Scans, Audits & Fees
5 tools, 7 guides, 1 vendor list
This is the recurring part: the external scans, the attestation you sign, the policies and training behind it, and the fee line on your statement that comes from your acquirer or processor, never from the Council. Most of it runs on a calendar.
Use the calendar and the checklist to see what falls due, the templates to write the policy and the incident plan, and the Council's list of approved scanning vendors to pick who runs your scan.
Tools
PCI Compliance Checklist
A printable checklist filtered by your SAQ type, grouped under the twelve requirement families.
- SAQ typepick one
- Progressper line
ResultChecklist
PCI Compliance Cost Calculator
Adds up your own PCI cost lines into a yearly total and shows what validating saves.
- Processor PCI feeper year
- Scan feeper year
- Staff timehours
ResultFee
PCI Policy Template Generator
Builds the information security policy a small merchant needs from its SAQ type.
- SAQ typepick one
- Setupterminal, website
ResultPolicy
PCI Deadline Calendar
Your last questionnaire and last passing scan, turned into the next scan windows and renewal date.
- Last SAQdate
- Last passing scandate
ResultDeadline
PCI Incident Response Plan Template
A printable incident response plan for a small merchant, with the contacts filled in by you.
- Contactsnames
- Setuphow you take cards
ResultPlan
Guides
- PCI Compliance Fees (and the Non-Compliance Fee)15 min
The PCI lines on your processing statement: who charges them, why, and how to stop the extra one.
- What Is a PCI ASV Scan?19 min
Which merchants need external scans, what a pass means, and what to do after a failed one.
- PCI Attestation of Compliance (AOC), ROC and QSAs Explained17 min
The paperwork names decoded: which one you send, which one you ask your vendors for, who signs.
- PCI Compliant Firewall Rules for Small Shops17 min
Network security controls in a one-router shop: keep the terminal apart and write the rules down.
- PCI Password and MFA Requirements19 min
What the standard asks of passwords and multi-factor sign-in, in plain words for a small team.
- PCI Security Awareness Training16 min
What the standard expects staff to learn, how often, and how a small shop can keep a record of it.
- PCI Penetration Testing Cost16 min
Which merchants need a penetration test, what drives its cost, and what to ask before you book one.
Guides7
Vendor lists
- Approved Scanning Vendors DirectoryCouncil list
The Council's own list of approved scanning vendors, filterable, with the date it was read.
Vendor lists1