Guide
PCI remediation, from findings to evidence
PCI remediation turns gap analysis findings into closed items with evidence. So it needs priorities, owners, a budget and a date by which each item must close before the QSA arrives.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Where PCI remediation starts
It starts with the gap analysis report. Each finding names a requirement, the gap and a suggested fix. Then you decide the order.
Because some fixes take months, start with the longest ones. For example, network changes or a new payment flow.
Prioritizing PCI remediation
Rank findings by effort and by effect on scope. A fix that removes systems from scope can close many gaps at once.
| Priority | Typical item |
|---|---|
| First | Scope reduction, such as removing stored card data |
| Second | Long technical changes, such as segmentation |
| Third | Process controls, such as reviews and approvals |
| Fourth | Documentation and policy updates |
PCI remediation check
Tick what your plan already has.
Your result appears here as you tick, so you can see what is still open.
PCI remediation budgets
Remediation work varies widely with scope and starting point. Our published range is $30,000 to $150,000. So set the budget after the gap analysis, not before.
Also plan internal time. Engineers and IT staff carry much of the work.
Evidence of each fix
A fix without evidence is not closed. So record what changed, when and who approved it. Then add the evidence to the requirement folder.
In addition, let the fix run for a while before the assessment, so records exist.
Tracking PCI remediation
Review progress weekly with owners. Then report to leadership every two weeks. As a result, blockers surface early.
Also keep the QSA informed about items that will not close in time.
Where Ashcroft helps
We plan remediation, coordinate owners and partners, and check evidence for each fix. Remediation support runs $30,000 to $150,000, and gap analysis $8,000 to $40,000. We are not a QSA. The standard is in the PCI SSC document library.
Also keep a short log of decisions. Because some fixes are traded off against others, the reasons get forgotten. So write one line per decision with the date and owner. In addition, share the log with the QSA when asked, because it explains the order of the work.
PCI remediation questions
How long does PCI remediation take?
Often three to nine months, depending on scope and findings.
What does PCI remediation cost?
It varies with scope. Our published range is $30,000 to $150,000.
Can PCI remediation continue after the assessment?
Some items can, with a documented plan, but discuss it with your QSA.
Who does the technical work?
Your teams, or partners you choose.
Related guides
Plan your PCI remediation
Send us your gap analysis findings. We reply with a written estimate, usually inside one business day.
Get my written estimate