In brief
Maintaining ISO 27001 and PCI DSS means two audit cycles on one shared control set; how fintech and payment teams plan the year and avoid doing it twice.
Maintaining ISO 27001 and PCI DSS after certification means running two different audit cycles on the same systems: ISO 27001 has annual surveillance audits by your certification body, and PCI DSS is reassessed every year through a QSA's Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ). Most controls overlap, so the cheapest approach is to map them once, collect evidence once and run one calendar for the year.
How is maintaining ISO 27001 different from maintaining PCI DSS?
Both frameworks expect controls to operate continuously, but they check them differently. ISO 27001 assesses your management system (ISMS) and lets you set most control frequencies from your risk assessment. PCI DSS fixes the frequency of many requirements and applies only to the cardholder data environment (CDE) and the systems connected to it.
| Aspect | ISO 27001 | PCI DSS v4.0.1 |
|---|---|---|
| Who assesses | An accredited certification body | A QSA (ROC) or a self-assessment (SAQ), depending on the merchant or service-provider level set by the card brands |
| Cycle | 3-year certificate; surveillance audits in years 1 and 2, recertification in year 3 | Reassessed every year |
| Scope | The ISMS scope you define | The CDE and connected systems, confirmed at least every 12 months (12.5.2) |
| Control frequency | Set by risk assessment and "planned intervals" | Many fixed frequencies: account reviews every 6 months (7.2.4), internal scans quarterly (11.3.1), ASV scans quarterly (11.3.2), penetration tests at least every 12 months (11.4) |
Sources: ISO/IEC 27001:2022 and PCI DSS v4.0.1 in the PCI SSC document library. For how long each framework takes to reach in the first place, see how long PCI DSS compliance takes.
Which ISO 27001 and PCI DSS controls can share evidence?
Many controls serve the same purpose. If you design a shared control to the stricter requirement (usually PCI DSS, because its frequencies are fixed), the same evidence satisfies both frameworks.
| Topic | ISO 27001:2022 Annex A | PCI DSS v4.0.1 | What to watch when sharing |
|---|---|---|---|
| Access reviews | A.5.18 | 7.2.4 | Run at least every 6 months to meet PCI |
| Vulnerability management | A.8.8 | 11.3.1, 11.3.2 | Quarterly scans; external ASV scans are PCI-only |
| Penetration testing | A.8.8 (risk-based) | 11.4 | PCI requires at least every 12 months and after significant changes |
| Logging and monitoring | A.8.15, A.8.16 | 10.2, 10.4.1 | PCI requires daily review of security logs |
| Security awareness training | A.6.3 | 12.6 | At hire and at least every 12 months |
| Suppliers | A.5.19 to A.5.22 | 12.8 | PCI requires monitoring each provider's compliance status at least every 12 months (12.8.4) |
| Incident response | A.5.24 to A.5.26 | 12.10 | One plan, tested at least every 12 months for PCI |
| Policies | A.5.1 | 12.1 | Reviewed at least every 12 months (12.1.2) |
The same map-once approach works when you add SOC 2 or HIPAA later; the multi-framework compliance strategy guide covers what is genuinely new work for each framework.
What does a year of running both look like?
The calendar below is an illustrative example for a fintech with its ROC in March and its ISO 27001 surveillance audit in September. Your months depend on your own cycles.
- Daily: review security logs in the CDE (PCI 10.4.1) and run automated cloud configuration checks.
- Quarterly: internal and ASV vulnerability scans (PCI 11.3), close evidence tasks that are due, update the vendor list.
- Every 6 months: an access review covering both the CDE and the ISMS scope (PCI 7.2.4, ISO A.5.18).
- Before the ROC (January to February): confirm PCI scope (12.5.2), run the annual penetration test (11.4), review policies (12.1.2, A.5.1).
- After the ROC (April to June): close the QSA's findings and feed the results into the ISO 27001 risk assessment.
- Before the surveillance audit (July to August): ISO 27001 internal audit (clause 9.2) and management review (clause 9.3), reusing evidence already collected for PCI.
One calendar and one evidence repository are what stop two audits from turning into two separate sprints.
Why do certified teams still struggle to keep up?
The same three causes show up in most companies. First, the consultant who got you certified does not stay to run operations, so after the project everything drifts back to spreadsheets and email. Second, compliance is usually a part-time job for a CTO or IT manager, so recurring work slips until an audit is close. Third, evidence is scattered: CloudTrail logs in an S3 bucket, access-review confirmations in a manager's inbox, scan reports in a personal folder, vendor contracts in legal's Drive. When the QSA or the certification body asks for 12 months of evidence, the team searches instead of exporting. The general version of this problem, across SOC 2, HIPAA and GDPR as well, is covered in maintaining compliance after certification.
How does pTrackly help maintain ISO 27001 and PCI DSS?
pTrackly includes ISO 27001 and PCI DSS 4.0.1, and controls are shared across frameworks: a published policy or a completed task counts for every framework linked to it. Evidence tasks have a frequency from daily to annual, an owner and a review date, with reminders 7, 3 and 1 days before they are due and escalation when overdue. Access reviews can recur every 6 months and record each decision; cloud tests can run daily as evidence; the Pentest module tracks findings, remediation progress and the final report; the vendor register warns before certificates and contracts expire. Each audit runs in its own workspace, and auditors see only the audit they are invited to. pTrackly is not a QSA or a certification body: the QSA performs the ROC, the certification body performs the surveillance audit, and your team operates the controls. See pTrackly for certified teams and the PCI DSS framework page.
Frequently asked questions
Can the PCI DSS ROC and the ISO 27001 surveillance audit be combined into one audit?
They are performed by different parties (a QSA and a certification body) against different standards, so they remain two audits. What you can combine is the evidence: one repository organized by control serves both.
Which PCI DSS requirements are stricter than ISO 27001 in day-to-day operations?
PCI DSS fixes the frequency of many activities, such as account reviews every 6 months (7.2.4), quarterly scans (11.3) and daily security log reviews (10.4.1). ISO 27001 leaves frequency to your risk assessment, so a control designed to the PCI frequency usually satisfies both.
How often does an ISO 27001 surveillance audit happen?
The certification body performs surveillance audits in the first and second years after certification, then a recertification audit before the 3-year certificate expires.
Does the PCI DSS scope have to match the ISMS scope?
No. The PCI scope is the CDE and connected systems; the ISMS scope is what you define and is usually broader. Shared controls need to cover both scopes.
