A ControlScan alternative for ISOs, acquirers and PayFacs

Reviewing your merchant PCI program, or comparing ControlScan before you sign? Here is a fair description of ControlScan, the questions worth asking any vendor, how Compliance Assessment Tool works, and a practical plan for switching.

About ControlScan

ControlScan was a provider of PCI compliance and managed security services. VikingCloud's own press release says ControlScan was acquired by Sysnet Global Solutions in December 2020, and that when Sysnet rebranded to VikingCloud in April 2022, Sysnet, SecureTrust, NuArx and ControlScan would all operate under the VikingCloud name.

Today controlscan.com redirects to vikingcloud.com. VikingCloud offers PCI compliance programs for processors, acquirers and ISOs; we describe them on our VikingCloud alternative page.

If your ISO or bank signed a merchant PCI program with ControlScan, your contract and account team are the authority on which entity and platform provide it today.

What to compare

The same questions apply to any merchant PCI program. The CAT column is what we do; the right-hand column is what to ask ControlScan. We don't answer for them.

What to compare	Compliance Assessment Tool	Ask ControlScan
SAQ selection	The merchant describes each way they take payments in their own words. AI picks the right SAQ for each payment method from all nine PCI DSS v4.0.1 merchant SAQs, asking a follow-up only when it needs one.	How is the SAQ chosen? Who decides, the merchant or the tool, and what happens when a merchant takes cards more than one way?
Merchant experience	Every question is written in plain English for that business and that payment method, and each answer shapes the next. The merchant reviews and confirms every answer; nothing is auto-attested.	Can we see the exact questions a merchant with a countertop terminal answers? What share of invited merchants complete, and how long does it take them?
Branding and white-label	Your brand: a white-label portal and embeddable iframe, and branded invite emails.	Whose brand does the merchant see in the emails, the portal and the documents? Is white-label included or extra?
Integration options	Zero-code bulk invites, a platform redirect, an embeddable iframe, a REST API (OpenAPI 3.1) and an MCP server for AI agents. An optional Authorize.Net connection reads how a merchant takes payments.	Is there a documented API, and can our engineers test it today, before a contract?
Portfolio reporting	Portfolio visibility for ISOs and banks: a portfolio API, CSV export for your sponsor bank, and signed webhooks.	What does the portfolio report show, can we export it in our sponsor bank's format, and can our systems receive status events?
Document output	The official PCI SSC SAQ and Attestation of Compliance, filled in and signed digitally by the merchant, as PDFs.	Is the output the official PCI SSC SAQ and AoC, signed by the merchant?
Pricing model	$25 per completed assessment. Free sandbox.	Is it priced per merchant, per month, per assessment, or bundled into a fee charged to merchants? Who pays, you or the merchant?
Bundled services	None: CAT does the SAQ and AoC. Pair it with an Approved Scanning Vendor if merchants need quarterly scans.	Which services are bundled (scans, breach coverage, support), and can we drop the ones we don't need?
Switching and renewals	Bulk CSV invites move merchants over at their renewal dates. From then on, annual renewals carry the prior year's answers forward.	ControlScan now operates under the VikingCloud name. Ask whether your program has moved, or will move, to a VikingCloud platform, what changes for your merchants, and whether you can export every merchant's status, SAQ type, AoC and validation dates as CSV.

The full list of criteria is in our guide to choosing a merchant PCI compliance program.

Where Compliance Assessment Tool fits

CAT is a PCI DSS compliance engine for ISOs, acquirers and PayFacs, under your brand. Each merchant describes how they take payments; AI picks the right SAQ for each payment method (all nine merchant SAQs under PCI DSS v4.0.1), and every question is written in plain English for that business and payment method, with each answer shaping the next. The merchant reviews and confirms every answer, signs digitally, and gets the official PCI SSC SAQ and AoC, filled in. You launch through a white-label portal, an embeddable iframe, the REST API or an MCP server, and see your whole portfolio through a portfolio API, CSV export and signed webhooks. Annual renewals carry prior answers forward. Pricing is $25 per completed assessment.

When CAT is not the better fit: If you want one provider to bundle scanning, security services and the SAQ under a single contract, a broader managed program may suit you better than CAT. You can also pair CAT with a scanning vendor.

Switching from ControlScan

You don't have to move every merchant at once. Most of the work is lining up each merchant's move with its renewal date.

1. Read your current contract. Note the term, the notice period, the renewal date and what it says about returning your data.
2. Export your merchant list. For each merchant: merchant ID, legal and DBA name, contact email, payment channels, SAQ type, AoC date and validation expiry. A CSV is enough.
3. Keep existing AoCs valid until they expire. A merchant that validated last quarter does not need to start again. Keep its SAQ and AoC on file, and move it at its next annual renewal.
4. Re-validate at renewal. Invite merchants to CAT in renewal-date cohorts with a bulk CSV invite and branded emails, or build it into your portal with the iframe or API. Their next renewal on CAT carries this year's answers forward.
5. Board new merchants on CAT from day one, so the old program only has to cover merchants until their renewal.
6. Keep scanning covered. Merchants whose SAQ requires quarterly ASV scans still need them; keep your scanning vendor or choose one.
7. Tell your sponsor bank or acquirer, and agree how portfolio reporting will look during the overlap. CAT's CSV export and portfolio API cover the merchants it handles.
8. Update merchant communications and billing, including any program or non-compliance fee wording in your merchant agreement.

Common questions

What happened to ControlScan's merchant PCI program?

Sysnet Global Solutions acquired ControlScan in December 2020, and in April 2022 Sysnet rebranded to VikingCloud, announcing that Sysnet, SecureTrust, NuArx and ControlScan would all operate under the VikingCloud name. The controlscan.com website now redirects to vikingcloud.com. Your contract and account team can confirm which entity and platform provide your program today.

Is Compliance Assessment Tool affiliated with ControlScan or VikingCloud?

No. Compliance Assessment Tool is an independent company with no affiliation with, or endorsement from, ControlScan or VikingCloud. Both names are trademarks of their owners.

Does CAT provide ASV scans?

No. CAT handles SAQ selection, the plain-English assessment and the signed SAQ and AoC. If your merchants' SAQs require quarterly external scans, pair CAT with an Approved Scanning Vendor.

Do merchants have to redo their SAQ when we change PCI vendors?

Not straight away. A merchant's current SAQ and Attestation of Compliance cover its current validation year, whichever tool produced them. The usual approach is to keep each AoC on file until it expires and move that merchant to the new program at its next annual renewal. Your acquirer sets the validation requirements, so confirm the plan with them.

Can we try Compliance Assessment Tool before we switch?

Yes. Sandbox credentials are free and issued as soon as you verify your email, and the sandbox runs the same API and engine as production. Run your own merchants' descriptions of how they take payments through it and compare the questions and documents side by side.

Also compared: SecurityMetrics alternative · VikingCloud alternative · all PCI program alternatives

ControlScan and VikingCloud are trademarks of their owners. Compliance Assessment Tool is not affiliated with, endorsed by or sponsored by any of them, and names them only to describe their published offerings. Descriptions of other companies come from their own websites as of October 2026 and may have changed; confirm details with each vendor. Compliance Assessment Tool facilitates merchant PCI DSS self-assessment. It is not a Qualified Security Assessor and does not certify compliance; acquirers set each merchant's validation requirements.