Advisory

PCI DSS Consulting & Compliance

Australia's first certified QSA Company. Twenty years of PCI DSS assessments, pen tests and v4.0 script monitoring for merchants, service providers and banks.

From cardholder data to signed Report on Compliance.

Vectra became Australia's first certified QSA Company in 2006. More than 80% of Australia's top companies trust us with their PCI DSS assessments. Our assessors write Reports on Compliance that banks and card schemes accept first time. Services cover gap analysis, scope minimisation, full Level 1 assessment and DSS v4.0 script monitoring (6.4.3 and 11.6.1). We also run segmentation testing (11.4) and annual re-assessment, and provide quarterly ASV scans (11.3.2) through our Approved Scanning Vendor partner. We work from five Australian offices - Sydney, Melbourne, Adelaide, Perth and Brisbane. We cover retail, financial services, insurance, gaming and service providers.

PCI DSS Consulting & Compliance
PCI DSS Service Desk

Merchant PCI support, run for acquiring banks and payment providers.

Vectra runs an Australian PCI DSS Service Desk for acquiring banks, payment providers and their merchants. We guide merchants through scoping, Self-Assessment Questionnaires, ASV scanning, remediation questions and annual renewal.

Merchant programs create a specific kind of support work: portal access, SAQ choice, scoping questions, failed scans, annual reminders, and merchants who need someone to explain what a requirement means in practice. We become the PCI support layer between your program and your merchants.

The Service Desk can be paired with a secure PCI DSS compliance portal. Merchants register, confirm their details, work out their SAQ pathway, complete the SAQ and any ASV scanning, then attest and get their compliance outputs. Self-service handles the simple steps, and people help when the process gets technical.

Discuss a merchant compliance program

  • Merchant support

    Merchants reach an Australian team that understands PCI DSS, payment channels and the common validation pathways.

  • Program consistency

    Every merchant gets the same support, instead of general banking or payments staff each reading the standard their own way.

  • Lower support burden

    PCI questions, SAQ guidance and ASV help move away from your internal service teams.

  • Compliance momentum

    We support onboarding, renewal and remediation, so merchants are less likely to stall when the work turns technical.

  • Specialist escalation

    When an issue goes beyond Service Desk guidance, we pass it to our QSA, penetration testing or security teams, or to our ASV scanning partner.

The practical work that keeps a merchant program moving.

Service Desk staff help merchants understand and complete the tasks on their own PCI pathway. What applies depends on the merchant's environment, payment channel, acquirer and validation type.

Portal and account support

User set-up, login help, password resets, contact updates and help finding the way around the merchant compliance portal.

Scoping and re-scoping

We help merchants describe how they take payments. We explain how a new website, payment provider, terminal or payment flow can change their scope and the right SAQ.

SAQ guidance

We help merchants pick the right Self-Assessment Questionnaire and understand the questions and evidence that apply to them.

ASV scanning support

Where external scans are required under requirement 11.3.2, we guide merchants through them from start to finish.

  • Setting up the external IP addresses or domains to scan
  • The quarterly scan cycle
  • What a failed result means and what must change to pass
  • The evidence needed to dispute a false positive
ASV vulnerability scanning

Compliance-cycle support

Renewal notices and help when merchants return to the portal for their next annual validation.

Specialist escalation

Level 1 validation, segmentation, e-commerce design and technical failures go to our QSA, penetration testing and security specialists, with ASV scanning through our partner.

Penetration testing
Existing merchants

Call the PCI Service Desk on 1800 558 522.

Or email support@vectrapci.com.au. The Service Desk is based in Australia, run by staff trained in PCI DSS and QSA work, and backed by our wider QSA and security teams.

Email the Service Desk

PCI DSS v4.0.1 is the version that applies now.

The future-dated v4.x requirements became effective on 31 March 2025. They raise the bar on stronger authentication, e-commerce security, targeted risk analysis, and evidence that controls work all year.

Not every requirement applies to every merchant or every SAQ. We help you work out which ones apply to your payment environment and when you need specialist advice.

Review your v4.0.1 readiness

  • Payment-page scripts

    E-commerce merchants must authorise, list and justify the scripts on payment pages, and detect unauthorised changes.

  • Authentication

    Multi-factor authentication, account governance and access-control rules now apply more widely.

  • Targeted risk analysis

    Where the standard lets you set how often a control runs, a targeted risk analysis must support that choice.

  • Evidence of operation

    You need to show your security processes work, with named owners and repeatable steps - not just that a policy exists.

PCI support for every kind of payment environment.

We started card-security programs with Visa and MasterCard in 2004. Since then we have helped thousands of organisations in retail, financial services, insurance, transport, banking, credit unions, building societies, utilities, gaming, and third-party hosting and service providers.

Merchants

Retail, e-commerce and customer payments

Support for in-store, online, contact-centre and recurring payment channels.

  • SAQ and ROC pathways
  • Payment-page security
  • Scope reduction
  • Multi-channel payments
Service providers

Platforms, hosting and payment services

Assessment and advice for organisations that store, process or send account data, or can affect its security.

  • Service-provider ROC
  • Responsibility matrices
  • Customer assurance
  • Shared-control environments
Complex enterprise

Large and regulated organisations

QSA support across business units, cloud platforms, outsourced services and large technology estates.

  • Multiple payment channels
  • Cloud and hybrid environments
  • Segmentation validation
  • Enterprise remediation programs

Why acquirers trust our QSAs.

QSA Company since 2006

First in Australia certified by the PCI Security Standards Council. Two decades of assessor experience across every card brand and transaction volume.

Trusted by Australia's top companies

More than 80% of Australia's top companies trust Vectra with their PCI DSS assessments.

Designed for sign-off

Reports are written to pass your acquirer's reviewer on first submission. No template content, no generic risk language, no back-and-forth revisions.

Scoped to your business

Level 1 or Level 4, merchant or service provider: we right-size the engagement and the control footprint to your actual risk.

The six-step path to a signed RoC.

  1. Step 1: Scope & risk evaluation

    We set merchant level, CDE footprint, SAQ type and acquirer expectations before any control work starts.

  2. Step 2: Gap analysis

    We document your current state against all 12 DSS requirements, then build a prioritised remediation roadmap.

  3. Step 3: Remediation

    We uplift controls, harden systems, update policies and gather evidence, all aligned to the roadmap.

  4. Step 4: Validation

    Penetration tests, ASV scans, segmentation testing and process walk-throughs confirm the controls work.

  5. Step 5: Assessment

    A formal QSA-led assessment produces the Report on Compliance and Attestation of Compliance, for submission to your acquirer.

  6. Step 6: Maintain

    Annual re-assessment, v4.0 requirement uplifts, change reviews and ongoing compliance support keep the program current.

PCI services under one QSA Company.

Full Level 1 assessments

On-site QSA-led audits for merchants and service providers, producing an acquirer-accepted Report on Compliance and Attestation of Compliance.

Assisted SAQ

Self-Assessment Questionnaire preparation and review for Level 2-4 merchants. We do the mapping, you sign the attestation.

Gap & scope reviews

A pre-assessment review of your current state, with a prioritised remediation plan and scope-minimisation recommendations.

ASV vulnerability scans

Quarterly external scans for DSS 11.3.2, run by our partner in the United States, a PCI SSC Approved Scanning Vendor. Our PCI team helps you act on the results.

Penetration testing

Application, infrastructure and segmentation testing aligned to DSS 11.4 and the broader 11.x requirements.

Script monitoring (v4.0)

E-commerce script inventory and tamper detection for DSS v4.0 requirements 6.4.3 and 11.6.1, effective 31 March 2025.

What you gain with an integrated QSA partner.

All 12 DSS requirements covered

Guidance on every requirement, with clear steps mapped to your environment. Not a tick-and-flick checklist.

Independent assessor credibility

Vectra QSAs are registered with the PCI Security Standards Council. Named on your Report on Compliance at submission.

Scope minimisation

Design patterns that shrink the CDE footprint, cutting control obligations without pushing risk to untested boundaries.

DSS v4.0 script monitoring

Covers the 6.4.3 and 11.6.1 e-commerce script requirements from 31 March 2025. Tooling, monitoring and attestation are ready to go.

ASV scanning through a partner

Quarterly external scans for requirement 11.3.2 come from our Approved Scanning Vendor partner in the United States. Our PCI team helps you read the results and fix what they find.

Continuous compliance

Annual re-assessment, change reviews and interim attestation support keep your status current between cycles.

The result when the assessment lands.

  • Signed Report on Compliance accepted by the acquiring bank first submission

  • Cardholder data environment secured against DSS v4.0 risk objectives

  • Clear understanding of every DSS requirement as it applies to your business

  • Smaller CDE footprint through design patterns that legitimately cut control burden

  • Evidence pack suitable for card scheme audit, acquirer review and internal board reporting

2006
Australia's first PCI QSA company
12
PCI DSS requirements covered
v4.0.1
DSS version
6
Australian offices

PCI credentials we hold.

QSAC QSA PCI SSC Member PCI DSS v4.0 CREST ISO 27001 IRAP QSAC QSA PCI SSC Member PCI DSS v4.0 CREST ISO 27001 IRAP

PCI DSS questions we hear most weeks.

What is PCI DSS and does my business need to comply?

PCI DSS is the Payment Card Industry Data Security Standard. It's a contractual requirement for any business that stores, processes or sends card data. Even with a third-party processor, if card data touches your systems, you carry compliance obligations.

What's the difference between an SAQ and a full QSA assessment?

Your merchant level sets the path, and your acquirer assigns that level based on transaction volume. Level 1 merchants (6M+ transactions a year) and most service providers need an annual assessment and Report on Compliance by a QSA Company or a PCI SSC certified Internal Security Assessor (ISA). Levels 2-4 can complete a Self-Assessment Questionnaire matching their card-acceptance channels. We help with either path.

How often does compliance need to be validated?

Acquiring banks ask for PCI DSS compliance reporting every year, and in some cases every quarter. Quarterly ASV scans apply where you have internet-facing systems in scope.

Are you an Approved Scanning Vendor?

No. We provide ASV scanning through our partner in the United States, which is a PCI SSC Approved Scanning Vendor. We coordinate the quarterly external scans for requirement 11.3.2 with you and help you fix what they find.

When did the DSS v4.0 script monitoring requirements take effect?

PCI DSS v4.0.1 is the current version of the standard. Its future-dated requirements, including 6.4.3 and 11.6.1 for script integrity on e-commerce payment pages, became effective on 31 March 2025. We offer tooling, monitoring and attestation for both.

How long does a full Level 1 assessment take?

It depends on the size of your cardholder data environment and how ready it is. We agree the timeline at scoping, once we understand your environment and any remediation needed.

Do you help with segmentation testing (requirement 11.4)?

Yes. Our CREST-certified pen test team handles segmentation testing aligned to 11.4, bundled or standalone. One vendor, one report, one set of evidence.

What's the difference between the PCI Service Desk and a QSA assessment?

The Service Desk helps merchants find their way through the compliance process and their self-assessment. A Qualified Security Assessor carries out formal PCI DSS assessment and validation where it is required. We provide both, so complex questions can be passed to the right people.

How do existing merchants contact the Vectra PCI Service Desk?

Call the Vectra PCI DSS Service Desk on 1800 558 522 or email support@vectrapci.com.au.

What happens if our assessment is non-compliant?

For first-time assessments, a gap assessment is intended to catch compliance issues before the formal compliance assessment, to present the best possible outcome. Non-compliant assessments are not unusual and are not seen by acquirers as a failure. If the outcome of the compliance assessment is non-compliant, we work with you to document a remediation plan for your acquirer's approval.

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.