Payment card information remains one of the most targeted forms of data. For Australian organisations that store, process or transmit cardholder data, PCI DSS compliance is a practical risk management requirement as much as a contractual one.
years testing for government and enterprise
CREST-accredited through CREST ANZ
dotSec is a PCI QSA Company and a PCI DSS-compliant service provider, with more than 12 years securing payment environments.
We focus on practical, risk-driven improvements that reduce the likelihood and impact of compromise, not checkbox activity. Fixed pricing is available.
PCI DSS (the Payment Card Industry Data Security Standard) is a set of technical and operational requirements that protect cardholder data. It applies to any organisation that touches payment card data, even indirectly: retailers, e-commerce sites, service providers, franchise networks, billing platforms, hospitality groups and SaaS platforms that integrate payment processing.
PCI DSS was designed to achieve practical, risk-driven improvements that reduce the likelihood and impact of compromise. That is what we deliver.
accept credit or debit cards, online or in store
use a payment gateway or merchant provider
store or transmit cardholder data, even temporarily
develop or host payment systems, or manage IT for organisations that process cardholder data
PCI DSS is not an Australian law, but banks, acquirers, insurers and partners expect it, and it is frequently part of due diligence. We have secured payment environments for government, APRA-regulated entities, financial institutions, utilities and national retailers, and help managed service providers navigating SAQ A eligibility.
PCI DSS applies in Australia the same way it does globally. The standard is set by the PCI Security Standards Council, not by Australian regulators, and the technical requirements are identical in every jurisdiction. What differs is the local context.
Sets PCI DSS v4.0.1 and the reporting templates. The requirements are the same worldwide.
Determines your merchant level and how you must validate compliance, and can override the defaults.
APRA-regulated organisations need to consider how PCI DSS controls align with their CPS 234 information security obligations.
Where cardholder data is personal information, the Australian Privacy Principles apply independently of PCI DSS.
So PCI DSS compliance is rarely a standalone exercise. We scope PCI engagements to fit alongside ISO 27001, the Essential Eight and APRA CPS 234 where they apply, so you are not duplicating control work across frameworks.
Requirements vary with how you handle card data. All merchants have reporting requirements, whatever their level, and non-compliance exposes you to card scheme fines, higher transaction fees and the possible loss of the ability to take card payments. Most merchants below Level 1 complete a Self-Assessment Questionnaire (SAQ); Level 1 merchants usually need an annual assessment by a Qualified Security Assessor (QSA).
For most merchants, the key is the SAQ. Different SAQs suit different payment environments. SAQ A is the leanest path: it covers a small subset of requirements, and much of the responsibility can sit with PCI DSS-compliant third parties such as payment gateways. To be eligible, all cardholder data functions must be outsourced to compliant providers, and the merchant must:
Level 1 merchants and service providers, or those with particular acquirer requirements, report through a Report on Compliance (ROC). A QSA is an individual certified by the PCI SSC to assess compliance and issue ROCs, and the SSC certifies their employers as QSA Companies; dotSec is one. Our QSA formally assesses how well you meet the applicable requirements. If you comply, we deliver a ROC and an Attestation of Compliance (AOC); if not, the findings go in the ROC and a non-compliant AOC is issued. We keep you on top of the timetable and deadlines.
We deliver PCI DSS work in three clearly defined modes. Most engagements fall into one; some span two as scope evolves. Across all three, the work is done by senior practitioners.
For Level 1 merchants, larger service providers and contractual requirements, we are the QSA Company of record: scoping, evidence collection, control testing, ROC and AOC drafting, and submission liaison, by our credentialed QSA with senior assessor support. Typically 6 to 14 weeks.
If you already work with another QSA Company but want independent technical depth, we run the gap analysis against PCI DSS v4.0.1, scope and carry out remediation, and hand a remediation-complete environment back to your chosen QSA for the ROC.
For SAQ-eligible merchants (most often SAQ A and SAQ A-EP), we work through the questionnaire with your team, check eligibility is understood (a frequent failure point around third-party scope) and produce the evidence pack.
We price PCI DSS work in one of two ways. We will not quote indicative numbers without understanding scope, but we will happily work through a scope with you in a no-obligation conversation.
Where scope is clear (an existing PCI environment, a prior assessment, well-defined SAQ work, or remediation against an agreed gap report), we quote a fixed price upfront. No surprises, and no scope creep absorbing cost.
For initial scoping, complex multi-entity environments or major payment-flow change, we work to a written upper cap with weekly written progress checkpoints. You see costs as they accrue, and we do not bill past the cap without your written agreement.
We assess against PCI DSS, and we live under it ourselves.
We are a PCI DSS-compliant service provider with an AOC, so we know what it takes to implement and maintain a compliant environment, not just assess others against one.
As well as being a PCI QSA Company and a compliant service provider, we are ISO 27001 certified, with years of hands-on ISO 27001 experience.
Our PCI DSS professionals hold certifications including QSA, ISO 27001, CISA and CISM.
Our recommendations come from implementation experience. We have helped clients recover from incorrect SAQ selection, mistaken controls and impractical compliance guidance.
If we can reduce your scope or simplify your reporting path, we will. Well-scoped, right-sized compliance programmes cost less and hold up better over time.
Our articles and case studies cover the practical questions that come up most often in scoping conversations.
Surprise PCI compliance request? An Australian SAQ guide
Reduce PCI DSS reporting time and cost with SAQ A
How lack of staff awareness can sabotage PCI DSS
TPSP AOCs save you money
SAQ A eligibility for MSPs
When your website provider handles payments
PCI DSS v4.0.1 is the only active version. v3.2.1 was retired on 31 March 2024 and v4.0 on 31 December 2024. The 51 future-dated requirements in v4.0.1, including script management, stronger MFA and targeted risk analysis, became mandatory on 31 March 2025 (PCI SSC). If you last assessed under v3.2.1, a gap analysis is worthwhile.
It depends on how you take card payments: a hosted payment page, a direct integration, card-present terminals, or a mix (PCI SSC on SAQs). Choosing the wrong SAQ is a common, consequential error that can create false confidence or unnecessary work. We determine the right SAQ as part of scoping.
It depends on the reporting path. SAQ determination, gap analysis and SAQ completion typically take around one week. A QSA-led ROC needs a scoping conversation first, because it depends on how mature your controls are, whether you have a previous AOC and ROC, and the extent of any gaps.
Scope is the systems, people and processes subject to PCI DSS. The broader it is, the more controls you must implement and evidence. Segmentation, tokenisation or outsourcing to compliant providers can reduce it (PCI SSC guidance), and is one of the most cost-effective ways to simplify compliance.
It depends on transaction volume and payment flows. Level 1 merchants (broadly, more than 6 million Visa or Mastercard transactions a year, or any merchant that has had a breach) generally need a QSA-led ROC; most others self-assess with an SAQ. Service providers have their own threshold (300,000 Visa transactions a year). Your acquirer can override these defaults.
Annually. An AOC, whether from a QSA-led ROC or a merchant-completed SAQ, is valid for one year. Quarterly internal vulnerability scans (Requirement 11.3.1) and ASV external scans (Requirement 11.3.2) run on their own cycle within the year; see our vulnerability scanning service.
If you need to report under PCI DSS, through an SAQ or a QSA-led assessment, dotSec can help you find the most direct, cost-effective path to compliance.
We take scope reduction seriously: a well-scoped engagement costs less, takes less time and produces a more defensible result.
