PCI DSS Roadmap: 9-Month Compliance Plan With Owners and Milestones
8 min read ยท 2026-10-25
A PCI DSS roadmap is a phased plan that takes your organization from an unclear picture of where card data lives to a completed PCI DSS assessment, with scope defined, gaps fixed, evidence collected and controls running all year. It names owners for each part of the work and milestones leadership can track.
The plan below covers 9 months in six phases. It starts with scoping, because scope drives almost everything else: the more systems touch card data, the more controls you must apply and prove. It ends with the assessment and a routine that keeps you compliant between assessments. You will also find who owns what, an example, the metrics to report and how to adapt it.
This guide stays at the planning level. The exact requirements, which validation form you must complete and your deadlines depend on your role, your volume and your card brands and acquirer. Confirm them in the official PCI DSS standard from the PCI Security Standards Council and with your acquirer or Qualified Security Assessor (QSA).
The roadmap at a glance
Goal: Complete your PCI DSS assessment with a documented, reduced scope, all required controls in place with evidence, and a calendar of recurring tasks running. Duration: 9 months
Mobilize and confirm obligations (Weeks 1-3)
Agree on who leads the work and what you must deliver.
- Name an executive sponsor and a PCI program lead, often in security or compliance.
- Confirm with your acquirer or card brands whether you are assessed as a merchant or a service provider, your level, and whether you need a Self-Assessment Questionnaire (SAQ) or a Report on Compliance (ROC).
- Confirm which version of PCI DSS your assessment will use and your assessment date.
- Decide whether you will work with a QSA, and if so, bring them in early for scoping advice.
Milestone: A one-page charter stating your entity type, validation form, assessment date, sponsor and program lead.
Scoping and data flows (Weeks 3-8)
Find every place card data is stored, processed or transmitted.
- Map every payment channel: e-commerce, in-store terminals, call center, mail order and any back-office process.
- Draw data flow diagrams showing where card data enters, moves, is stored and leaves.
- Build an inventory of system components in scope, including connected systems that can affect the security of card data.
- Search file shares, databases and logs for stored card numbers you did not expect.
Milestone: Data flow diagrams, a network diagram and an in-scope system inventory reviewed and signed off by the program lead and IT.
Scope reduction (Weeks 6-14)
Shrink the environment you have to protect and prove.
- Stop storing card data you do not need, and delete what you find in unexpected places through a controlled process.
- Consider outsourcing payment pages or using hosted fields from a validated provider, so card data does not touch your servers.
- Evaluate point-to-point encryption or tokenization for stores and call centers.
- Segment the cardholder data environment from the rest of the network, and plan to test that segmentation.
Milestone: Updated diagrams and inventory showing the reduced scope, with each scope change approved by the sponsor.
Gap assessment (Weeks 12-16)
Compare your current controls with the requirements that apply to you.
- Walk through each applicable requirement for your validation form with the control owners.
- Record each gap in a tracker with requirement number, owner, fix, effort and target date.
- Use the PCI SSC Prioritized Approach to order the work so the highest risks are fixed first.
- Review the gap list with your QSA or internal assessor to confirm interpretation.
Milestone: A gap tracker with every open item assigned an owner and a date, agreed with the assessor.
Remediation (Weeks 16-32)
Close the gaps and put controls into daily operation.
- Fix technical gaps such as configuration hardening, patching, access control, logging and vulnerability scanning.
- Write or update the policies and procedures each requirement needs, and get them approved.
- Complete the targeted risk analyses and other documented activities the current version of the standard asks for, as confirmed with your assessor.
- Train staff who handle card data and run the security awareness program.
- Track progress weekly and escalate blocked items to the sponsor.
Milestone: All high-priority gaps closed and the remaining items on track, confirmed at a status review with the sponsor.
Evidence and assessment (Weeks 30-39)
Prove the controls work and complete the assessment.
- Collect evidence per requirement: screenshots, configs, logs, scan reports, penetration test results, signed policies and training records.
- Run a readiness review or mock assessment and fix what it finds.
- Support the assessment: schedule interviews, provide evidence and answer follow-up questions quickly.
- Submit the completed SAQ or ROC and Attestation of Compliance as your acquirer requires.
Milestone: Assessment completed and the Attestation of Compliance submitted to your acquirer or the brands that require it.
Who owns what
PCI DSS touches security, IT operations, development, finance, legal, customer service and vendors. If the security team owns everything, the work stalls in other teams' queues. Give every requirement area a named control owner and keep the list in the gap tracker.
The program lead does not fix every gap. Their job is to keep scope, gaps, evidence and dates in one place and to escalate when owners are blocked.
- Executive sponsor (CFO, CIO or CISO): priorities, budget and decisions on scope reduction.
- PCI program lead: the roadmap, gap tracker, evidence library and assessor relationship.
- Network and infrastructure lead: segmentation, firewall rules, hardening and patching.
- Application and development lead: secure coding, payment page changes and script management.
- Security operations: logging, monitoring, vulnerability scans and incident response.
- Vendor or procurement manager: service provider inventory, contracts and their compliance status.
- HR and team managers: awareness training and access reviews when people join, move or leave.
Why scope comes first
Every system that stores, processes or transmits card data is in scope, along with systems connected to it or that can affect its security. Each one must meet the applicable requirements and be part of the assessment. A flat network with card data on a few servers can pull hundreds of systems into scope.
That is why scope reduction is its own phase. Removing stored card data you do not need, moving to hosted payment pages, or tokenizing card numbers can shrink the work a great deal. Confirm the effect of each change on your validation form and scope with your acquirer or QSA before you rely on it.
Example: an online and in-store retailer
Picture a retailer with an e-commerce site, 40 stores and a small call center. It completed a SAQ in past years, but a new acquirer asks for a fresh review. Here is how the roadmap could look.
The call center was the surprise. Agents typed card numbers into the order system, which pulled the whole order platform into scope. Fixing that one process removed more work than any other change.
- Months 1-2, Mobilize and scope: CISO sponsors, security manager leads. Data flows mapped for all three channels. Card numbers found in old call recordings and a shared spreadsheet. Milestone: scope inventory signed.
- Months 2-4, Reduce scope: checkout moved to hosted payment fields, call center switched to a payment solution that keeps card data away from agents, old files deleted. Milestone: reduced scope approved.
- Months 4-7, Gaps and remediation: gap tracker built with the Prioritized Approach. Logging, access reviews and script management on the payment page fixed. Milestone: high-priority gaps closed.
- Months 7-9, Evidence and assessment: mock assessment, evidence library completed, assessment done. Milestone: Attestation of Compliance submitted.
Keeping compliance running all year
PCI DSS is not a once-a-year project. Many requirements are periodic: scans, reviews, tests and training that must happen on a schedule. If you only collect evidence before the assessment, you find missed tasks too late to fix them.
Build a compliance calendar after your first assessment. Put each recurring task in it with an owner, a frequency and where the evidence goes. Review it monthly. Check the frequency of each task in the standard and agree it with your assessor rather than guessing.
- Vulnerability scans, internal and external, on the schedule the standard sets.
- Penetration testing and segmentation testing.
- Access reviews for user and admin accounts.
- Firewall and router rule reviews.
- Security awareness training for staff.
- Review of service provider compliance status.
Metrics to track
Leadership wants to know if you will be ready on time. Report a few numbers every two weeks from the gap tracker and the evidence library, not from impressions.
Keep the same format at every review so trends are easy to see. Red items should always come with an owner and a recovery date.
- Open gaps by priority: count of open items, split by Prioritized Approach milestone or by risk level.
- Gaps closed on time: items closed by their target date divided by items due.
- Evidence completeness: requirements with complete evidence divided by applicable requirements.
- Systems in scope: count from the inventory, to show the effect of scope reduction.
- Recurring tasks on schedule: periodic tasks done on time divided by tasks due.
How to present it to leadership
Show one slide with four parts: what you must deliver and by when, the scope today versus the target scope, the six phases with one milestone each, and the top three risks with an owner. Add the open gaps by priority as a single bar.
Leave out the requirement-by-requirement detail. Leadership needs to decide on scope reduction investments and to unblock teams, not to read the standard. Be clear that compliance is a minimum, and that the assessor has the final say on whether a control meets a requirement.
Common mistakes to avoid
- Starting remediation before scoping wastes effort on systems that may leave scope, so map data flows and reduce scope first.
- Assuming your validation form without asking leads to the wrong amount of work, so confirm your level and SAQ or ROC with your acquirer at the start.
- Keeping card data you do not need expands scope and risk, so find it, delete it through a controlled process and stop collecting it.
- Treating PCI DSS as a security-team project stalls fixes in other teams, so name a control owner for every requirement area.
- Collecting evidence only before the assessment exposes missed periodic tasks too late, so run a compliance calendar with owners all year.
- Interpreting requirements alone leads to surprises in the assessment, so review the gap list with your QSA or internal assessor early.
Frequently asked questions
How long does it take to become PCI DSS compliant?
It depends on your scope, your current controls and the validation form you need. A small merchant with hosted payment pages may finish an SAQ quickly. A large organization completing a ROC for the first time often plans for several months to a year. Confirm timelines with your assessor.
What is the first step in PCI DSS compliance?
Confirm your obligations with your acquirer, then scope your environment. Map every payment channel and data flow to find where card data is stored, processed or transmitted. Scope drives the rest of the work.
What is the PCI DSS Prioritized Approach?
It is a tool from the PCI Security Standards Council that groups requirements into milestones ordered by risk. It helps you decide which gaps to fix first. It does not replace the full assessment, so you still need to meet every applicable requirement.
What is the difference between an SAQ and a ROC?
A Self-Assessment Questionnaire is a self-evaluation used by many merchants and some service providers, with several types for different payment setups. A Report on Compliance is a detailed assessment usually performed by a Qualified Security Assessor. Your acquirer or the card brands tell you which one you need.
How can I reduce PCI DSS scope?
Stop storing card data you do not need, use hosted payment pages or tokenization so card data does not touch your systems, and segment the cardholder data environment from the rest of your network. Confirm the effect of each change with your acquirer or QSA.