Most PCI DSS engagements in India are sold on price and delivered on paper. A vendor quotes you the lowest number, hands you a Report on Compliance that reads well, and then quietly hopes the acquiring bank never asks a hard question. Six months later a card scheme forensic team lands after a breach, pulls your last assessment, and finds that half the controls were never actually tested — they were attested.

So the real question is not who is the cheapest QSA in India. It is who will sit in your CDE, argue with your engineers about a firewall rule, and put their empanelment on the line for what they sign. That is a very short list, and it looks nothing like the one you get from a generic Google search.

PCI DSS is the Payment Card Industry Data Security Standard. It is a contractual security standard maintained by the PCI Security Standards Council on behalf of the card brands (Visa, Mastercard, American Express, Discover, JCB). It applies to any organisation that stores, processes or transmits cardholder data. In India that captures banks, payment aggregators regulated by the RBI, e-commerce platforms, BPOs handling card data on behalf of overseas clients, and increasingly SaaS companies whose customers push the requirement down the contract chain.

The current version is PCI DSS v4.0.1. The transition from v3.2.1 closed on 31 March 2024, and a large block of the new future-dated requirements became mandatory on 31 March 2025. If your provider is still assessing you against v3.2.1 language, that is your first warning sign — the standard moved and they did not.

Cardholder data means the Primary Account Number (PAN) plus, where present, cardholder name, expiry and service code. Sensitive Authentication Data (SAD) — the full track data, CVV/CVV2 and PIN block — must never be stored after authorisation. That single rule, Requirement 3.2, is where a surprising number of Indian merchants quietly fail because a developer logged a full authorisation response to a debug file three years ago and nobody noticed.

PCI compliance is not one thing. Your obligations scale with the volume of card transactions you handle, and the level dictates whether you can self-attest or must bring in an external assessor.

Two roles above matter most and are constantly confused. A QSA is a firm and its named assessors, certified by the PCI Council, allowed to perform the on-site assessment and sign your RoC and AoC. An ASV is an Approved Scanning Vendor, a separate certification, allowed to run the external vulnerability scans mandated by Requirement 11.3.2. Many firms hold one and not the other. If you are a Level 1 service provider you need both — either from one house or coordinated between two.

Every PCI provider will tell you they are thorough. Here is how you actually tell them apart before you sign, using the same tests I apply when a client asks me to review another firm's work.

Weak assessors let you draw the smallest possible Cardholder Data Environment (CDE) because a small scope is a cheap assessment and a happy client. Good assessors do the opposite. They chase every system that can affect the security of the CDE — the jump host, the DNS server, the monitoring stack, the developer laptop with production database access. Requirement 12.5.2 makes annual scope confirmation your obligation, but a real QSA will pressure-test your scope diagram and network segmentation with actual segmentation penetration testing under Requirement 11.4.5, not a walkthrough of a Visio file.

The difference between attestation and testing is the whole game. A rubber stamp asks whether you rotate keys. A real QSA asks to see the key ceremony log, the split-knowledge and dual-control records under Requirement 3.6, and the exact date the last key was retired. They sample. For a control like Requirement 8.3.6 password length, they will pull the actual authentication configuration, not a policy PDF that says the right thing.

PCI DSS does not live alone in India. It sits on top of RBI mandates. The RBI Storage of Payment System Data circular (April 2018) requires the entire payment data to be stored only in India — which collides directly with global tokenisation providers. The RBI Card-on-File Tokenisation framework (CoFT) means merchants and aggregators can no longer store actual card numbers, which changes your PCI scope dramatically. And the Digital Personal Data Protection Act 2023 now layers Indian privacy obligations on the same cardholder records. A QSA who cannot speak to how CoFT shrinks your Requirement 3 obligations is a QSA who has not done Indian work.

Ask who signs your RoC. Ask for their QSA employee number and whether they are the same person who will be on site. In too many engagements a senior name closes the sale and a first-week analyst runs the fieldwork. For anything touching national payment infrastructure, CERT-In empanelment of the firm is a meaningful additional filter — it means the government has vetted their audit competence.

You will find the same names on every listicle: the Big Four audit arms, the large Indian IT services players, a handful of pure-play security boutiques, and the offshore delivery centres of global QSAs. Rather than rank logos, evaluate any provider on the ten criteria that actually predict whether your assessment survives a breach investigation.

On that last row, watch for a genuine conflict of interest. PCI ethics rules discourage a QSA from assessing controls it designed and implemented itself. A firm that builds your segmentation and then signs off on that same segmentation is grading its own homework. Real independence means the advisory and the assessment are separated, or at least declared.

Vendors love round numbers and single line items. A truthful PCI programme is neither. Here is the honest shape of a first-time Level 1 service provider engagement in India, in INR.

Anyone quoting a flat two lakh for a Level 1 RoC is selling a document, not an assessment. The number moves with the size of your CDE, the number of applications in scope, and how much remediation the gap phase surfaces. A tight, well-segmented environment with one payment application costs far less than a sprawling estate with card data leaking into four microservices.

A mid-size payment aggregator in Bengaluru, Level 1, engaged us after passing three consecutive self-assessments with another vendor. They were confident. The AoCs were clean.

On day two of fieldwork we pulled application logs to test Requirement 10, the logging and monitoring controls. Inside a debug log directory that predated their current CTO, we found full authorisation response payloads — including the service code and, in a subset of records, unmasked PAN. That is a Requirement 3.2 and 3.4 failure, storage of data that should never persist, sitting in plain text on a server that their previous assessor had marked in scope but never actually inspected the filesystem of.

The fix was not glamorous. We froze the directory, forensically confirmed the data had not been exfiltrated, purged it under a documented secure-deletion procedure, rewrote the logging library to tokenise before write, and re-ran the sampling across every log store. It added five weeks and about seven lakh to their programme. It also almost certainly saved them a card-brand fine and a mandatory Payment Card Industry Forensic Investigator engagement that would have cost ten times as much. The previous three clean assessments were, in the language we do not use in front of clients, worthless.

The lesson is blunt. A PCI assessment is only as good as the evidence the assessor was willing to open. Clean paperwork from a firm that never touched your filesystem is not compliance. It is a liability with a signature on it.

Across engagements, failures cluster. If you fix these five before your assessor arrives, you shorten the programme and shrink the bill.

Do this internally first. It makes every quote you receive cheaper and every assessor you interview easier to judge.

The best PCI DSS provider in India is not the one with the shiniest logo or the lowest quote. It is the one who will open your log files, argue about your segmentation, understand how RBI data localisation and CoFT reshape your scope, and stake a named QSA signature on evidence they personally tested. Everything else is a certificate that looks reassuring right up until the moment it needs to be true.

At CyberSigma we run PCI DSS assessments the hands-on way — senior CERT-In empanelled auditors and QSAs who sit in your CDE, test the controls themselves, and tell you what is actually broken before a card brand does. If you would rather know now than during a forensic investigation, that is the conversation we are built for.