Get from PCI gaps to your ROC and AOC with a clear, fixed-price program.

Yes. The service is designed around the current PCI DSS requirements applicable to the engagement. PCI DSS v4.0.1 is the currently published active version of the standard as of September 2026.

Yes. The formal PCI DSS QSA assessment, ROC and AOC are included in all three packages for environments that remain within the agreed fixed-price scope.

No cybersecurity assessor can legitimately guarantee compliance regardless of the customer's environment. Successful completion depends on your organization implementing and operating all applicable PCI DSS controls and providing sufficient evidence for the assessor to validate them. ValueMentor will identify non-compliances and, depending on your package, provide different levels of assistance to help you address them.

That is exactly why every program starts with an assessment. Assessment customers remediate the identified gaps independently. Guided customers receive periodic ValueMentor advisory support. Complete customers receive hands-on support throughout the remediation program. If the underlying environment remains within the agreed scope, the number of initial PCI findings does not change the package price.

No. We explain the finding and identify what needs to be addressed, but your team determines and implements the remediation. If you need regular PCI advice, choose Guided. If you need hands-on support, choose Complete.

No. Your organization remains responsible for its systems and controls. ValueMentor helps manage the PCI DSS compliance program, supports documentation and evidence, advises your technical teams, tracks remediation and helps prepare the organization for assessment. Your team remains responsible for actions such as making cloud configuration changes, deploying software, administering users and operating security controls.

They are available through the optional PCI Security Testing Bundle for $7,500 per year. This includes quarterly ASV scanning, quarterly internal vulnerability assessments, annual network and application penetration testing, applicable segmentation testing and defined remediation retesting within the published scope limits.

You do not need to buy the testing bundle solely because you are purchasing a PCI DSS program. Existing testing may be used where it is applicable, current, sufficiently scoped and meets the relevant PCI DSS requirements. The QSA determines whether supplied evidence is sufficient for the assessment.

No. Testing triggered by significant application, infrastructure, CDE or architectural changes is quoted separately because the number and scale of such changes cannot be predicted when the fixed-price program begins.

The standard fixed-price program covers one primary cloud provider and up to three accounts, subscriptions or projects. Multi-cloud environments require scope review and may require custom pricing.

We can review up to 10 PCI-relevant third-party service providers as dependencies of your PCI environment. Their own systems and environments are not included in your ValueMentor assessment. If one of your providers requires its own PCI DSS assessment, that requires a separate scope.

The formal deliverables are the applicable PCI DSS validation documents, including the Report on Compliance and Attestation of Compliance. PCI SSC does not recognize a separate compliance certificate as a substitute for the official PCI DSS validation documents.

The fixed-price engagement is complete when the agreed assessment has been successfully finalized and the applicable ROC and AOC have been completed. PCI DSS compliance requires ongoing activities after the assessment. Secusy and ValueMentor can separately support recurring compliance, ASV scanning, vulnerability management, penetration testing and future annual assessments.