PCI DSS compliance services for Australian organisations

PCI QSA Company · PCI DSS-compliant service provider · 12+ years · Fixed pricing available

Payment card information remains one of the most targeted forms of data. For Australian organisations that store, process or transmit cardholder data, PCI DSS compliance is a practical risk management requirement as much as a contractual one.

We focus on what PCI DSS was designed to achieve: practical, risk-driven improvements that reduce the likelihood and impact of compromise, not superficial checkbox activity.

What is PCI DSS compliance?

PCI DSS (the Payment Card Industry Data Security Standard) is a set of technical and operational requirements designed to protect cardholder data. Compliance means implementing, operating and maintaining a comprehensive set of controls relating to:

Network segmentation and security
Access control and authentication
Logging, monitoring and incident response
Secure software development
Vulnerability management
Physical security and hosted environments
Supplier and service-provider oversight

PCI DSS compliance applies to any organisation that touches payment card data, even indirectly. That includes retailers, e-commerce sites, service providers, franchise networks, billing platforms, hospitality groups and SaaS platforms that integrate payment processing.

DotSec has more than 12 years of experience securing payment environments for government, APRA-regulated entities, financial institutions, utilities and national retail organisations. The PCI DSS was designed to achieve practical, risk-driven improvements that reduce the likelihood and impact of compromise, and that’s what dotSec delivers!

Do I need PCI DSS compliance?

Your business will almost certainly need to be PCI DSS compliant if you:

Accept credit or debit cards (online or in-store)
Use a payment gateway or merchant provider
Store or transmit cardholder data (even temporarily)
Develop or host systems involved in payment processing
Are a managed service provider to organisations who themselves process cardholder data

PCI DSS compliance is not optional in Australia. It is expected by banks, acquirers, insurers, and partners, and is frequently required as part of due-diligence processes.

PCI DSS compliance in Australia

PCI DSS applies in Australia the same way it does globally. The standard is set by the PCI Security Standards Council, not by Australian regulators, and the technical requirements are identical regardless of jurisdiction. What differs is the local enforcement and regulatory context: your acquiring bank determines your validation requirements and merchant level; organisations regulated by APRA need to consider how PCI DSS controls align with their CPS 234 information security obligations; and where cardholder data constitutes personal information under the Privacy Act 1988, the Australian Privacy Principles apply independently.

For Australian merchants, this means PCI DSS compliance is rarely a standalone exercise. DotSec’s PCI engagements are scoped to fit alongside ISO 27001, Essential Eight, and APRA CPS 234 obligations where they apply, so you’re not duplicating control work across frameworks.

PCI DSS reporting options

The compliance requirements varies significantly depending on how your organisation handles card data. For example, merchants using fully hosted payment pages may qualify for a minimal SAQ A self-assessment, while those with broader card data environments face more extensive requirements.

In either case, non-compliance leaves your organisation exposed to card scheme fines, increased transaction fees, and potential loss of the ability to process card payments. Generally speaking, all merchants have reporting requirements, irrespective of their level.

However, the specific requirements differ: Most merchants, except for the highest level (Level 1), are typically required to complete a Self-Assessment Questionnaire (SAQ). Level 1 merchants, on the other hand, usually need to undergo an annual assessment by a Qualified Security Assessor (QSA).

Option 1: SAQ and AOC

For the bulk of merchants, the key to PCI DSS compliance is the Self-Assessment Questionnaire (SAQ).

Different SAQs exist, each tailored to different types of payment processing environments. The specific SAQ a merchant needs to complete depends on how they process card payments.

SAQ A (Self-Assessment Questionnaire A) is the leanest of the PCI DSS reporting paths, meaning that it can be used (in general) with very little effort or time.

Merchants prefer SAQ A because there are only 26 controls (and some of those might be non-applicable) and it’s often possible for the merchant to offload many of its PCI DSS responsibilities to third-party providers such as payment gateways or security service providers, as long as those third parties are themselves PCI DSS compliant.

To be eligible for SAQ A, all cardholder data functions must be fully outsourced to PCI DSS-compliant TSPs, and merchants must:

Not store, process, or transmit cardholder data on their systems.
Use only redirects, iframes, or hosted payment pages.
Confirm their ecommerce site is not susceptible to script-based attacks

Option 2: AOC and ROC

Tier 1 merchants and service providers, or those merchants/service-providers who have particular acquirer requirements, will need to report using a Report On Compliance (ROC).

In this scenario, DotSec’s Qualified Security Assessor (QSA) will formally assess how effectively the client meets the applicable requirements from the PCI DSS.

In contrast to the collaborative nature of a scoping or gap-analysis project, the QSA-led PCI DSS assessment will be a formal assessment process, the outcomes of which are documented in a formal Report on Compliance (ROC):

If DotSec’s QSA finds that the reporting entity is compliant with the requirements of the PCI DSS, then we’ll complete and deliver a RoC and an Attestation of Compliance (AoC).
If DotSec’s QSA finds that the entity does not comply with the requirements of the PCI DSS, then those findings will be documented in the RoC which will be delivered to the client, and a non-compliant AoC will be issued.

It is important to note that the formal QSA-led assessment must be conducted in a timely manner. As a QSA Company, dotSec would ensure that the client remains aware of the assessment timetable, impending deadlines and project completion date.

You tell us what you need: We'll deliver

DotSec sells PCI DSS work in three clearly-defined modes. Most engagements fall cleanly into one; some span two as scope evolves.

Full ROC: QSA-led end-to-end assessment.

Where the client requires a Report on Compliance (Level 1 merchants, larger service providers, contractually-mandated cases), DotSec delivers the full assessment as the QSA Company of record: scoping, evidence collection, control testing, ROC and AOC drafting, and submission liaison. Conducted by our credentialed QSA, with senior assessor support.

This work is typically a 6 to 14-week engagement depending on customer-specific reporting requirements and in-scope environment complexity.
Gap analysis, remediation, and partner-led ROC

Where a client has a pre-existing relationship with another QSA Company but wants independent technical depth on the remediation, DotSec runs the gap analysis against the current PCI DSS v4.0.1 control set, scopes and executes remediation work, and hands a remediation-complete environment back to the client’s chosen QSA for the formal ROC. Useful for clients who want to keep an existing assessor relationship but who also would like independent verification.
SAQ preparation and assistance

For SAQ-eligible merchants (most commonly SAQ A and SAQ A-EP), DotSec works through the questionnaire alongside the merchant’s team, validates that eligibility criteria are correctly understood (a frequent failure point, particularly around third-party scope), and produces the supporting evidence pack. Where SAQ work is bundled with TPSP review or remediation, scope expands accordingly.

Across all three modes, our PCI work is built on senior practitioners, not box-tickers.

Pricing approach

dotSec’s PCI DSS work is priced in one of two ways:

Fixed price: Our preferred approach. Where scope is clear (existing PCI environment, prior assessment available, well-defined SAQ work, or remediation against an agreed gap report), we provide a fixed quote upfront. No surprises, no scope creep absorbing cost.
Capped time-and-materials: If needed because scoping is genuinely uncertain (typically initial scoping, complex multi-entity environments, or significant payment-flow change underway), we work to a written upper cap with weekly, written progress checkpoints. You see costs in flight; you know what we’re doing in great detail, and we don’t bill past the cap without your written agreement.

While we won’t quote indicative numbers without first understanding scope, we will happily work through a scope with you. Engage us for a no-obligation scoping conversation.

Why choose dotSec for PCI DSS compliance in Australia?

dotSec stands out among other PCI DSS companies in Australia for a couple of important reasons:

Compliance by experience: We are a PCI DSS-compliant service provider with an AOC to prove it. We have first-hand experience implementing and maintaining a compliant PCI DSS environment, not just assessing others against it. We know what it takes to implement and maintain a compliant PCI DSS service.
Compliance experts: As well as being a PCI DSS QSA company, and a PCI DSS-compliant service provider, we are also ISO 27001 certified, and have years of hands-on, practical ISO 27001 compliance experience.
Qualified team: Our PCI DSS professionals hold a a wide range of certifications including QSA, ISO 27001, CISA, CISM and more. We’re not just a one-shot, tick-the-box QSA assessor company.
Independent and practical: Our recommendations are grounded in real implementation experience. We have remediated situations where clients received incorrect SAQ selection, mistaken controls, and impractical compliance guidance from less experienced providers.
Scope reduction focus: If we can reduce your compliance scope or simplify your reporting path, we will. Clients with well-scoped, right-sized compliance programs are better positioned for the long term — and tend to form longer relationships with the firms that help them get there. You can rely on us to provide experience-led and pragmatic advice.

PCI DSS compliance FAQ

Which version of PCI DSS applies now?

Answer: PCI DSS v4.0.1 is the current and only active version of the standard. PCI DSS v3.2.1 was retired on 31 March 2024, and the interim v4.0 was retired on 31 December 2024, leaving v4.0.1 as the sole active version from January 2025. A further milestone came on 31 March 2025, when the 51 future-dated requirements within v4.0.1 became fully mandatory, including expanded requirements for web-facing application security (script management), stronger multi-factor authentication, and targeted risk analysis. If your organisation last completed a PCI DSS assessment under v3.2.1, a gap analysis against v4.0.1 is worth undertaking.

Reference: PCI security blog

How do I know which SAQ applies to my business?

Answer: SAQ selection depends primarily on how your organisation processes card payments whether you use a hosted payment page, a direct integration, card-present terminals, or a combination. Selecting the wrong SAQ is a common and consequential error; it can create a false sense of compliance or impose unnecessary controls. dotSec can determine the appropriate SAQ for your environment as part of a scoping engagement.

Reference: What’s new blog post

How long does a PCI DSS assessment take?

Answer: It depends on which reporting path applies. A gap analysis engagement, covering SAQ determination, gap analysis, and SAQ completion and reporting, typically requires around one week of work. A QSA-led assessment leading to a Report on Compliance is not something we can estimate without a scoping conversation. The time required depends on how mature your organisation’s current controls are, whether you have completed a previous AOC and ROC, and the nature and extent of any compliance gaps. Contact dotSec to arrange a scoping discussion before committing to a timeline.

What is PCI DSS scope and why does it matter?

Answer: Scope defines which systems, people, and processes are subject to PCI DSS requirements. The broader the scope, the more controls must be implemented and evidenced. Scope reduction can be done using network segmentation, tokenisation, or outsourcing cardholder data functions to compliant third parties; which ever technique you choose, scope reduction is one of the most cost-effective ways to simplify compliance. dotSec’s scoping work routinely identifies opportunities to reduce scope before an assessment begins.

Reference: Segmentation and scoping guidance

What is PCI QSA?

Answer: A QSA (Qualified Security Assessor) is an individual certified by the PCI Security Standards Council to assess PCI DSS compliance and to issue Reports on Compliance (ROCs).

The PCI SSC also certifies the firms employing them as QSA Companies. DotSec is a registered PCI QSA Company.

Do we need a full QSA-led assessment, or will an SAQ work for our business?

Answer: It depends on transaction volume and payment-flow architecture.

Level 1 merchants (broadly, 6M+ Visa/Mastercard transactions per year, or any merchant compromised in a cardholder-data breach) generally need a QSA-led ROC. Most other merchants can self-assess via the appropriate SAQ. Service providers have their own threshold (300K+ transactions/year for Visa).

Acquirer requirements can override these defaults.

DotSec’s scoping conversation determines the right path.

How often is PCI DSS reassessment required?

Answer: Annually.

The Attestation of Compliance (AOC), whether produced via QSA-led ROC or merchant-completed SAQ, has a one-year validity.

Quarterly internal vulnerability scanning (Requirement 11.3.1) and ASV external scans (Requirement 11.3.2) run on their own cadences inside the year.

What next?

If you need to report under the PCI DSS, whether through a SAQ or a QSA-led assessment, dotSec can help you find the most direct, cost-effective path to compliance.

We take scope reduction seriously. Where there is a legitimate opportunity to narrow the compliance boundary through segmentation, tokenisation, or the use of compliant third-party services, we will identify it. A well-scoped engagement costs less, takes less time, and produces a more defensible result. That is good for you, and it is the basis of the kind of long-term working relationship we aim to build.

Premier Australian cyber security specialists

ISO 27001 consulting

Practical and experienced Australian ISO 27001 and ISMS consulting services. We will help you to establish, implement and maintain an effective information security management system (ISMS).

Penetration tests

dotSec’s penetration tests are conducted by experienced, Australian testers who understand real-world attacks and secure-system development. Clear, actionable recommendations, every time.

PCI DSS

dotSec stands out among other PCI DSS companies in Australia: We are not only a PCI QSA company, we are a PCI DSS-compliant service provider so we have first-hand compliance experience.

WAF and app-sec

Web Application Firewalls (WAFs) are critical, protecting web apps and services by inspecting and filtering malicious requests before they reach your servers. Web page or API, a WAF is your first defence.

Identity management

Multi-Factor Authentication (MFA) and Single Sign-On (SSO) reduce password risks, simplify access, letting verified and authorised users reach sensitive systems, services and apps.

Vulnerability management

dotSec provides comprehensive vulnerability management services. As part of this service, we analyse findings in the context of your specific environment, priorities and threat landscape.

Phishing and soc eng

We don’t just test whether users will click a suspicious link — we also run exercises, simulating phishing attacks that are capable of bypassing multi-factor authentication (MFA) protections.

Penetration testing

dotSec’s penetration testing services help you identify and reduce technical security risks across your applications, cloud services and internal networks. Clear, actionable recommendations, every time!

Managed SOC/SIEM

dotSec has provided Australian managed SOC, SIEM and EDR services for 15 years. PCI DSS-compliant and ISO 27001-certified. Advanced log analytics, threat detection and expert investigation services.

Secure configuration

We provide prioritised, practical guidance on how to implement secure configurations properly. Choose from automated deployment via Intune for Windows, Ansible for Linux or Cloud Formation for AWS.

Secure cloud hosting

Secure web hosting is fundamental to protecting online assets and customer data. We have over a decade of AWS experience providing highly secure, scalable, and reliable cloud infrastructure.

Essential eight

dotSec helps organisations to benefit from the ACSC Essential Eight by assessing maturity levels, applying practical security controls, assessing compliance, and improving resilience against attacks.

CIS 18 Critical Controls

Evaluation against the CIS 18 Controls establishes a clear baseline for stakeholders, supporting evidence-based planning, budgeting, maturity-improvement and compliance decisions

Advisory services

We have over 25 years of cyber security experience, providing practical risk-based guidance, advisory and CISO services to a wide range of public and private organisations across Australia.