PCI compliance services
PCI Compliance Consultants for Merchants, SaaS and Service Providers
BlueRadius is a PCI DSS compliance consulting firm for merchants and service providers: we scope your cardholder data environment, close the gaps against PCI DSS v4.0.1 and prepare you for your SAQ or QSA assessment. We are not a QSA, so we work on your side of the table.
Your acquiring bank wants an SAQ, a customer wants your Attestation of Compliance, or a QSA is booked and you are not sure you will pass. We get you ready. BlueRadius scopes your cardholder data environment, cuts it down where we can, closes the gaps against PCI DSS v4.0.1, and builds the evidence your assessor will ask for. We are not a QSA, so we sit on your side of the table.
When companies call us
- The acquirer asked for an SAQ and nobody knows which one applies, or whether the honest answer is "we're not compliant yet".
- An enterprise customer wants your AOC before they sign, usually because you process or can affect their card payments.
- You moved to a service provider level and now need a Report on Compliance instead of a self-assessment.
- Last year's assessment passed on v3.2.1 and the v4.0.1 requirements are new territory.
- A breach or a failed scan put PCI on the board agenda.
What a PCI engagement includes
Level and validation scoping
We confirm whether you are assessed as a merchant, a service provider or both, which level applies, and whether you validate with an SAQ or a ROC. Getting this wrong is the most common reason PCI projects run long.
Cardholder data environment mapping and scope reduction
We trace where card data enters, moves and is stored, then look for ways to take systems out of scope: tokenization, hosted payment fields, redirects to a validated provider, and segmentation. Fewer systems in scope means fewer requirements, lower cost and an easier assessment every year after.
Gap assessment against PCI DSS v4.0.1
We test your controls against the requirements that apply to your scope and give you a prioritized remediation plan, with the v4.0.1 items that became mandatory in March 2025 called out separately.
Remediation and policy work
Policies, targeted risk analyses, access and authentication changes, logging, vulnerability management and payment page script controls. Where the fix needs engineering time, we write the requirement so your team or MSP can build it once.
Evidence and QSA coordination
We build the evidence package, run a pre-assessment walkthrough, and work with the QSA firm you choose during fieldwork. For SAQ merchants, we help you complete the questionnaire accurately and sign the AOC with confidence.
Staying compliant
PCI is annual, with quarterly ASV scans in between. Our vCISO service keeps the program running so next year's validation is routine, and our penetration testing covers the annual and segmentation tests the standard requires.
PCI alongside your other frameworks
Most companies that need PCI also need something else. SaaS companies usually pair it with SOC 2; banks and lenders with GLBA. A lot of the control work overlaps, so we map it once and reuse the evidence. See our regulatory compliance practice for the full list, or read our PCI DSS compliance guide for mid-market companies before you call.
Who we work with
- E-commerce and retail merchants taking card payments online or in store
- SaaS platforms that process, store or can affect customer card payments
- Fintech and payment companies assessed as service providers
- Healthcare and professional services firms taking card payments from patients or clients
- MSPs and IT providers whose clients' PCI scope includes systems they manage
Frequently asked questions
What does a PCI compliance consultant do?
A PCI consultant gets you ready to pass. That means confirming which merchant or service provider level you are, working out which Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC) applies, shrinking the cardholder data environment so fewer systems are in scope, closing gaps against the PCI DSS v4.0.1 requirements, and building the evidence a Qualified Security Assessor (QSA) or your acquiring bank will ask for.
Is BlueRadius a QSA?
No. We do readiness, remediation and ongoing program management, and we work alongside the QSA firm you choose. Keeping the two roles separate is deliberate: the firm that assesses you should not be the firm that built your controls.
Do we need a full Report on Compliance, or is an SAQ enough?
It depends on your level, which your acquirer or the card brands set by annual transaction volume. Level 1 merchants (over 6 million Visa transactions a year) and Level 1 service providers need a ROC from a QSA. Most smaller merchants complete an SAQ, and which SAQ depends on how you take payments. A business that fully outsources card entry to a validated provider may qualify for SAQ A; one that stores or processes card data on its own systems usually lands on SAQ D. Confirm the requirement with your acquirer before scoping anything.
What changed with PCI DSS v4.0.1?
PCI DSS v4.0 replaced v3.2.1 in March 2024, and v4.0.1 is the current version. The requirements that were future-dated in v4.0 became mandatory on March 31, 2025. The ones that catch most companies out are targeted risk analyses, stronger authentication for access into the cardholder data environment, and management of scripts on payment pages.
How do you reduce PCI scope?
Keep card data off your systems wherever you can. Tokenization, hosted payment fields or redirects to a validated payment provider, and network segmentation that isolates the systems that do touch card data all shrink the number of requirements that apply. Scope reduction is usually the single biggest lever on cost and effort, so we look at it before anything else.
What does PCI compliance cost?
It varies with your level, how you take payments and how much of your environment is in scope. A small e-commerce merchant on SAQ A is a very different job from a service provider preparing for a ROC. We start with a fixed-fee gap assessment and give you a written quote for the remediation work once scope is clear. QSA fees are separate and paid to the assessor.
Start with a PCI gap assessment
A fixed-fee gap assessment tells you your level, your validation path, how much scope you can remove, and what it will take to pass, in writing, with a timeline. If you would rather talk it through first, book a 30-minute call.