What is the difference between a ROC and a Self-Assessment Questionnaire (SAQ)?

A Report on Compliance (ROC) is a formal assessment conducted by a Qualified Security Assessor (QSA) and is required for PCI DSS Level 1 merchants and service providers. A Self-Assessment Questionnaire (SAQ) is a self-validation tool intended for eligible organizations with lower transaction volumes.

How long does it take to complete a PCI DSS ROC audit?

The timeline depends on your organization's readiness, environment, and complexity. Most organizations spend 3 to 5 months preparing for the assessment, while the formal ROC audit itself is typically completed within several weeks.

Where can I access the current PCI DSS standards and Self-Assessment Questionnaires (SAQs)?

The PCI Security Standards Council (PCI SSC) provides the latest PCI DSS standards, Self-Assessment Questionnaires (SAQs), and supporting guidance through its Document Library. Organizations can use these resources to determine the appropriate SAQ for their environment or consult GRSee for expert guidance.

4.9on G2

PCI DSS Level 1 Audit

Q: What is included in the ROC?

The Report on Compliance (ROC) documents the PCI DSS assessment scope, evaluates compliance with all 12 PCI DSS requirements, and includes findings, supporting evidence, validation of implemented security controls, and the assessor's conclusions.

Q: Do you assist with both readiness and the audit?

Yes. GRSee provides end-to-end PCI DSS services, including readiness assessments, gap analysis, remediation planning, audit preparation, formal PCI DSS Level 1 assessments, and Report on Compliance (ROC) submission support.

Deep QSA expertise with a hands-on team: pass your PCI DSS audit, reduce audit fatigue, streamline evidence and strengthen payment security.

Book a call Send us a message

They helped us bridge the gap between PCI requirements and our operational reality, adapting the process to fit our business.Igor Rutman, Security Risk Lead, Playtika

Protect cardholder data and secure payments.

Our PCI audit services cover the entire process: readiness assessments and implementation, the audit and the Report on Compliance (ROC), and Compliance as a Service afterwards.

PCI DSS is the set of security standards that every company accepting, processing, storing or transmitting card data must meet to keep that environment secure.

Compliance, without the compromises.

Direct line to your auditorNo ticket queues. Message your audit team directly and get real answers, fast.
One team, every frameworkSOC 2, ISO 27001, PCI DSS, pen testing: one team, one timeline, no duplicate evidence.
We work with your stackWe plug into the compliance platforms you already use, adapt to your processes, or bring our own tooling at no extra cost.
Fixed scope, fixed priceOne clear quote upfront. No change orders, no surprise fees mid-audit.
Timelines you can plan aroundClear milestones from kickoff to report.
Always know where you standLive visibility into audit progress, no chasing status updates.
Built for fast-moving teamsWe understand cloud-native, SaaS and modern DevSecOps, so there is no explaining your stack from scratch.
Support that does not end at the reportWe stay in your corner after the report: ongoing guidance, not a one-time transaction.

How your PCI DSS engagement runs.

Four phases, one team, and a fixed price agreed before we start.

Prepare

DescopingWe map your cardholder data flow and shrink your cardholder data environment where possible, saving time and money and reducing complexity.
Gap assessmentWe analyze your current processes and identify what needs to improve.
Implementation supportWe work with your team to implement the necessary controls and get audit-ready.

Validate

TestingOur experts run the required pentests and vulnerability scans to validate your controls.
Audit readiness reviewA comprehensive readiness review before the final audit, so there are no surprises.

Audit

The auditAn experienced QSA from our assurance team performs a thorough, impartial PCI DSS audit.
ReportingA detailed Report on Compliance (ROC) and a QSA-signed Attestation of Compliance (AOC).

Maintain

Compliance as a ServiceWe can run your PCI maintenance: regular scans, pentests, quarterly reviews and annual recertification preparation.

ROC or SAQ?

Report on Compliance (ROC)

A formal audit by a Qualified Security Assessor.

Required for Level 1 merchants and service providers.

Self-Assessment Questionnaire (SAQ)

A self-assessment reporting tool.

For smaller organizations that process fewer transactions.

Not sure which applies? We will tell you on the scoping call. See also our PCI DSS SAQ service.

What PCI DSS does for your business.

Build client trustShows your commitment to data security, strengthening relationships with clients and partners.
Protect payment dataSafeguards cardholder information and reduces the risk of breaches.
Competitive advantagePositions you as a secure, trustworthy vendor in a competitive market.
Reduced riskProtects cardholder data from breaches and fraud.
Avoid fines and penaltiesPrevents costly non-compliance fees and reputational damage.
A scalable frameworkA foundation for future security improvements and compliance efforts.

Why teams choose GRSee for PCI DSS.

PCI DSS Level 1 across complex, high-volume payment environments.

Read the story

Experienced PCI DSS QSAsQualified Security Assessors with years of experience helping organizations achieve PCI DSS compliance.
Tailored to your businessWe customize the approach to your size, your payment flows and your needs.
Post-audit PCI supportBeyond the report, guidance to maintain and improve your compliance posture.

Pairs well with, in one OneAudit engagement

Book a call

4.9on G2

PCI DSS guides from our team.

All resources

PCI DSS questions, answered.

Still not sure? Bring your questions to a scoping call.

What is the difference between a ROC and an SAQ?

The ROC is a formal audit conducted by a Qualified Security Assessor (QSA) and is required for Level 1 merchants and service providers. The SAQ is a self-assessment reporting tool for smaller organizations that process fewer transactions.

How long does a PCI DSS compliance audit take?

It depends on your readiness and complexity. Most organizations take 3 to 5 months to prepare for the audit; the audit itself is completed within several weeks.

What is included in the ROC?

A clear definition of your PCI environment, a detailed evaluation of your compliance with all 12 PCI DSS requirements, and the findings, evidence and validation of implemented controls.

Do you assist with both readiness and the audit?

Yes. We offer end-to-end support, from readiness assessments and remediation planning to conducting the formal audit and submitting the ROC.

Where can I find the current standards and SAQs?

The PCI Security Standards Council website has a Document Library with all the guidance for merchants and service providers. Filter by "SAQs" to find yours, see "Understanding SAQs for PCI DSS" if you are unsure which applies, or ask one of our experts.

Book your scoping call.

Pick a time that suits you. You leave with a scope and a fixed quote.

A direct line to your auditor
We work with your stack
Fixed scope and price

Local teams, your time zone

United States
Europe
Middle East

We work in your time zone and support you in multiple languages.

4.9on G2

Loading the booking form

Times are shown in your own time zone.

Booking form not showing?Open it in a new tab