Combined PCI DSS + SOC 2 assessments

One evidence set, two reports. If your buyers ask for both PCI DSS and SOC 2, combining the assessments saves real money — done right.

Why combine

PCI DSS and SOC 2 overlap substantially: access control, logging, change management, risk assessment, vendor management. A combined engagement tests each control once and maps the evidence to both frameworks — typically saving 20–40% versus two separate assessments in planning estimates, and halving the disruption to your team.

What has to be true

• One firm, both credentials. The firm must be an accredited QSA company and a licensed CPA firm (for SOC 2) — several firms in our directory hold both.
• Aligned periods. SOC 2 Type 2 needs an observation period (typically 6–12 months); the PCI ROC is point-in-time. Sequence so the SOC 2 observation covers the PCI fieldwork window.
• One evidence request list. Insist on a unified request list mapped to both frameworks — if you get two separate lists, you’re paying for two audits wearing a trench coat.

Pitfalls

• Different teams, no coordination. Confirm a single engagement manager owns both workstreams.
• Scope mismatch. PCI scope (cardholder data environment) and SOC 2 scope (system boundaries) differ — the combined scoping session must define both explicitly.
• Renewal drift. The two cycles can drift apart over the years; re-align them at each renewal or the savings evaporate.