What is a PCI DSS Report on Compliance (RoC)?

What the RoC Contains

Executive Summary

Every RoC opens with an executive summary that documents the organization's overall compliance posture, the scope of the assessment, the assessor performing the engagement, and the date range covered. The executive summary is what acquirers read first to determine the disposition of the assessment.

Scope Documentation

The RoC includes detailed documentation of the cardholder data environment scope — the systems, applications, network segments, and personnel that fall within PCI DSS applicability. Scope documentation is the foundation of the entire RoC; if scope is wrong, every downstream control evaluation is affected. This is why scoping work is the most consequential pre-assessment activity.

Control Evaluation Across All 12 Requirements

For each of the 12 PCI DSS high-level requirements — and the roughly 250-300 specific control items they expand to — the RoC documents the assessor's findings: what controls are in place, what evidence the assessor reviewed, what test results validate control effectiveness, and what compensating controls are in use where standard controls do not apply.

Compliance Disposition

The RoC concludes with a compliance disposition for each requirement: in place, not in place, not applicable, or in place with compensating controls. Compliance with the standard requires "in place" disposition for all applicable requirements. Non-compliant requirements typically produce remediation requirements that the organization must address before the next assessment cycle.

The RoC Assessment Process

Pre-Assessment Preparation

Most organizations engage in pre-assessment preparation work before the formal QSA engagement begins — gap analysis, evidence collection, scope validation, and control documentation. Organizations that arrive at the QSA engagement with mature pre-assessment work complete the engagement materially faster and at lower cost than organizations relying on the QSA to discover gaps during fieldwork.

Fieldwork and Evidence Review

The QSA's fieldwork phase involves on-site or remote review of the organization's environment, interviews with control owners, observation of control execution, and detailed evidence review. The QSA collects sufficient evidence to support each control disposition in the final RoC.

Report Production and Quality Assurance

Following fieldwork, the QSA produces the RoC and submits it through quality assurance review at the QSA firm. PCI SSC quality requirements impose specific standards on RoC documentation; reports that do not meet those standards are revised before submission.

Acquirer Submission and Disposition

The completed RoC is submitted by the assessed organization to its acquiring bank. The acquirer reviews the RoC, evaluates any non-compliant findings, and determines the organization's processing status. Material non-compliance can produce restrictions on processing privileges, increased monitoring requirements, or other consequences imposed by the acquirer.

RoC Strategy for PE Portfolio Companies

For PE operating partners, RoC engagement is one of the higher-cost recurring compliance investments at portfolio companies that operate at Level 1 merchant or service provider scale. The strategic considerations include timing alignment across the portfolio (consolidating engagements with a single QSA firm produces volume pricing), transition planning around acquisitions (new acquisitions inherit the RoC posture of the seller, which may or may not align with the portfolio's compliance program), and remediation investment provisioning during pre-close diligence.

The portfolio-level discipline is treating RoC engagement as a standardized operational program rather than a portco-by-portco project. The cost savings, posture comparability, and platform-level visibility benefits typically exceed the structural cost of central coordination.

Frequently Asked Questions

Who needs a RoC versus a SAQ?
Generally, Level 1 merchants (more than 6 million transactions per card brand per year) and large service providers require RoCs. Lower-tier merchants typically complete SAQs. Specific requirements vary by card brand and acquirer.

How long does a RoC remain valid?
RoCs are typically produced annually. Material changes to the cardholder data environment between assessments can require interim assessment work, even if the next annual RoC is not yet due.

Can I conduct my own internal RoC-equivalent assessment?
Internal assessments can prepare the organization for the QSA engagement and identify gaps before the assessor does. They cannot substitute for the QSA-produced RoC for organizations required to submit one.

What happens when the RoC identifies non-compliance?
The non-compliance is documented in the RoC. The organization typically produces a remediation plan that the acquirer reviews. Material non-compliance can produce processing restrictions or other consequences depending on severity and the acquirer's policies.

Can the RoC be shared with customers or used in marketing?
The full RoC is typically confidential and shared only with the acquirer. Many organizations produce a public-facing Attestation of Compliance (AoC) — a summary document that confirms the organization is PCI DSS compliant without disclosing the detail of the RoC.

Related Reading

• What is PCI DSS?
• What is a QSA? — the assessor producing the RoC
• What is an ASV? — the scanning vendor adjacent to RoC
• PCI DSS Compliance Consultants — pre-assessment preparation
• Compliance as a Service (CaaS) — managed PCI compliance for organizations without in-house programs

What is a PCI DSS Report on Compliance (RoC)?

A Report on Compliance (RoC) is the formal documentation that a Qualified Security Assessor produces upon completing a PCI DSS assessment of a Level 1 merchant or large service provider. The RoC is the artifact that merchants and service providers submit to their acquiring banks and, in some cases, directly to card brands as the formal attestation of PCI DSS compliance. It is structurally distinct from the Self-Assessment Questionnaire (SAQ) used by smaller merchants — the RoC is a third-party attestation produced by an independent QSA based on direct evidence review.

Who is required to produce a RoC versus a SAQ?

Generally, Level 1 merchants (more than 6 million transactions per card brand per year) and Level 1 service providers are required to produce RoCs. Lower-tier merchants typically complete SAQs as self-attestations. Specific requirements vary by card brand (Visa, Mastercard, American Express, Discover, JCB) and acquirer. Following any significant security incident, lower-tier merchants may be required to engage a QSA and produce a RoC as a condition of continued processing privileges. The merchant level is determined by transaction volume.

What does the RoC contain?

The RoC contains an executive summary documenting overall compliance posture; detailed scope documentation defining the cardholder data environment; control evaluation across all 12 PCI DSS high-level requirements and the approximately 250-300 specific control items they expand to; and final compliance disposition for each requirement (in place, not in place, not applicable, or in place with compensating controls). The volume of required evidence and documentation is the primary reason RoC engagements run weeks rather than days, even for organizations with mature compliance programs.

How long does a RoC engagement take?

For a mid-market organization with mature documentation, typical RoC engagements run 4-8 weeks of fieldwork plus 2-4 weeks of report production and quality assurance review. Organizations with documentation gaps or significant remediation requirements run materially longer. Pre-assessment readiness work — gap analysis, evidence collection, scope validation — substantially reduces engagement duration. Organizations arriving at QSA fieldwork with mature pre-assessment preparation complete the engagement faster and at lower cost than organizations relying on the QSA to discover gaps during fieldwork.

How much does a RoC engagement cost?

Typical RoC engagement pricing for a mid-market organization runs $50,000-$250,000+ depending on environment complexity, scope size, and engagement type. Service providers and large merchants with complex environments can run materially higher. The engagement includes scope review, control assessment, evidence collection, documentation production, and final attestation. Pre-assessment readiness consulting (typically 10-30% of the QSA fee) substantially reduces both the QSA engagement cost and the risk of material findings during the assessment.

How long is a RoC valid?

RoCs are typically produced annually. Material changes to the cardholder data environment between assessments — new systems brought into scope, significant architecture changes, organizational restructuring affecting compliance — can require interim assessment work even if the next annual RoC is not yet due. Acquirers may also require interim assessments following security incidents. The annual cadence reflects the rate of change in both the threat landscape and most organizations' environments.

What happens when a RoC identifies non-compliance?

The non-compliance is documented in the RoC. The organization typically produces a remediation plan that the acquirer reviews. Material non-compliance can produce processing restrictions, increased monitoring requirements, escalated fees, or other consequences imposed by the acquirer. Severe non-compliance can produce loss of processing privileges. The RoC itself does not impose consequences; the acquirer and card brands determine the response based on the RoC findings and the remediation plan.

Real-World Example: When the RoC Catches What the SAQ Missed

A Cloudskope engagement with a payment processor that had grown from Level 2 to Level 1 merchant status illustrates the structural value of RoC versus SAQ. Pre-engagement, the organization had been completing SAQ-D self-assessments annually with no significant findings. The transition to Level 1 required first-time RoC engagement.

The QSA assessment surfaced three material findings the SAQ self-assessment had missed: a network segmentation gap that expanded actual scope beyond the documented scope, a logging requirement gap on database systems that the internal team had assumed was satisfied by the application-tier logging, and a key management practice that did not meet the standard's specific requirements for key custodian segregation.

None of the findings were unusual — they were the kind of gaps that internal self-assessment routinely overlooks because the team writing the assessment is the same team operating the controls. The structural value of QSA-led RoC assessment is the independence that surfaces gaps the internal team has internalized as compliant.