PCI DSS v4.0.1 · SAQ D
Your team answers a guided online questionnaire. A CISSP and CISA reviews the answers, writes your remediation plan, and helps you complete the official Attestation of Compliance.
Already a client? Want to be a client?
Open the PCI Compliance ToolUse the private assessment link we emailed you to open your questionnaire.
Multi-factor authentication for all access into the cardholder data environment
Finding: Administrators reach the payment database over VPN with a password only.
Fix: Require MFA on the VPN and the database jump host for every admin account. Owner: IT lead. Target: 30 days.
Internal vulnerability scans every three months
Incident response plan, ready to use
Every requirement that is not in place comes with a plain-language finding and a fix your team can act on.
Who needs SAQ D
SAQ D applies when card data touches your own systems and no shorter questionnaire fits. That usually means you:
Answer six questions or fewer and get your SAQ type with the reasoning behind it. It's free, and you don't need to sign up.
If you qualify for a shorter one, such as SAQ A or A-EP, a $495 scoping consult gets you the right questionnaire and a plan. It's credited if you later book an assessment.
How it works
Twenty minutes to confirm SAQ D applies, agree the scope and pick a tier. You get a fixed quote the same day.
Your team gets a private link to every requirement, each explained in plain language. Answers save as you go.
Your answers are reviewed against PCI DSS v4.0.1. You get a gap report and a remediation plan for anything not yet in place.
We complete the official PCI SSC Attestation of Compliance together. You sign it and submit it to your acquirer.
Pricing
Choose how much help your team needs. Every tier covers one full SAQ D cycle.
Guided
$1,950per assessment
For teams that know their environment and want a second pair of eyes.
Typically 2 to 3 weeks
Request a scoping callRecommended · Assisted
$4,950per assessment
For most merchants. Every answer is reviewed, and you are never stuck on a requirement.
Typically 3 to 4 weeks
Request a scoping callFull-service
$9,500per assessment
For teams without in-house security staff, or with gaps to close before attesting.
Typically 6 to 12 weeks
Request a scoping call50% at signing, 50% on delivery of your report. Next year's renewal is 25% off. Add-ons: security policy pack $1,500; extra advisory hours $225/hour; ASV scan coordination at cost plus $250.
Plain terms
Questions
The free SAQ check tells you which questionnaire applies, with the reasons. If it's a shorter one, such as SAQ A or A-EP, a $495 scoping consult gets you the right questionnaire and a plan. The fee is credited if you later book an assessment.
Most of the time goes into answering the questionnaire, which saves as you go so it can be split across people and days. Calls are scheduled around you: one in Guided, three in Assisted, up to eight in Full-service.
You do. PCI DSS self-assessment is the merchant's own attestation. We review your answers and help you complete the forms, and you submit them to your acquirer or payment processor.
No. The questionnaire asks about your security controls, never about card numbers, and you should never enter cardholder data into it. Your assessment sits behind a private link served over HTTPS, and it is deleted on request after delivery.
The first draft of a remediation plan can be written with AI, then reviewed and edited by your consultant before you see it. Pass/fail results come from fixed rules, never from AI. If you prefer, we can turn AI drafting off for your assessment.
Your SAQ has to be renewed every year. Returning clients get 25% off, and last year's answers give your team a head start.
A 20-minute call is enough to confirm your SAQ type and give you a fixed quote.
CKB Secure Data LLC is not a PCI Qualified Security Assessor and is not affiliated with or endorsed by the PCI Security Standards Council. PCI DSS is a standard of the PCI Security Standards Council, LLC.