PCI DSS, scoped down before it is worked through.
The cheapest PCI programme is the one with the smallest cardholder data environment. We shrink the scope first, then evidence what is genuinely left - and run the annual test the standard names outright.
- Scope reduction first - segmentation, tokenization, and getting systems out of the CDE
- The right SAQ for how you actually take payments, or a Report on Compliance if you need one
- 2 scoped penetration tests; confirm coverage for your PCI environment
Every system you remove from scope is a system you never evidence again.
PCI cost scales with the size of the cardholder data environment. Most programmes start by working through 12 requirements against an environment that should have been half the size.
Scope reduction before control work
Segmentation, tokenization, and moving card capture to a compliant processor take systems out of the CDE entirely. Cheaper than evidencing them forever.
The right validation path
The SAQ you qualify for depends on how you actually take payments. Filling in the wrong one is worse than useless - we determine it against your real flows.
Requirement 11.4 is our day job
Match the test targets and techniques to the requirements for your environment. The base plan includes 2 scoped tests; specialist testing, expanded targets, or additional engagements need separate agreement.
Quarterly, not annual
Identify the scan, log-review, and validation obligations for your scope. The 12 included vulnerability scan runs do not promise ASV validation. Continuous log review and specialist services are separately scoped.
The twelve requirements, in six goals.
Everything in PCI hangs off one prior question: what is in your cardholder data environment? Answer that well and the twelve requirements shrink with it.
Build and maintain a secure network
req 1-2Network security controls and secure configuration for all system components - no vendor defaults left in place.
Protect account data
req 3-4Storage protections for stored account data and strong cryptography for cardholder data in transit across open networks.
Maintain a vulnerability management programme
req 5-6Malware protection, and secure development and maintenance of bespoke and custom software.
Implement strong access control
req 7-9Need-to-know restriction, identification and authentication including MFA, and physical access restrictions.
Monitor and test networks
req 10-11Logging and monitoring of all access, plus the regular testing programme - ASV scans, internal and external penetration testing, and segmentation validation.
Maintain an information security policy
req 12Organizational policies and programmes, including the targeted risk analyses v4 introduced for customized approaches.
We scope to PCI DSS v4.0.1, including the future-dated v4 requirements that are now in force. Your merchant level and validation path - SAQ versus Report on Compliance - depend on transaction volume and your acquirer, and we confirm both before any control work starts.
From scoping call to attestation.
Two phases are gated - CDE scoping and attestation. Scope is gated because every mistake there multiplies across twelve requirements and then recurs every year.
Define and shrink the CDE
We trace every card data flow, identify connected systems, and take everything we can out of scope through segmentation, tokenization, or redirecting capture to the processor.
Fix the validation path
Merchant level, acquirer expectations, and the right SAQ - or a Report on Compliance with a QSA. We confirm this before control work so nothing gets evidenced twice.
Work the twelve requirements
Controls implemented and evidenced against the reduced scope, with quarterly ASV scans, log review, and the annual penetration and segmentation testing running on schedule.
Attest and stay attested
We assemble the evidence, complete the SAQ or support the QSA through the RoC, and produce the Attestation of Compliance - then keep the recurring obligations running.
PCI DSS: $20,000 a year total.
Startup base plus one framework.
$20,000/year including one framework. Each additional framework is $3,000/year. For companies under $5M revenue or 50 staff. The SOC 2 Type I, Security-only bundle includes the independent auditor fee. Type II audits, additional audit criteria, and other certification fees are quoted separately. Enterprise pricing is custom. The SOC 2 Type I, Security-only bundle is $20,000/year total, including the $3,000 independent auditor fee. Sythe coordinates preparation and the audit through the platform. The independent auditor performs the audit and issues the report. Type II audits and additional criteria are quoted separately.
For companies under $5M revenue or 50 staff. Base security services plus PCI DSS support.
- 2 scoped penetration tests per year
- One scoped retest per penetration test
- 2 risk assessments per year
- 12 host-limited vulnerability scan runs per year
- Third-party risk document uploads and Q&A
- Compliance & GRC support for one included framework
- The Sythe Labs platform, run by us
Over $5M revenue or 50 staff. Negotiated to your scale and obligations.
- Enterprise scope agreed separately
- Additional assets and testing quoted to scope
- Service levels defined in your agreement
Sythe operators request and review evidence, prepare materials, and follow up in the platform. You supply business information and approve your organization's policies. Routine clarification, corrections, and supported platform integration repairs are included.
Ongoing security monitoring and incident response are additional services. We recommend fixes; hands-on changes to your systems require a separate implementation scope.
Strategic compliance advice and expressly delegated decisions use a vCISO retainer at $250/hour, with hours approved in advance. Kickoff and pentest scoping and closure meetings are included. Other routine delivery happens in the platform; recurring consulting meetings are extra.
The people who already handed it over.
"Jarred, Andrew, and their team are trusted partners - extensive penetration testing, code analysis, and security reviews that protect our users. We share a vision of prioritizing customer security above all else."
"Sythe Labs was great to work with. Extremely knowledgeable, responsive, and trustworthy. I'd recommend them to anyone looking for security or penetration testing."
"The strategic security recommendations from Sythe Labs have been invaluable. Their expertise helped us put real protection in place while keeping us moving fast."
Real engagements. Real outcomes.
The same programme, run for teams who had no security function when they started.
PCI DSS, honestly answered.
The questions that come up on every PCI DSS scoping call, answered before you have to ask them.
- Do we need a QSA?
- It depends on merchant level and what your acquirer demands. Many companies validate with a Self-Assessment Questionnaire; larger volumes or a service provider role can require a QSA-led Report on Compliance. We confirm which applies before doing any control work.
- Which SAQ do we fill in?
- That is determined by how you take payments - whether card data touches your systems at all, whether you redirect to a processor, whether it is card-present. Using the wrong SAQ is a common and expensive mistake, so we determine it from your real payment flows.
- Can we get out of scope entirely?
- Rarely entirely, but often dramatically. Moving card capture to a hosted payment page or tokenizing early removes whole systems from the CDE. That work usually pays for itself in the first year.
- Is the penetration test extra?
- The plan includes 2 scoped penetration tests, not unlimited PCI testing. We agree targets, techniques, and coverage before work begins. Additional engagements, expanded targets, and specialist validation are separately scoped.
- How often do the obligations recur?
- We record the obligations for your agreed scope and coordinate routine evidence work. The annual package has fixed testing and scan allowances. ASV validation, additional specialist testing, continuous log review, and independent assessments are not automatically included.
Shrink the scope before you work the requirements.
A 30-minute call. We will trace where card data actually flows, tell you what can come out of scope, and price the real path to an AOC - whether or not you hire us.