SOC 2 + PCI DSS Mapping Attestation
A SOC 2 examination with an added section addressing your controls against the PCI DSS v4.0.1 requirements, giving SaaS companies below Level 1 independent evidence behind their Self-Assessment Questionnaire.
- Criteria
- Public PCI DSS v4.0.1 text
- Report
- SOC 2 Type I or II with PCI DSS section
- Engagement
- Additional criteria in your SOC 2 examination
Timeline: Same period as your SOC 2 when the added controls have operated for that period; otherwise we tell you on the scope call.
Who needs SOC 2 + PCI DSS mapping?
Service providers below Level 1
You store, process or transmit cardholder data but are under the volume that requires a QSA-signed Report on Compliance.
Platforms using hosted payments or tokenization
Your scope is small, but customers and acquirers still want evidence behind the SAQ you sign each year.
Marketplaces and billing SaaS
Enterprise customers ask "are you PCI compliant?" and a self-signed questionnaire does not satisfy their vendor risk team.
What is in the report
- Your full SOC 2 opinion on the Trust Services Criteria you select
- An additional section addressing your controls against the twelve PCI DSS v4.0.1 requirements, scoped to your cardholder data environment, based on the mapping management prepares
- Test results for the mapped controls, including network segmentation, encryption of cardholder data, logging and vulnerability management
- A summary you can attach to your SAQ and Attestation of Compliance when a customer asks for independent evidence
What it is not
Not a Report on Compliance. Only a Qualified Security Assessor listed by the PCI Security Standards Council can issue one, and Level 1 service providers need exactly that. Not an ASV scan, and not a QSA signature if your acquirer requires one. Tang Advisory is not a QSA or an ASV. This is an independent CPA attestation that supports the Self-Assessment Questionnaire you sign yourself.
We do not design, implement, or operate the controls we examine.
How it works
The framework is addressed as additional criteria in the same SOC 2 examination: one report, one fieldwork window.
- 1
Scope call
Confirm your cardholder data environment, your SAQ type and what your acquirer and customers ask for.
- 2
Mapping
You map your controls to the PCI DSS v4.0.1 requirements that apply to your SAQ. We evaluate the mapping and can share a template crosswalk, but the mapping is management’s.
- 3
Examination
PCI-mapped controls are tested in the same fieldwork as your SOC 2.
- 4
One report
Signed SOC 2+ report with the PCI DSS section.
Scope, timing and fees
The add-on is scoped together with your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
Customers asking "are you PCI compliant?"
Schedule a free 30-minute preliminary scope discussion. We will confirm your SAQ, tell you whether a SOC 2 + PCI DSS mapping answers the question, and say plainly if you need a QSA instead.