Guide
PCI audit preparation before the QSA arrives
PCI audit preparation in the last two months is about logistics. The controls should already run, so the job is to organize evidence, book interviews and close open items.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What PCI audit preparation covers at this stage
By now, scope is settled and the gap analysis is closed. However, the QSA still needs evidence, interviews and observations. So the work turns into project management.
Name a coordinator, share a tracker and set a response time for QSA requests. Then onsite days run smoothly.
Organize evidence by requirement
File evidence by requirement number. Then the QSA can trace each item without asking. Also add a short index per folder.
| Folder | Typical content |
|---|---|
| Scope | Data flow diagram, network diagram, inventory |
| Policies | Approved policy set with dates |
| Scans and tests | Four quarterly scans, annual test, retest |
| Access | User lists, reviews, MFA settings |
| Logging | Log review records |
| Vendors | Service provider list, AOCs, responsibility matrix |
PCI audit preparation check
Tick what is ready.
Your result appears here as you tick, so you can see what is still open.
PCI audit preparation for interviews
The QSA interviews owners and watches some processes. So brief each person on their area and book backup people. Also choose a quiet room or a stable video link.
In addition, do not script answers. Honest, short answers work best.
Closing open items
List anything still open from the gap analysis. Then decide which can close before fieldwork and which need a documented plan. Because surprises cost time, tell the QSA about known gaps early.
Also check that the last quarterly scan passed and the retest is done.
Common PCI audit preparation mistakes
Rewriting policies at the last minute is common. However, the QSA looks for policies that operated, not new ones. Another mistake is missing service provider AOCs.
So collect vendor documents early, since they depend on other companies.
Where Ashcroft helps
We run the tracker, prepare owners and check evidence before the QSA sees it. Our gap analysis fee runs $8,000 to $40,000. We are not a QSA, so the assessment stays with an independent QSA company. The official QSA company list shows who can assess.
PCI audit preparation questions
When should PCI audit preparation start?
Readiness starts months earlier. Final logistics usually start six to eight weeks before fieldwork.
Who leads PCI audit preparation?
A coordinator, often the compliance or security lead.
Is PCI audit preparation different for an SAQ?
Yes. With an SAQ, you complete the questionnaire yourself, although evidence still matters.
Should we tell the QSA about gaps?
Yes. Early notice helps plan the assessment.
Related guides
Start PCI audit preparation in time
Tell us your assessment date and scope. We reply with a written estimate, usually inside one business day.
Get my written estimate