Services PCI DSS Level 1
+44 20 3996 1505

PCI DSS Level 1 QSA Assessment & ROC

PCI DSS Level 1 is the highest validation tier: merchants processing over 6 million transactions annually across any card scheme, and service providers designated Level 1 by volume or by a card brand, must be assessed on-site by a Qualified Security Assessor and evidenced through a formal Report on Compliance (ROC).

RedSecLabs is a PCI SSC Qualified Security Assessor (QSA) Company delivering Level 1 assessments end to end: scoping, readiness review, evidence collection, control testing, remediation validation, and the final ROC and Attestation of Compliance (AOC) your acquirer and the card brands require.

We assess Level 1 merchants and service providers across retail, e-commerce, SaaS, payment processing and banking, with in-house penetration testers covering the Requirement 11 technical work under the same engagement.

CREST Member Company CREST Penetration Testing Provider PCI SSC Qualified Security Assessor (QSA) Company ISO 27001 Certified UKAS Accredited Certification AICPA SOC 2

Get Your Fixed-Fee Quote

Tell us what needs testing. You’ll get a scoped, fixed-fee quote back the same business day, from a senior assessor, not a sales rep. No obligation, no spam.

✓ Same-day response✓ Fixed-fee, no surprises✓ Senior testers only✓ Retest included

We reply within one business day with next steps. Your details are used only to scope your enquiry, never shared or sold.

✓ PCI SSC QSA Company · ✓ CREST accredited · ✓ UKAS-certified ISO 27001 & 9001 · ✓ IASME Certification Body · ✓ Same-day scoping response
Who this is for

This service is a fit if you’re..

1
Level 1 merchants
Over 6M transactions a year on any card brand, or elevated to Level 1 by your acquirer following an incident.
2
Level 1 service providers
Processors, gateways and hosting providers above 300k transactions, or asked by clients for a Level 1 AOC.
3
First-time Level 1 entities
Growing past self-assessment and facing your first full ROC cycle with acquirer scrutiny.

PCI DSS Level 1, Quick Facts

Last reviewed: 2026-05-21
Who requires it
Merchants over 6M transactions/year; service providers over 300,000 transactions or designated Level 1 by a card brand; entities escalated after a breach
Validation method
Full on-site/remote assessment by a QSA, documented in a Report on Compliance (ROC) with signed Attestation of Compliance (AOC)
Standard assessed
PCI DSS v4.0.1, every applicable requirement tested with evidence and sampling
Cadence
Annual ROC renewal, quarterly ASV scans (Req 11.3.2), annual penetration testing (Req 11.4)
Typical duration
8-16 weeks from scoping to signed ROC, depending on readiness and CDE complexity
Delivered by
RedSecLabs, PCI SSC QSA Company; in-house CREST penetration testing for Requirement 11
Level 1
Highest validation tier
ROC
Formal QSA-assessed report
6M+
Merchant transaction threshold
AOC
Acquirer-ready attestation

What is PCI DSS Level 1?

PCI DSS validation levels are set by annual card transaction volume and, for service providers, by card-brand designation. Level 1 merchants (over 6 million transactions annually) and Level 1 service providers (typically over 300,000 transactions, or any provider a card brand designates) cannot self-assess: their compliance must be validated by a Qualified Security Assessor through a full Report on Compliance (ROC) assessment covering every applicable PCI DSS v4.0.1 requirement.

A Level 1 engagement is materially different from an SAQ. The QSA tests each control directly, samples systems and personnel, reviews evidence over the assessment period, and documents the result requirement by requirement. The output is the ROC plus the Attestation of Compliance (AOC), the document acquirers, card brands and enterprise customers actually ask to see. Compromised entities of any size can also be escalated to Level 1 by the card brands, so breach history matters as much as volume.

Because Level 1 assessments repeat annually, the economics reward getting scope right: segmentation, tokenisation and third-party offloading can materially reduce the assessed environment year after year. Our scoping and segmentation assessment is often the first step for new Level 1 entities.

What PCI DSS compliance delivers:

Eligibility to accept card payments under acquiring bank agreements

Reduced exposure to fines following any card data breach

Lower transaction fees with major card schemes

Cyber insurance coverage eligibility

Customer and partner trust around payment data handling

Evidence reusable for SOC 2, ISO 27001, and broader compliance programmes

Compliance is annual, and the bar continues to rise. v4.0.1 makes scoping accuracy and continuous control operation far more material than under previous versions.

Why PCI DSS matters

Card data breaches remain among the most damaging and costly cyber incidents an organisation can experience. Beyond direct fraud costs, breached merchants face card scheme fines, mandatory forensic investigation by PFI-approved investigators, increased transaction processing fees, and lasting customer trust damage.

PCI DSS is not optional, it is a contractual requirement under every major acquiring bank agreement. Non-compliance can result in fines starting from £5,000 per month, escalating significantly after a breach, and ultimately to suspension of card-acceptance privileges.

Common consequences of weak PCI DSS programmes:

Card scheme fines from £5,000 to £100,000+ per month

Mandatory PFI investigation after any suspected breach

Increased transaction processing fees

Acquiring bank termination of merchant agreements

Direct breach costs averaging £3.4M in the UK in 2025

Brand and customer trust damage following public incidents

Strong PCI DSS programmes reduce breach probability, limit financial exposure when incidents occur, and become a strategic asset rather than an annual overhead.

Who needs PCI DSS compliance?

PCI DSS applies to every organisation that interacts with cardholder data. RedSecLabs delivers across all merchant and service provider tiers:

E-commerce merchants (all levels)

Retail and in-person POS merchants

Payment service providers and gateways

Card processors and acquirers

Cloud hosting providers handling cardholder data

Contact centres processing phone payments

Software providers in PCI scope (payment apps)

Logistics and fulfilment where card data flows

If your organisation touches cardholder data, even briefly, even via redirect. PCI DSS applies. We scope your assessment level and SAQ type as the first step of every engagement.

Our PCI DSS Methodology

An eight-stage methodology covering the full PCI DSS compliance lifecycle, from initial scoping through annual renewal.

01

Scope Definition

We map cardholder data environments (CDE) and confirm which systems are in scope, in connected scope, or out of scope through network segmentation.

02

Merchant Level Determination

We confirm your merchant or service provider level and identify the correct assessment route. SAQ type or full Report on Compliance (ROC).

03

Gap Analysis

Comprehensive review against all 12 PCI DSS requirements with control-by-control evidence sampling and remediation prioritisation.

04

Remediation Support

Hands-on guidance on common weak areas: network segmentation, encryption key management, authenticated scanning, audit logging, secure development.

05

Quarterly ASV Scanning

External vulnerability scanning by approved scanning vendor (ASV) on a quarterly basis, with remediation support between scans.

06

Annual Penetration Testing

Network and application penetration testing meeting PCI DSS requirements 11.4.1-11.4.5, including segmentation validation.

07

Compliance Validation

QSA-led ROC or SAQ validation depending on your assessment route, producing the documentation acquirers require.

08

Annual Renewal & Continuous Compliance

Year-round programme management to keep controls operational, not just compliant at audit point.

Most clients reach first-time compliance in 3-9 months depending on starting maturity and CDE complexity, with annual renewal cycles thereafter.

What you receive

Every PCI DSS engagement with RedSecLabs includes:

  • Scope analysis and cardholder data environment documentation
  • Merchant level determination and assessment route confirmation
  • Gap analysis report against all 12 PCI DSS v4.0.1 requirements
  • Prioritised remediation roadmap with effort estimates
  • Quarterly ASV scan reports and remediation guidance
  • Annual penetration test report meeting requirements 11.4.1-11.4.5
  • QSA-validated ROC or signed SAQ with attestation of compliance
  • Ongoing compliance management and acquirer reporting support

Industries We Serve

We deliver this service across these industries:

E-commerce
Retail & POS
Payment Providers
Acquirers & Processors
Cloud Hosting
Contact Centres
Travel & Hospitality
Petroleum & Fuel

Why RedSecLabs for PCI DSS

PCI DSS rewards depth, not theatre. Our QSAs and PCI specialists have seen every common scoping mistake, every popular workaround that fails audit, and every remediation pattern that actually works. We deliver assessments that withstand acquirer scrutiny, and a continuous compliance programme that keeps your CDE controls operational year-round.

QSA-led assessments across all merchant levels
Scoping and segmentation expertise (v4.0.1)
ASV-grade quarterly vulnerability scanning
PCI DSS penetration testing to 11.4 standards
Annual renewal and continuous compliance support
Acquirer reporting and dispute support

Plan Your Level 1 Assessment

Book a free 30-minute scoping call. Merchant level confirmation, SAQ recommendation, and fixed-fee quote within a week.

Book a Scoping Call Contact Us

Where to next

Related services and industry packages worth exploring.

PCI DSS UK

PCI DSS USA

PCI DSS Saudi Arabia

PCI DSS UAE

E-commerce & Retail package
Related reading

From the RedSecLabs research blog

From the blog

PCI DSS SAQ vs ROC: Choosing Your Compliance Path

Self-assessment questionnaire or formal Report on Compliance, which applies to your merchant level.

Read on the RedSecLabs blog
From the blog

PCI DSS 4.0.1: What Every Business Must Do

The 64 new requirements, what changes from 4.0, and the future-dated deadlines.

Read on the RedSecLabs blog
From the blog

PCI DSS Compliance Costs: 2026 Breakdown

What PCI DSS compliance actually costs across merchant level and environment complexity.

Read on the RedSecLabs blog

Frequently Asked Questions

Yes. Merchant Level 1 is triggered at 6 million+ annual transactions per card brand. Service provider Level 1 typically applies above 300,000 transactions, or whenever a card brand designates the provider Level 1 regardless of volume. Both require a QSA-assessed ROC, but service provider assessments usually cover broader multi-client environments and appear on the Visa and Mastercard registered provider lists.

Some acquirers accept ROCs completed by a PCI SSC-certified Internal Security Assessor for Level 1 merchants, but many still require an independent QSA, and service providers generally need a QSA Company. Confirm with your acquirer first; we frequently co-deliver with internal ISA teams where that model is accepted.

Expect configuration standards, network and dataflow diagrams, access-control records, logging and monitoring output, vulnerability and penetration test reports, policy and training records, and interview access to control owners. Our readiness phase produces an evidence register so nothing is discovered missing mid-assessment.

A prepared organisation typically completes scoping to signed ROC in 8-16 weeks. Remediation of gaps found during readiness is the main variable, which is why we run the gap phase before the formal assessment clock starts.

Pricing is driven by CDE size, number of locations and system types, evidence readiness, and whether penetration testing and ASV scanning are bundled. We quote fixed fees after a scoping call rather than publishing one-size-fits-all figures.

Requirements found not in place are remediated and re-tested within the assessment window where feasible. If remediation cannot complete in time, the ROC records the status and a remediation plan is agreed with your acquirer. Our readiness-first approach exists precisely to avoid surprises at this stage.
What you receive

Every engagement includes

  • ✓ Scoping call. A 30-minute call to define scope, timeline, and authorisation boundaries.
  • ✓ Assessment plan. Written plan covering scope, evidence requirements, and assessment schedule.
  • ✓ Findings report. Control-by-control findings with evidence references and remediation guidance.
  • ✓ Executive summary. Board-ready 1-2 page summary with risk ratings and business impact.
  • ✓ Audit-ready evidence. Findings letter formatted for auditors, customers, and supervisory authorities.
  • ✓ Re-verification letter. Remediated gaps re-verified within an agreed window. Confirmation letter included.
  • ✓ Remediation call. A call with our lead assessor to walk through findings and remediation strategy.
How we deliver

Our process, end to end

  1. 1
    Scoping call & fixed-scope quote
    A 30-minute call. We define scope, targets, timeline. You get a fixed-scope quote within one working day. No surprise invoices.
  2. 2
    Assessment plan & authorisation
    Written assessment plan covering scope, evidence requirements and schedule. Authorisation and NDA in place before any work begins.
  3. 3
    Assessor-led execution
    A senior assessor runs the engagement. Material gaps flagged as they are found, not saved for the report. Daily updates if you want them.
  4. 4
    Technical + executive report
    Detailed technical findings with reproduction steps. Board-ready executive summary. Delivered within agreed working days.
  5. 5
    Remediation call & re-verification
    Walkthrough with our lead assessor. Re-verification of remediated gaps within the agreed window. Confirmation letter for your auditors.
Engagement scope

What shapes the quote

Small scope
Single environment, one framework, limited system count. 5-7 working days.
Medium scope
Multiple systems or sites, several control owners, integrations. 8-12 working days.
Enterprise scope
Complex estate, multiple entities or locations, full audit-grade evidence. 12-25 working days.
Fixed-scope quote within 1 working day
No surprise invoices, no scope-creep. We commit to a number before you commit to us.
Sample report
See exactly what we deliver
Download a redacted RedSecLabs report. Same structure, depth and clarity as the deliverables your team will receive.
Download sample report
Why RedSecLabs

Grounded reasons clients choose us

⚑
UK-based team
Testers based in the UK. Data stays within UK/EU jurisdiction for sensitive engagements.
❄
CREST member company
CREST-accredited methodology. Senior testers hold CREST CRT or CCT certifications.
⚙
Practitioners, not checklists
Assessments run by practitioners who also test systems hands-on, findings reflect how controls actually operate.
✎
Clear executive reporting
Reports your board can read and your developers can act on. No jargon padding.
♚
Compliance-aware delivery
PCI, SOC 2, ISO 27001, DORA, GDPR. We map findings to your compliance framework.
↺
Retest support included
Free retest of remediated findings within agreed window. Confirmation letter for auditors.
Related services

Often paired with this engagement

PCI DSS SAQ Assessment →
QSA-verified SAQ and countersigned AOC.
PCI DSS QSA Hub →
All PCI DSS assessment services.
ROC Assessment →
QSA Report on Compliance, end to end.
Readiness & Gap →
Gap register and evidence index pre-assessment.
PCI DSS QSA (UK) →
Formal QSA assessment in the UK.
PCI DSS QSA (US) →
Formal QSA assessment in the US.
PCI ASV Scanning →
External quarterly scans (via ASV partner).
Network Pentesting →
Required under Requirement 11.
Web App Pentesting →
For payment applications.
📞 Call us Book a call