Pricing guide
PCI audit cost, line by line, with the drivers behind it
PCI audit cost is more than the assessor's fee. Readiness and remediation are usually the larger half, so a realistic budget includes every line below.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Published ranges for PCI audit cost
These are US market ranges for 2026.
| Line item | Range |
|---|---|
| Gap analysis and readiness | $8,000 to $40,000. |
| Remediation and implementation | $30,000 to $150,000. |
| Policy and documentation | $10,000 to $30,000. |
| QSA-led ROC assessment | $50,000 to $250,000. |
| SAQ completion support | $500 to $20,000. |
| Quarterly ASV scanning | $1,200 to $8,000. |
| Annual penetration test | $15,000 to $45,000. |
| Typical Level 2 first year | $85,000 to $190,000. |
The drivers of PCI audit cost
Six drivers explain most of the difference between businesses. So check each before comparing quotes.
- Transaction volume: two to ten times, because it sets your level
- Which form applies: three to eight times
- Size of the card environment: up to five times
- How you take payment: up to three times
- Network separation: up to double
- First time or renewal: year two is often 40 to 60 percent of year one
Estimate your PCI audit cost drivers
Tick each statement that is true. More ticks usually mean a higher total.
Your result appears here as you tick, so you can see what is still open.
PCI audit cost floors that signal trouble
Very low quotes usually mean missing work. For example, under $5,000 for anything involving remediation or QSA coordination is not real work. Also, a penetration test under $8,000 is usually an automated scan, and a full report under $35,000 suggests an unrealistic scope.
Timing and availability
Compliance work clusters in the last quarter and again before March. Therefore rates and availability are both worse if you wait, so book before October where you can. The standard is in the PCI SSC document library.
What we charge for
We charge for readiness, remediation and documentation, quoted in writing. However, the QSA's fee is separate, because the assessment is always performed by an independent assessor.
Ask every provider to separate these lines in writing. That way, quotes become comparable, and you can see whether a low number simply leaves out remediation.
PCI audit cost questions
What is a typical PCI audit cost for a Level 2 merchant?
A first year often runs $85,000 to $190,000 all-in.
Why is year two cheaper?
Because documentation already exists, it often costs 40 to 60 percent of year one.
Is the PCI audit cost mostly the assessor?
No. Readiness and remediation are usually the larger half.
Do you charge for the assessment?
No. The QSA charges separately.
Related guides
Price your own PCI scope
Answer five questions on our home page. We reply with a written estimate for readiness and remediation.
Get my written estimate