--- title: PCI DSS Compliance & SAQ Consulting | BorderHawk description: BorderHawk helps merchants and service providers secure cardholder data and complete PCI DSS SAQs, ROCs, and Attestations of Compliance. --- [Skip to content](https://www.borderhawk.com/pci-dss-consulting#main-content) [![BorderHawk Logo in White.](https://www.borderhawk.com/hs-fs/hubfs/BorderHawk%20Logos%20and%20Images/BorderHawk%20Logo%20in%20White..png?width=3050&height=975&name=BorderHawk%20Logo%20in%20White..png) ![BorderHawk LLC Logo Transparent Background](https://www.borderhawk.com/hs-fs/hubfs/BorderHawk%20Logos%20and%20Images/BorderHawk%20LLC%20Logo%20Transparent%20Background.png?width=3050&height=975&name=BorderHawk%20LLC%20Logo%20Transparent%20Background.png)](https://www.borderhawk.com?hsLang=en) [Contact Us](https://www.borderhawk.com/contact-us?hsLang=en) - [Home](https://www.borderhawk.com) - Solutions - [Cybersecurity Consulting](https://www.borderhawk.com/cybersecurity-consulting) - [Assessments](https://www.borderhawk.com/risk-assessments) - [Overwatch](https://www.borderhawk.com/overwatch-framework) - [M365/Endpoint Review](https://www.borderhawk.com/microsoft-cloud-and-endpoint-review) - [IR/BCDR Program Development](https://www.borderhawk.com/ir-bcdr-program-development) - Requirements - [CMMC](https://www.borderhawk.com/cmmc-consulting) - [BEAD / E-ACAM](https://www.borderhawk.com/bead-and-e-acam-consulting) - [HIPAA](https://www.borderhawk.com/hipaa-consulting) - [SOC](https://www.borderhawk.com/soc-2-consulting) - [PCI-DSS](https://www.borderhawk.com/pci-dss-consulting) - [About Us](https://www.borderhawk.com/about-us) - (470) 945-1979 # **PCI DSS Compliance Consulting** #### Meet Your PCI-DSS Compliance Requirements We work with organizations that accept, transmit, and store cardholder data (payment card information) to build cardholder environments, assess those environments, and validate attestations of compliance. Our information risk and cybersecurity services align your internal processes and leadership's expectations with PCI requirements. [![Talk to an Expert](https://no-cache.hubspot.com/cta/default/22562447/interactive-192914496395.png)](https://www.borderhawk.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJfWr%2FWIwaclhS2hWozZ7R%2FOLNeWb6fA1Us1G%2FPIlEpGigTJ9S%2FzystDgrmzaP1gaQQYIHh9UQG5yV01AkzMXFA3wpZq7ex%2FP%2FwICZTXOt6Gze%2BaZh3uxccgsVlSNpyA9uIe%2BoH114UQVNeDCeJK244RhfrmzxP%2FyF3AvA9h0oePTeNPiuCzRlvZuznNOBNRbEn3KpVEh5KmLe8%2Fjjb3fO536pXjcrbQGAu6kSi74LDyZxsSxDVCgd25mKXp6YHnrf1mYw%2BDA%3D%3D&webInteractiveContentId=192914496395&portalId=22562447&hsLang=en) ### PCI-DSS Requirements The Payment Card Industry Data Security Standard (PCI DSS) is a globally recognized framework developed by the PCI Security Standards Council to protect cardholder data and ensure secure payment processing. It was established by major credit card brands - Visa, MasterCard, American Express, Discover, and JCB - to create a unified standard for organizations that store, process, or transmit payment card information. PCI DSS outlines a set of technical and operational requirements designed to safeguard sensitive data, reduce fraud, and maintain trust in the electronic payment ecosystem. PCI DSS applies to all entities involved in payment card processing, including merchants, financial institutions, point-of-sale vendors, and service providers. The standard is structured around 12 core requirements grouped into six overarching goals, such as building secure networks, protecting stored cardholder data, maintaining a vulnerability management program, and implementing strong access control measures. Compliance with PCI DSS is not optional - any organization that handles payment card data must adhere to its requirements to avoid penalties, data breaches, and reputational damage. ### Payment Card Information Payment card information, also known as cardholder data, includes the primary account number (PAN) and may also include the cardholder's name, expiration date, and service code. In some cases, sensitive authentication data - such as full magnetic stripe data, CVV codes, and PINs - may also be involved, though this data must never be stored after authorization. PCI DSS is specifically designed to protect this information during storage, processing, and transmission, ensuring that it is encrypted, access-controlled, and monitored to prevent unauthorized use or theft. ![Payment Card Information](https://www.borderhawk.com/hs-fs/hubfs/Website%20Rebuild%20Photos%202025/Payment%20Card%20Information.png?width=1188&height=846&name=Payment%20Card%20Information.png) ### Compliance Requirements PCI DSS defines four levels of compliance based on the volume of transactions an organization processes annually. Level 1 applies to merchants processing over 6 million transactions per year and requires an annual Report on Compliance (ROC) conducted by a Qualified Security Assessor (QSA). Levels 2 through 4 apply to smaller merchants and typically require the completion of a Self-Assessment Questionnaire (SAQ), though some may also need quarterly network scans by an Approved Scanning Vendor (ASV). These levels help tailor compliance efforts to the size and risk profile of each organization.   The levels of compliance also determine the rigor of validation and reporting. For example, Level 1 merchants must undergo an annual on-site assessment and submit quarterly scans, while Level 4 merchants may only need to complete an annual SAQ and perform internal security reviews. This tiered approach ensures that organizations with greater exposure to risk are held to stricter standards, while still maintaining a baseline of security across the entire payment ecosystem.   Validation of compliance is a critical component of PCI DSS. Organizations must demonstrate that they have implemented the required controls through documentation, testing, and third-party assessments. Depending on their level, this may involve submitting a ROC, SAQ, for Attestation of Compliance (AOC) to acquiring banks or card brands. Regular validation not only ensures ongoing adherence to the standard but also helps identify and remediate vulnerabilities before they can be exploited. ### How We Can Help You   ### Community The BorderHawk Community, composed of security and compliance professional, offers strategic value to leadership and risk management teams. Within the community, leaders gain access to real-time insights on emerging threats, regulatory updates, and proven mitigation strategies - shared by BorderHawk experts and peers who face similar challenges. This collective intelligence accelerates decision-making, enhances incident response readiness, and fosters a culture of continuous improvement. For compliance officers and CISOs, the ability to benchmark practices, validate interpretations of complex regulations, and source solutions to nuanced problems reduces isolation and increases confidence in their programs. Ultimately, the BorderHawk community strengthens organizational resilience and ensures that security and compliance efforts are both proactive and aligned with industry best practices. ![Community Engagement](https://www.borderhawk.com/hs-fs/hubfs/Website%20Rebuild%20Photos%202025/Community%20Engagement.png?width=1149&height=790&name=Community%20Engagement.png) ![Risk Assessment](https://www.borderhawk.com/hs-fs/hubfs/Website%20Rebuild%20Photos%202025/Risk%20Assessment.png?width=1413&height=853&name=Risk%20Assessment.png)   ### Risk Assessment Risk assessments are essential for any organization aiming to maintain strong security and compliance postures. They provide a structured approach to identifying vulnerabilities, evaluating potential threats, and understanding the impact of security incidents on sensitive information. By regularly conducting risk assessments, organizations can prioritize resources effectively, implement targeted safeguards, and demonstrate due diligence in meeting their regulatory, contractual, and internal requirements. Risk assessments not only reduce the likelihood of data breaches and compliance violations, but also build trust with patients, partners, and regulators by showing a proactive commitment to protecting sensitive information. In a rapidly evolving threat landscape, risk assessments are not just a regulatory checkbox - they are a strategic necessity. ### Overwatch Compliance Framework A detailed compliance framework is critical for organization to navigate the complex landscape of regulatory and contractual mandates. Such a framework provides a structured, repeatable approach to managing policies, processes, incident response, and security controls - ensuring that every aspect of compliance is addressed systematically.  The rigor the Overwatch Framework brings helps eliminate gaps, reduce human error, and align internal practices with external expectations. Moreover, a well-documented framework enhances accountability, simplifies audits, and enables faster adaptation to regulatory changes. The Overwatch Framework transforms compliance from a reactive obligation into a proactive, strategic asset that supports operational excellence and builds stakeholder trust. ![Overwatch-just-logo](https://www.borderhawk.com/hs-fs/hubfs/Overwatch-just-logo.png?width=300&height=300&name=Overwatch-just-logo.png) [![Q4 Special](https://no-cache.hubspot.com/cta/default/22562447/interactive-192964813673.png)](https://www.borderhawk.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKCOANjkT7g1%2F5IC81HcCID%2B5coE2KqGIaeq%2BPTyqh63DO0Epn0BxslasOBMM3Odrpp%2B9nYNji5uYh5kPUJsAVfAv4mAVQaGJZNnTYykta2KobzEbal%2FJDcBa4eF2ADVWt20Ivrr63nhqzG2opp7JNiv4whpjo8q97vh6ozJxkRmdUFEE67V42WWmlvbtkvYl3lxV88tcLeOMySmA%3D%3D&webInteractiveContentId=192964813673&portalId=22562447&hsLang=en)   ### FAQs - #### What is a PCI DSS SAQ and which one applies to us?  A Self-Assessment Questionnaire (SAQ) is the streamlined form merchants use to attest to PCI DSS compliance; which of the several SAQ types applies depends on how you accept, process, and store cardholder data — BorderHawk helps determine the correct one for your environment. - #### What's the difference between an SAQ and a full PCI DSS Report on Compliance (ROC)?  An SAQ is a self-assessment available to smaller or lower-risk merchants; a ROC is a full assessment conducted by a Qualified Security Assessor (QSA), generally required for higher transaction volumes or more complex cardholder data environments. - #### What is a Cardholder Data Environment (CDE) and why does scoping it matter?  The CDE is the set of systems, people, and processes that store, process, or transmit cardholder data; correctly scoping the CDE is the single biggest driver of PCI DSS cost and effort, since it determines exactly which requirements apply. - #### Can outsourcing payment processing reduce our PCI DSS scope?  Yes — merchants that fully outsource payment processing to a PCI DSS-compliant vendor (through a redirect or hosted iframe) can often qualify for the shortest SAQ (SAQ A), significantly reducing their compliance burden - #### How often do we need to complete a PCI DSS assessment?  PCI DSS compliance validation, whether via SAQ or ROC, is required annually, along with quarterly vulnerability scans for most merchant levels. - #### What's an Attestation of Compliance (AOC)?  The AOC is the formal document submitted alongside your SAQ or ROC confirming the accuracy of your responses and your current PCI DSS compliance status, typically required by your acquiring bank or payment brand. - #### Does PCI DSS apply to us if we only take a small number of card payments?  Yes — PCI DSS applies to any merchant that accepts, processes, stores, or transmits cardholder data, regardless of transaction volume, though lower-volume merchants generally qualify for a simpler SAQ. - #### What's the difference between a merchant and a service provider under PCI DSS?  A merchant accepts payment cards for goods or services; a service provider is directly involved in processing, storing, or transmitting cardholder data on behalf of another entity — service providers face additional requirements and must use SAQ D Service Provider if self-assessing. - #### What happens if we store cardholder data on our own systems?  Storing cardholder data on your own premises generally disqualifies you from the simpler SAQ types and requires a more comprehensive assessment (typically SAQ D), since it significantly expands your compliance scope. - #### How does BorderHawk help beyond just completing the paperwork?  BorderHawk helps you scope your CDE correctly, identify and remediate control gaps before your assessment, and complete the appropriate SAQ or prepare supporting documentation for a QSA-led ROC — reducing both compliance cost and audit risk. ##### Who We Are Who We Are - [Home](https://www.borderhawk.com) - [About Us](https://www.borderhawk.com/about-us) - [Contact Us](https://www.borderhawk.com/contact-us) ##### What We Do What We Do - [Consulting](https://www.borderhawk.com/cybersecurity-consulting) - [Assessments](https://www.borderhawk.com/risk-assessments) - [Program Development](https://www.borderhawk.com/overwatch-framework) - [M365 Review](https://www.borderhawk.com/microsoft-cloud-and-endpoint-review) ##### Why Do We Do It Why Do We Do It - [BEAD/E-ACAM](https://www.borderhawk.com/bead-and-e-acam-consulting) - [CMMC](https://www.borderhawk.com/cmmc-consulting) - [HIPAA](https://www.borderhawk.com/hipaa-consulting) - [SOC](https://www.borderhawk.com/soc-2-consulting) - [PCI-DSS](https://www.borderhawk.com/pci-dss-consulting) [![BorderHawk Logo in White.](https://www.borderhawk.com/hubfs/BorderHawk%20Logos%20and%20Images/BorderHawk%20Logo%20in%20White..png)](https://www.borderhawk.com?hsLang=en) - [Privacy Policy](https://www.borderhawk.com/privacy-policy) - [Community Terms of Use](https://www.borderhawk.com/community-terms-of-use) © 2026 BorderHawk, LLC ```json { "@context" : "https://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "US", "addressLocality" : "Cartersville", "addressRegion" : "GA" }, "areaServed" : "US", "description" : "BorderHawk delivers tailored cybersecurity compliance, risk assessments, and Overwatch consulting for critical infrastructure, defense, healthcare, and enterprise sectors.", "logo" : "https://www.borderhawk.com/hubfs/BorderHawk%20Logos%20and%20Images/BorderHawk%20Logo%20in%20White..png", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "Service", "areaServed" : "US", "audience" : { "@type" : "Audience", "audienceType" : "Critical infrastructure organizations (Communications, Defense Industrial Base, Healthcare, Oil & Gas, Transportation, Manufacturing, Local Government, Data Centers, Law Practices)" }, "description" : "Developing a cybersecurity program requires more than the technology used to manage the business. Focused on the management of cybersecurity, ensuring leadership has an accurate picture of IT and OT operations.", "name" : "Management Consulting | BorderHawk, LLC", "provider" : { "@type" : "Organization", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com/" }, "serviceType" : "Management Consulting", "url" : "https://www.borderhawk.com/cybersecurity-consulting" } ``` ```json { "@context" : "https://schema.org", "@type" : "Service", "areaServed" : "US", "audience" : { "@type" : "Audience", "audienceType" : "Critical infrastructure organizations (Communications, Defense Industrial Base, Healthcare, Oil & Gas, Transportation, Manufacturing, Local Government, Data Centers, Law Practices)" }, "description" : "Evaluate your organization's current controls and risk posture, whether for the organization or specific assets, through analysis of technology, documentation, processes, and conversations with personnel.", "name" : "Security Assessments | BorderHawk, LLC", "provider" : { "@type" : "Organization", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com/" }, "serviceType" : "Security Assessments", "url" : "https://www.borderhawk.com/risk-assessments" } ``` ```json { "@context" : "https://schema.org", "@type" : "Service", "areaServed" : "US", "audience" : { "@type" : "Audience", "audienceType" : "Critical infrastructure organizations (Communications, Defense Industrial Base, Healthcare, Oil & Gas, Transportation, Manufacturing, Local Government, Data Centers, Law Practices)" }, "description" : "Tabletop exercises with leadership and operations, Risk Assessment Workshops that teach personnel to conduct risk assessments, and incident-response training built into the broader consulting engagement.", "name" : "Cybersecurity Training | BorderHawk, LLC", "provider" : { "@type" : "Organization", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com/" }, "serviceType" : "Cybersecurity Training", "url" : "https://www.borderhawk.com/cybersecurity-consulting" } ``` ```json { "@context" : "https://schema.org", "@type" : "Service", "areaServed" : "US", "audience" : { "@type" : "Audience", "audienceType" : "Critical infrastructure organizations (Communications, Defense Industrial Base, Healthcare, Oil & Gas, Transportation, Manufacturing, Local Government, Data Centers, Law Practices)" }, "description" : "BorderHawk's industry-leading cybersecurity compliance framework and premier consulting package — takes an organization from its current state to an audit-defensible position, and helps maintain audit readiness through changes in requirements and the business itself.", "name" : "Overwatch | BorderHawk, LLC", "provider" : { "@type" : "Organization", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com/" }, "serviceType" : "Overwatch", "url" : "https://www.borderhawk.com/overwatch-framework" } ``` ```json { "@context" : "https://schema.org", "@type" : "Person", "description" : "CEO and Managing Director of BorderHawk, LLC with 25+ years of experience developing strategic business and technology solutions. Focused on Information Risk Management & Cybersecurity programs for critical infrastructure, including DoD vendors (CMMC), healthcare (HIPAA), and state and local governments (ISO 27001 / NIST).", "jobTitle" : "CEO and Managing Director", "knowsAbout" : [ "CMMC", "NIST 800-171", "HIPAA", "ISO 27001", "NIST Cybersecurity Framework", "Cybersecurity Compliance" ], "name" : "Jay Harmon", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "url" : "https://www.borderhawk.com/about-us", "worksFor" : { "@type" : "Organization", "foundingDate" : "2008", "name" : "BorderHawk, LLC", "url" : "https://www.borderhawk.com/" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A Self-Assessment Questionnaire (SAQ) is the streamlined form merchants use to attest to PCI DSS compliance; which of the several SAQ types applies depends on how you accept, process, and store cardholder data — BorderHawk helps determine the correct one for your environment." }, "name" : "What is a PCI DSS SAQ and which one applies to us?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "An SAQ is a self-assessment available to smaller or lower-risk merchants; a ROC is a full assessment conducted by a Qualified Security Assessor (QSA), generally required for higher transaction volumes or more complex cardholder data environments." }, "name" : "What's the difference between an SAQ and a full PCI DSS Report on Compliance (ROC)?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The CDE is the set of systems, people, and processes that store, process, or transmit cardholder data; correctly scoping the CDE is the single biggest driver of PCI DSS cost and effort, since it determines exactly which requirements apply." }, "name" : "What is a Cardholder Data Environment (CDE) and why does scoping it matter?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes — merchants that fully outsource payment processing to a PCI DSS-compliant vendor (through a redirect or hosted iframe) can often qualify for the shortest SAQ (SAQ A), significantly reducing their compliance burden." }, "name" : "Can outsourcing payment processing reduce our PCI DSS scope?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "PCI DSS compliance validation, whether via SAQ or ROC, is required annually, along with quarterly vulnerability scans for most merchant levels." }, "name" : "How often do we need to complete a PCI DSS assessment?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The AOC is the formal document submitted alongside your SAQ or ROC confirming the accuracy of your responses and your current PCI DSS compliance status, typically required by your acquiring bank or payment brand." }, "name" : "What's an Attestation of Compliance (AOC)?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes — PCI DSS applies to any merchant that accepts, processes, stores, or transmits cardholder data, regardless of transaction volume, though lower-volume merchants generally qualify for a simpler SAQ." }, "name" : "Does PCI DSS apply to us if we only take a small number of card payments?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A merchant accepts payment cards for goods or services; a service provider is directly involved in processing, storing, or transmitting cardholder data on behalf of another entity — service providers face additional requirements and must use SAQ D Service Provider if self-assessing." }, "name" : "What's the difference between a merchant and a service provider under PCI DSS?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Storing cardholder data on your own premises generally disqualifies you from the simpler SAQ types and requires a more comprehensive assessment (typically SAQ D), since it significantly expands your compliance scope." }, "name" : "What happens if we store cardholder data on our own systems?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "BorderHawk helps you scope your CDE correctly, identify and remediate control gaps before your assessment, and complete the appropriate SAQ or prepare supporting documentation for a QSA-led ROC — reducing both compliance cost and audit risk." }, "name" : "How does BorderHawk help beyond just completing the paperwork?" } ] } ```