Services PCI DSS ROC Assessment
+44 20 3996 1505

PCI DSS ROC Assessment: QSA Report on Compliance

A Report on Compliance (ROC) is the formal assessment document a Qualified Security Assessor produces after testing every applicable PCI DSS requirement in your environment. It is the mandatory validation route for Level 1 merchants and most Level 1 service providers, and the strongest compliance evidence any entity can hold.

RedSecLabs is a PCI SSC Qualified Security Assessor (QSA) Company. Our QSAs plan, execute and document ROC assessments against PCI DSS v4.0.1: confirming scope, sampling systems, testing controls, validating remediation, and issuing the signed ROC and Attestation of Compliance (AOC) that acquirers, card brands and enterprise customers accept.

Engagements are readiness-first: we surface gaps before the formal assessment begins, so the ROC records a clean result rather than a remediation story.

CREST Member Company CREST Penetration Testing Provider PCI SSC Qualified Security Assessor (QSA) Company ISO 27001 Certified UKAS Accredited Certification AICPA SOC 2

Get Your Fixed-Fee Quote

Tell us what needs testing. You’ll get a scoped, fixed-fee quote back the same business day, from a senior assessor, not a sales rep. No obligation, no spam.

✓ Same-day response✓ Fixed-fee, no surprises✓ Senior testers only✓ Retest included

We reply within one business day with next steps. Your details are used only to scope your enquiry, never shared or sold.

✓ PCI SSC QSA Company · ✓ CREST accredited · ✓ UKAS-certified ISO 27001 & 9001 · ✓ IASME Certification Body · ✓ Same-day scoping response
Who this is for

This service is a fit if you’re..

1
Entities required to produce a ROC
Level 1 merchants and service providers whose acquirer or clients require a QSA-signed Report on Compliance.
2
Providers moving from SAQ D to ROC
Client procurement demanding a ROC instead of a self-assessment, often mid-contract.
3
Renewals after material change
Environment, processor or scope changed since last year and the next ROC needs to reflect it cleanly.

PCI DSS ROC Assessment, Quick Facts

Last reviewed: 2026-05-21
What it is
The formal QSA assessment document covering every applicable PCI DSS v4.0.1 requirement, issued with a signed Attestation of Compliance
Who needs it
Level 1 merchants and Level 1 service providers; any entity whose acquirer, card brand or customers require independent validation
Assessed by
A PCI SSC Qualified Security Assessor (QSA) Company; RedSecLabs QSAs deliver the assessment end to end
Inputs
Scope confirmation, dataflow and network diagrams, control evidence, system sampling, interviews, technical test reports
Typical duration
8-16 weeks scoping to signed ROC; renewal annually
Related testing
Quarterly ASV scans and annual penetration testing feed directly into ROC evidence
ROC
QSA-assessed, requirement by requirement
v4.0.1
Standard assessed
AOC
Signed attestation included
12
Requirement domains tested

What is a PCI DSS ROC?

The Report on Compliance is the PCI SSC's template for documenting a full QSA assessment. For each of the twelve PCI DSS requirement domains, the QSA records what was tested, how it was tested (observation, interview, sampling, configuration review), and whether each control is in place. The completed ROC is accompanied by the Attestation of Compliance (AOC), the summary document you actually share with acquirers and customers.

A ROC differs from an SAQ in rigor and standing: an SAQ is your own declaration, while a ROC is an independent assessment by a firm qualified by the PCI Security Standards Council. That is why Level 1 entities must use the ROC route, and why growing service providers often adopt it voluntarily, enterprise customers increasingly ask for an AOC backed by a ROC rather than a self-assessment.

Under v4.0.1 the ROC also captures the customised approach where used, targeted risk analyses, and the evidence trail for formerly future-dated requirements that became mandatory in March 2025. Renewal is annual, so evidence management between assessments determines how painful each cycle is.

What PCI DSS compliance delivers:

Eligibility to accept card payments under acquiring bank agreements

Reduced exposure to fines following any card data breach

Lower transaction fees with major card schemes

Cyber insurance coverage eligibility

Customer and partner trust around payment data handling

Evidence reusable for SOC 2, ISO 27001, and broader compliance programmes

Compliance is annual, and the bar continues to rise. v4.0.1 makes scoping accuracy and continuous control operation far more material than under previous versions.

Why PCI DSS matters

Card data breaches remain among the most damaging and costly cyber incidents an organisation can experience. Beyond direct fraud costs, breached merchants face card scheme fines, mandatory forensic investigation by PFI-approved investigators, increased transaction processing fees, and lasting customer trust damage.

PCI DSS is not optional, it is a contractual requirement under every major acquiring bank agreement. Non-compliance can result in fines starting from £5,000 per month, escalating significantly after a breach, and ultimately to suspension of card-acceptance privileges.

Common consequences of weak PCI DSS programmes:

Card scheme fines from £5,000 to £100,000+ per month

Mandatory PFI investigation after any suspected breach

Increased transaction processing fees

Acquiring bank termination of merchant agreements

Direct breach costs averaging £3.4M in the UK in 2025

Brand and customer trust damage following public incidents

Strong PCI DSS programmes reduce breach probability, limit financial exposure when incidents occur, and become a strategic asset rather than an annual overhead.

Who needs PCI DSS compliance?

PCI DSS applies to every organisation that interacts with cardholder data. RedSecLabs delivers across all merchant and service provider tiers:

E-commerce merchants (all levels)

Retail and in-person POS merchants

Payment service providers and gateways

Card processors and acquirers

Cloud hosting providers handling cardholder data

Contact centres processing phone payments

Software providers in PCI scope (payment apps)

Logistics and fulfilment where card data flows

If your organisation touches cardholder data, even briefly, even via redirect. PCI DSS applies. We scope your assessment level and SAQ type as the first step of every engagement.

Our PCI DSS Methodology

An eight-stage methodology covering the full PCI DSS compliance lifecycle, from initial scoping through annual renewal.

01

Scope Definition

We map cardholder data environments (CDE) and confirm which systems are in scope, in connected scope, or out of scope through network segmentation.

02

Merchant Level Determination

We confirm your merchant or service provider level and identify the correct assessment route. SAQ type or full Report on Compliance (ROC).

03

Gap Analysis

Comprehensive review against all 12 PCI DSS requirements with control-by-control evidence sampling and remediation prioritisation.

04

Remediation Support

Hands-on guidance on common weak areas: network segmentation, encryption key management, authenticated scanning, audit logging, secure development.

05

Quarterly ASV Scanning

External vulnerability scanning by approved scanning vendor (ASV) on a quarterly basis, with remediation support between scans.

06

Annual Penetration Testing

Network and application penetration testing meeting PCI DSS requirements 11.4.1-11.4.5, including segmentation validation.

07

Compliance Validation

QSA-led ROC or SAQ validation depending on your assessment route, producing the documentation acquirers require.

08

Annual Renewal & Continuous Compliance

Year-round programme management to keep controls operational, not just compliant at audit point.

Most clients reach first-time compliance in 3-9 months depending on starting maturity and CDE complexity, with annual renewal cycles thereafter.

What you receive

Every PCI DSS engagement with RedSecLabs includes:

  • Scope analysis and cardholder data environment documentation
  • Merchant level determination and assessment route confirmation
  • Gap analysis report against all 12 PCI DSS v4.0.1 requirements
  • Prioritised remediation roadmap with effort estimates
  • Quarterly ASV scan reports and remediation guidance
  • Annual penetration test report meeting requirements 11.4.1-11.4.5
  • QSA-validated ROC or signed SAQ with attestation of compliance
  • Ongoing compliance management and acquirer reporting support

Industries We Serve

We deliver this service across these industries:

E-commerce
Retail & POS
Payment Providers
Acquirers & Processors
Cloud Hosting
Contact Centres
Travel & Hospitality
Petroleum & Fuel

Why RedSecLabs for PCI DSS

PCI DSS rewards depth, not theatre. Our QSAs and PCI specialists have seen every common scoping mistake, every popular workaround that fails audit, and every remediation pattern that actually works. We deliver assessments that withstand acquirer scrutiny, and a continuous compliance programme that keeps your CDE controls operational year-round.

QSA-led assessments across all merchant levels
Scoping and segmentation expertise (v4.0.1)
ASV-grade quarterly vulnerability scanning
PCI DSS penetration testing to 11.4 standards
Annual renewal and continuous compliance support
Acquirer reporting and dispute support

Discuss Your ROC Requirement

Book a free 30-minute scoping call. Merchant level confirmation, SAQ recommendation, and fixed-fee quote within a week.

Book a Scoping Call Contact Us

Where to next

Related services and industry packages worth exploring.

PCI DSS UK

PCI DSS USA

PCI DSS Saudi Arabia

PCI DSS UAE

E-commerce & Retail package
Related reading

From the RedSecLabs research blog

From the blog

PCI DSS SAQ vs ROC: Choosing Your Compliance Path

Self-assessment questionnaire or formal Report on Compliance, which applies to your merchant level.

Read on the RedSecLabs blog
From the blog

PCI DSS 4.0.1: What Every Business Must Do

The 64 new requirements, what changes from 4.0, and the future-dated deadlines.

Read on the RedSecLabs blog
From the blog

PCI DSS Compliance Costs: 2026 Breakdown

What PCI DSS compliance actually costs across merchant level and environment complexity.

Read on the RedSecLabs blog
What the fixed fee includes
INCLUDED IN THE FIXED FEE
Scope validation • assessment plan and interview schedule • assessor-led testing of every applicable requirement • QSA-signed ROC and AOC • remediation debrief • re-verification of fixed items
PRICED SEPARATELY, NAMED UP FRONT
Quarterly ASV scans via our SSC-approved partner • Requirement 11 penetration testing • scope added after material change, quoted first
From first call to signed ROC
1
Scope confirmed
CDE boundaries, dataflows and applicable requirements agreed. Fixed fee follows the same business day.
2
Evidence, then interviews
Your evidence index fills before fieldwork, so interviews confirm rather than discover. Critical gaps flagged same-day.
3
ROC signed, AOC delivered
QSA-signed report your acquirer accepts first time. Fixes re-verified, letter issued, next year’s baseline already documented.

Frequently Asked Questions

Your merchant or service provider level and your acquirer's requirements decide it. Level 1 entities must complete a ROC; Levels 2-4 typically self-assess via the appropriate SAQ, though acquirers can require a ROC at any level and many service providers complete one voluntarily for commercial standing.

Every applicable requirement across the twelve domains: network security, cardholder data protection, vulnerability management, access control, monitoring, and security policy. Testing combines configuration review, sampling, interviews, observation and review of technical outputs such as penetration tests and ASV scans.

Start with an accurate scope: dataflows, CDE boundaries and connected-to systems. Then close known gaps and assemble evidence per requirement. Our readiness assessment produces a prioritised gap register and evidence index, most failed first-time ROCs trace back to scope errors or missing evidence, not missing controls.

Yes, within reason. Controls remediated and re-verified before the assessment concludes are recorded as in place. Structural gaps that need longer are documented with a remediation plan agreed with your acquirer.

CDE size and complexity, number of locations, sampling breadth, evidence readiness, and whether technical testing is included. We quote a fixed fee after scoping, and scope-reduction work often pays for itself within one renewal cycle.

The AOC goes to your acquirer (merchants) or to card brands and customers (service providers). The full ROC generally stays with you and your acquirer; customers and prospects normally only need the AOC.

Card brands and your acquirer may require a PCI Forensic Investigator (PFI) engagement, which only card-brand-listed PFI firms can perform. Our role sits either side of that: our incident response team contains and investigates alongside the process, and our QSAs rebuild your control environment and evidence base to v4.0.1 so revalidation after the incident is fast and credible.
What you receive

Every engagement includes

  • ✓ Scoping call. A 30-minute call to define scope, timeline, and authorisation boundaries.
  • ✓ Assessment plan. Written plan covering scope, evidence requirements, and assessment schedule.
  • ✓ Findings report. Control-by-control findings with evidence references and remediation guidance.
  • ✓ Executive summary. Board-ready 1-2 page summary with risk ratings and business impact.
  • ✓ Audit-ready evidence. Findings letter formatted for auditors, customers, and supervisory authorities.
  • ✓ Re-verification letter. Remediated gaps re-verified within an agreed window. Confirmation letter included.
  • ✓ Remediation call. A call with our lead assessor to walk through findings and remediation strategy.
How we deliver

Our process, end to end

  1. 1
    Scoping call & fixed-scope quote
    A 30-minute call. We define scope, targets, timeline. You get a fixed-scope quote within one working day. No surprise invoices.
  2. 2
    Assessment plan & authorisation
    Written assessment plan covering scope, evidence requirements and schedule. Authorisation and NDA in place before any work begins.
  3. 3
    Assessor-led execution
    A senior assessor runs the engagement. Material gaps flagged as they are found, not saved for the report. Daily updates if you want them.
  4. 4
    Technical + executive report
    Detailed technical findings with reproduction steps. Board-ready executive summary. Delivered within agreed working days.
  5. 5
    Remediation call & re-verification
    Walkthrough with our lead assessor. Re-verification of remediated gaps within the agreed window. Confirmation letter for your auditors.
Engagement scope

What shapes the quote

Small scope
Single environment, one framework, limited system count. 5-7 working days.
Medium scope
Multiple systems or sites, several control owners, integrations. 8-12 working days.
Enterprise scope
Complex estate, multiple entities or locations, full audit-grade evidence. 12-25 working days.
Fixed-scope quote within 1 working day
No surprise invoices, no scope-creep. We commit to a number before you commit to us.
Sample report
See exactly what we deliver
Download a redacted RedSecLabs report. Same structure, depth and clarity as the deliverables your team will receive.
Download sample report
Why RedSecLabs

Grounded reasons clients choose us

⚑
UK-based team
Testers based in the UK. Data stays within UK/EU jurisdiction for sensitive engagements.
❄
CREST member company
CREST-accredited methodology. Senior testers hold CREST CRT or CCT certifications.
⚙
Practitioners, not checklists
Assessments run by practitioners who also test systems hands-on, findings reflect how controls actually operate.
✎
Clear executive reporting
Reports your board can read and your developers can act on. No jargon padding.
♚
Compliance-aware delivery
PCI, SOC 2, ISO 27001, DORA, GDPR. We map findings to your compliance framework.
↺
Retest support included
Free retest of remediated findings within agreed window. Confirmation letter for auditors.
Related services

Often paired with this engagement

PCI DSS SAQ Assessment →
QSA-verified SAQ and countersigned AOC.
PCI DSS QSA Hub →
All PCI DSS assessment services.
PCI DSS Level 1 →
Level 1 merchant and service provider assessments.
Service Providers →
SaaS, fintech, PSP and gateway validation.
PCI DSS QSA (UK) →
Formal QSA assessment in the UK.
PCI DSS QSA (US) →
Formal QSA assessment in the US.
PCI ASV Scanning →
External quarterly scans (via ASV partner).
Network Pentesting →
Required under Requirement 11.
Web App Pentesting →
For payment applications.
📞 Call us Book a call