PCI DSS Level 1 Certification (QSA Partner)

Overview

Level 1 merchants and Level 1 service providers are required to obtain a QSA-signed Report on Compliance (RoC) and Attestation of Compliance (AoC). The assessment is conducted and signed by a Qualified Security Assessor. Onyx Security Labs does not sign the RoC. We deliver the engagement through our QSA partner, who conducts and signs. The RoC is the annual report on compliance that your acquirer or payment brand requires under PCI DSS Level 1 requirements.

PCI DSS (the Payment Card Industry Data Security Standard) is maintained by the PCI Security Standards Council (PCI SSC). The card industry data security standard applies to any organisation that stores, processes, or transmits payment cards data at scale. Level 1 thresholds are determined by individual payment brands and are typically triggered by processing credit card transactions above a set annual volume, or by a mandate from your acquirer regardless of volume. Merchants or service providers who process above those thresholds must comply with pci dss Level 1 requirements, which include an annual QSA-signed RoC rather than a self-assessment.

Our role is the work that determines whether you pass. We run the readiness and gap assessment against the full PCI DSS v4.0.1 requirement set, author the policy and procedure suite, advise on scope reduction and segmentation, prepare the evidence repository, and manage the QSA engagement from start to signed attestation. You arrive at the assessment ready, not scrambling.

What’s included

• Readiness and gap assessment against the full PCI DSS v4.0.1 data security standards requirement set
• Cardholder data flow mapping and scope reduction guidance, including credit card data and account data inventories
• Customised policy and procedure documentation suite and security controls documentation
• Evidence preparation and organised audit repository
• Remediation guidance (technical implementation remains with your team)
• Coordination and project management with our QSA partner
• QSA-conducted Report on Compliance and signed Attestation of Compliance (delivered by the QSA partner)

How we work

1. 01
   Readiness assessment

   We assess your environment against the full PCI DSS v4.0.1 control set and identify exactly what stands between you and a signed RoC. Findings are documented with ownership and priority. This readiness phase is what allows you to achieve pci compliance at the assessment rather than discover gaps during it.

2. 02
   Scope and remediation guidance

   We map cardholder data flows, advise on segmentation and scope reduction, and prioritise the remediation work. Network segmentation, tokenisation, and reducing unnecessary credit card data storage all affect your pci level and the assessment effort. Technical implementation, including firewall changes, server hardening, and code-level fixes, remains with your team.

3. 03
   Documentation and evidence

   We author the customised policy and procedure suite, document your security controls, and assemble the evidence the QSA will review. An organised repository means the assessment runs on schedule. We note where an internal security assessor at your organisation should be trained and engaged to support maintaining pci compliance year-on-year.

4. 04
   QSA assessment

   Our QSA partner conducts and signs the Report on Compliance and Attestation of Compliance. We coordinate the engagement throughout and manage any findings that arise during the assessment. The signed RoC and AoC are issued by the QSA partner and delivered to you as the formal pci dss level 1 compliance evidence your payment brand requires.

What you get

• Readiness and gap assessment report against pci dss requirements
• Customised policy and procedure documentation suite covering the full data security standards control set
• Scope and segmentation documentation, including payment cards data flow maps
• Organised evidence repository
• QSA-signed Report on Compliance and Attestation of Compliance (issued by our QSA partner)

The signature comes from the QSA

The Report on Compliance is conducted and signed by our Qualified Security Assessor partner. Onyx Security Labs prepares you for the assessment, manages the engagement, and authors the documentation. We do not sign the RoC ourselves. This is stated plainly because it matters: your acquirer or payment brand will check. A pci qsa from our accredited partner is the only person who can sign the annual report on compliance.

Who needs Level 1 versus an SAQ?

The pci level thresholds that trigger a Level 1 requirement vary by payment brand. Visa and Mastercard typically place merchants processing above a defined transaction volume into Level 1. American Express has its own thresholds. Service providers are classified separately, with pci level 1 service provider status often triggered at lower volumes than merchant Level 1. If your acquirer has placed you at Level 1 directly, that instruction overrides any volume calculation. Level 2 and below generally qualify for the SAQ route.

Frequently asked questions