Buying toolkit
The PCI RFP brief & quote comparison worksheet
Comparable quotes require a comparable brief. Send every QSA company the same scope — then compare the engagement letters line by line.
The brief: what to send every QSA
- Validation path and level. Merchant level or service-provider level, and which card brands.
- Scope sketch. Locations, in-scope systems, cardholder data flows, service providers, payment channels (e-commerce, POS, MOTO).
- Environment. Cloud providers, on-prem, hybrid; in-house vs. outsourced processing.
- History. Last assessment date and outcome, current PCI DSS version posture, known gaps.
- Timeline. When you need the signed ROC and why (acquirer deadline, deal, renewal).
- What you want quoted. ROC assessment, gap assessment, pen test, ASV scans — separately line-itemed.
The comparison worksheet
| Line | Firm A | Firm B | Firm C |
|---|---|---|---|
| Quoted fee (fixed?) | |||
| Assumed scope (in writing?) | |||
| Named assessment team | |||
| Fieldwork window | |||
| Fee-breaker clauses | |||
| Re-testing policy | |||
| Pen test / ASV included? | |||
| Remediation support | |||
| Renewal-year pricing | |||
| References checked |
Print this page and fill it in — the worksheet is designed to work on paper.
Engagement-letter red flags
- No named team. “To be staffed” means you’re buying whoever’s free.
- Vague scope with broad re-scoping rights. The fee-breaker that isn’t a fee-breaker — it’s a blank check.
- Remediation sold by the same team that finds the gaps. Name the conflict; prefer separation.
- No renewal pricing. Year-two surprises are a choice — make them quote it now.
- Guaranteed outcome language. No honest QSA guarantees a pass.
Skip the RFP paperwork
Our free quote form sends a structured brief to matched QSA companies — two minutes, no RFP document needed.
How it works: tell us once (4 questions, 2 min) → we match accredited QSA companies to your size and scope → they send scoped quotes directly. Free, no obligation.