4.
• Segmentation testing. At least every 12 months for merchants and every six months for service providers.

For a recurring assessment, the assessor expects four quarters of passing scans. For a first assessment there is some flexibility if the most recent scan passed and you can show a documented quarterly process.

Step 6: Is your evidence ready?

An assessor validates each requirement through document review, interviews, observation and sampling. Make that easy with an evidence library organised by requirement.

Evidence must cover the assessment period, not just the week before fieldwork. If a quarterly task was missed, say so and show what you have done about it.

Step 7: What happens during the audit?

Assessments can be on site, remote or a mix. Either way:

• Appoint a single coordinator to track requests and chase responses.
• Brief subject matter experts and make sure they are available during fieldwork.
• Answer accurately and concisely. If someone does not know, they should say so and find out.
• Log every request and what you provided, so nothing is lost or sent twice.

If the assessor finds a gap, ask whether it can be fixed and validated within the assessment window. A missing policy approval can be resolved quickly; other items will need a remediation plan agreed with your acquirer.

Step 8: What happens after the audit?

The assessor issues the ROC and an Attestation of Compliance (AOC), which you submit to your acquirer or, as a service provider, make available to customers. Then keep controls operating until next year: a compliance calendar with owners for quarterly scans, six-monthly reviews, annual testing and training, and scope confirmation. Our guide to maintaining PCI DSS compliance year-round shows how.

Why do PCI audits stall?

The usual culprits are an incomplete scope, missing or expired third-party AOCs, scans or tests completed too late to remediate, and policies that do not match practice. Our article on common PCI audit failures covers each in more detail.

Working with a QSA company

Sovereign Secure is a PCI SSC-approved Qualified Security Assessor company and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028; our PCI QSA page explains what a QSA does and how to verify one. We run gap analyses and readiness reviews, deliver the scanning and penetration testing the standard requires, and carry out your PCI compliance audit. For budgeting, see our guide to PCI compliance cost.