The short answer
A PCI DSS consultant gets you ready before you are formally assessed. They confirm your scope, run a gap analysis against the 12 requirements of PCI DSS v4.0.1, manage remediation, write policies and prepare your SAQ or ROC evidence. A QSA assessment is the separate test that follows. Timing depends on your scope and gaps.
On this page
- What does a PCI DSS consultant do?
- PCI DSS consultancy or QSA assessment: which do you need?
- Can the same company consult and assess?
- When do businesses bring in a PCI DSS consultant?
- How does PCI DSS implementation work with a consultant?
- What should you look for in a PCI compliance consultant?
- PCI compliance consulting for US merchants and service providers
- Why Sovereign Secure
- How to get started
A PCI DSS consultant gets your business ready for PCI DSS before anyone formally assesses it. The work covers confirming what is in scope, finding the gaps against PCI DSS v4.0.1, planning and managing the fixes, writing policies, and preparing evidence for your Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC). Sovereign Secure is a PCI SSC-approved Qualified Security Assessor (QSA) company, so our PCI DSS consultancy is shaped by how assessments are actually run.
What does a PCI DSS consultant do?
A PCI DSS consultant turns the standard into a plan for your business: what applies, what is missing, who fixes it and by when. Our PCI DSS consulting services cover eight areas. Take one, or all of them.
| Service | What it involves | What you get |
|---|---|---|
| Scoping and scope reduction | Data-flow workshops to find everywhere card data is stored, processed or transmitted, then ways to shrink it: segmentation, PCI DSS tokenisation or outsourcing | A documented cardholder data environment (CDE) and a scope-reduction plan |
| Gap analysis and readiness | A requirement-by-requirement review against PCI DSS v4.0.1 | A gap report with priorities, owners and timescales |
| Remediation programme management | Running the fix list with your IT team and third parties, reviewing evidence as it arrives | Tracked progress and no surprises on assessment day |
| Policies and procedures | Writing the PCI DSS policies and procedures the standard requires, fitted to how you work | Documents staff can follow and an assessor can test |
| Targeted risk analysis (TRA) | The risk analyses v4.0.1 requires wherever you set your own frequency for a control (Requirement 12.3.1) | Documented TRAs that justify each frequency you choose |
| SAQ completion support | Confirming the right SAQ, checking eligibility, and reviewing answers and evidence before you sign | An SAQ and Attestation of Compliance (AOC) you can stand behind |
| v4.0.1 future-dated requirements | Closing the requirements that became mandatory on 31 March 2025, such as MFA for all non-console access into the CDE (8.4.2) and payment page script controls (6.4.3 and 11.6.1) | Working controls and evidence for the newest requirements |
| Service provider readiness | Preparing for SAQ D for Service Providers or a ROC, including six-monthly scope confirmation (12.5.2.1) and segmentation testing (11.4.6) | A realistic route to the AOC your customers ask for |
Whether you call the review a gap assessment or a readiness assessment, our guide to PCI DSS gap analysis explains what it covers, and our PCI DSS scoping guide explains the step before it.
PCI DSS consultancy or QSA assessment: which do you need?
You need a consultant to get ready and a PCI compliance audit to prove it. A consultant works alongside you and recommends. In a PCI QSA assessment, the assessor tests independently, through interviews, document review, sampling and observation, and reports. Most first-time programmes need both, in that order.
| Aspect | PCI DSS consultancy | QSA assessment |
|---|---|---|
| Purpose | Get ready: scope, gaps, fixes and documentation | Validate compliance formally |
| Output | Scope documents, gap report, remediation plan, policies, TRAs | ROC and AOC, or an SAQ validated by a QSA |
| Who relies on it | You and your project team | Your acquirer, the card brands and your customers |
| When | Before an assessment, or when something changes | On an annual cycle |
| Required? | No, it is optional | A ROC is required for Level 1 merchants (over 6 million card transactions a year) and Level 1 service providers (over 300,000), normally completed by a QSA; acquirers may ask for QSA involvement at other levels |
If you are new to PCI, our guide to PCI compliance in the UK explains who needs it, the merchant levels and what your acquirer expects.
Can the same company consult and assess?
Yes, with safeguards. The principle is simple: nobody should assess work they designed or built. PCI SSC sets independence requirements for QSA companies, and any firm offering both services should be able to tell you plainly how it meets them.
Before any engagement, we will explain how we keep advisory and assessment work separate for your organisation: who advises, who assesses, and how the two are kept apart. You are also free to use us for consultancy and a different QSA for your assessment, or the other way round.
Whoever you choose, ask these four questions:
- Will anyone who designed or implemented our controls be on the assessment team?
- Who reviews the assessment findings before the report is issued?
- Is any consultancy fee linked to the assessment outcome?
- Can we appoint a different QSA for the assessment if we prefer?
When do businesses bring in a PCI DSS consultant?
Most engagements start with a deadline, an acquirer letter or a customer questionnaire. Common triggers:
| Situation | What a consultant does first |
|---|---|
| A customer asks your business, as a service provider, for a PCI AOC for the first time | Confirms that you are a service provider, your level, and whether SAQ D for Service Providers or a ROC applies |
| Your acquirer is charging a monthly PCI non-compliance fee | Identifies the right SAQ, closes the gaps blocking it and gets it submitted |
| A previous assessment failed or stalled | Reviews the findings, separates real control gaps from evidence problems, and builds a remediation plan |
| Your e-commerce payment pages must meet 6.4.3 and 11.6.1 | Inventories payment page scripts, checks SAQ eligibility and sets up change- and tamper-detection |
| Your team takes card payments by phone | Maps where card numbers and security codes are spoken, keyed and recorded, and weighs descoping options such as payment links or DTMF masking (see our guide to taking card payments over the phone) |
| You are adding a payment channel, moving to the cloud or merging | Re-confirms scope before the change goes live, as Requirement 12.5.2 expects |
A note for e-commerce merchants: PCI SSC’s January 2025 update to SAQ A replaced requirements 6.4.3 and 11.6.1 with an eligibility criterion confirming your site is not susceptible to attacks from scripts. You still need to be able to justify that confirmation.
How does PCI DSS implementation work with a consultant?
Most engagements follow the same path, and you choose how much help you need along it.
- Discovery call. How you take payments, your merchant or service provider level, and your deadline.
- Scoping workshop. Data flows, systems and third parties, ending in a documented CDE.
- Gap analysis. A gap report and a prioritised plan with owners.
- Remediation. You close the gaps with our guidance, and we review evidence as it arrives.
- Readiness review. A final check before you sign your SAQ or your assessment begins.
Our PCI DSS compliance roadmap sets out the same path as a five-phase plan, with a free spreadsheet of tasks, owners and deadlines.
| Engagement model | Best for | How we quote |
|---|---|---|
| Fixed-scope gap analysis | Businesses that want a clear picture and will fix gaps themselves | Fixed quote after a scoping call |
| Retained consultant | Teams that want expert answers on demand through the year | An agreed allocation of days per month or quarter |
| Full programme management | First-time ROCs, service providers, and multi-site or multi-country estates | Fixed quote for each phase |
Cost depends on scope: payment channels, the number of locations and systems in the CDE, merchant or service provider status, and how much documentation already exists. Our page on PCI compliance cost shows how these drivers add up. Where testing is part of the gap, we also provide PCI DSS penetration testing. External ASV scans are delivered through our PCI SSC Approved Scanning Vendor partner. If your card data environment runs in the cloud or with a hosting provider, our guides to AWS PCI compliance and PCI compliant hosting explain how responsibility is split.
What should you look for in a PCI compliance consultant?
Look for listed credentials, current v4.0.1 knowledge and a straight answer on independence.
- Listed credentials. Check the firm on the PCI SSC Qualified Security Assessor list. A QSA company knows what assessors test and what evidence they accept.
- v4.0.1 depth. Ask how they handle targeted risk analyses, the customised approach and payment page scripts.
- Scope first. A good consultant shrinks your scope before adding controls.
- Independence. Ask the four questions above.
- Defined deliverables. Scope documents, a gap report and a plan with owners, not open-ended days.
PCI compliance consulting for US merchants and service providers
PCI DSS is one global standard, so our PCI consulting works the same way in the US. Sovereign Secure has an office in Los Angeles, plus offices in Singapore, Dubai and Dhaka for multi-country estates.
Why Sovereign Secure
- A PCI SSC-approved assessor. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire) is a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company.
- Part of the assessor community. We are a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.
- The whole payments chain. We also assess PCI PIN and card production, so we see how card data moves beyond the web shop.
- Security we practise. We are ISO 27001 certified and also provide penetration testing and vulnerability scanning.
- Clients include Accor, Fiserv, Ticketmaster, Cashplus and Kuwait Finance House.
See our full range of PCI DSS compliance services.
How to get started
Need PCI compliance help? For a quick first view, try our free PCI compliance check. Then tell us how you take card payments and when you need to be compliant. We will confirm what applies to you, recommend the smallest engagement that gets you there, and send a fixed quote. Contact our PCI team or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
