ROC vs SAQ: Which PCI Validation Path Do You Actually Need?
The one-paragraph difference
A ROC (Report on Compliance) is a full on-site assessment performed by a Qualified Security Assessor, required for Level 1 merchants (6M+ transactions/year) and most service providers. An SAQ (Self-Assessment Questionnaire) is a questionnaire you complete yourself -- validated by your own attestation -- available to smaller merchants whose acquirer accepts it. The ROC is deeper, slower, and 3--4x the cost.
Side-by-side
| ROC | SAQ | |
|---|---|---|
| Performed by | QSA company (on-site) | You (self-assessment; QSA guidance optional) |
| Required for | Level 1 merchants, most service providers | Level 2--4 merchants, if acquirer accepts |
| Published cost | $20k–$200k+ | $3k–$15k (QSA-assisted) |
| Time to AOC | 3–6 months | 4–12 weeks |
| Deliverable | ROC + Attestation of Compliance | Completed SAQ + Attestation of Compliance |
Who must do a ROC
Level 1 merchants (over 6 million transactions/year across card brands) and service providers at the corresponding levels. Some acquirers also require ROCs from Level 2 merchants -- confirm with yours in writing.
When SAQ is enough
- Your acquirer explicitly accepts SAQ validation for your level.
- You match an SAQ type cleanly (see SAQ types explained).
- No customer contract or partner agreement demands a ROC.
The common mistake
Paying for a ROC nobody required. If your acquirer accepts an SAQ and no contract demands more, a QSA-validated SAQ plus clean ASV scans satisfies compliance at a fraction of the cost. Conversely, submitting an SAQ when your acquirer expects a ROC wastes the whole cycle. Confirm the requirement in writing first.
Questions
Can a QSA sign off on my SAQ?
Yes -- many merchants hire a QSA to validate their SAQ responses and co-sign the attestation. It adds credibility with acquirers and partners without the cost of a full ROC.
Does a ROC last longer than an SAQ?
No -- both produce an Attestation of Compliance valid for one year. Annual renewal applies either way.
Related reading
Get quotes from PCI QSA firms
Tell us about your environment once -- matched assessors reply with scoped quotes. Free, 2 minutes.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.