Home › PCI program alternatives

Merchant PCI program alternatives for ISOs, acquirers and PayFacs

Most ISOs, acquirers and PayFacs run merchant PCI validation through an established managed program. If you are reviewing yours, or choosing one for the first time, here is how the providers ISOs most often compare describe themselves, the questions to ask each, and how an API-first, white-label option differs.

Short answer

Managed programs such as SecurityMetrics and VikingCloud (which now includes ControlScan) bundle the SAQ with services like ASV scanning and merchant support. Compliance Assessment Tool is an API-first alternative focused on the SAQ and AoC: merchants describe how they take payments, AI picks the right SAQ for each payment method, and they answer plain-English questions under your brand and sign the official documents, for $25 per completed assessment. Choose by how many merchants finish, whose brand they see, how you integrate, and which services you need bundled.

The vendors

Vendor	What its own website says	Comparison
SecurityMetrics	A PCI Program for acquirers, ISOs and payment service providers, listing a partner portal, merchant support, ASV scans and an SAQ auto-fill tool.	SecurityMetrics alternative →
ControlScan	Acquired by Sysnet Global Solutions in December 2020; now operates under the VikingCloud name, and controlscan.com redirects to vikingcloud.com.	ControlScan alternative →
VikingCloud	Formerly Sysnet Global Solutions. Programs for processors, acquirers and ISOs, listing self-service SAQ reporting, ASV scans, dashboards, white-label options and an API.	VikingCloud alternative →

From each company's own website as of October 2026. Capabilities vary by program; confirm details with each vendor.

Questions to ask any of them

SAQ selection: How is the SAQ chosen? Who decides, the merchant or the tool, and what happens when a merchant takes cards more than one way?
Merchant experience: Can we see the exact questions a merchant with a countertop terminal answers? What share of invited merchants complete, and how long does it take them?
Branding and white-label: Whose brand does the merchant see in the emails, the portal and the documents? Is white-label included or extra?
Integration options: Is there a documented API, and can our engineers test it today, before a contract?
Portfolio reporting: What does the portfolio report show, can we export it in our sponsor bank's format, and can our systems receive status events?
Document output: Is the output the official PCI SSC SAQ and AoC, signed by the merchant?
Pricing model: Is it priced per merchant, per month, per assessment, or bundled into a fee charged to merchants? Who pays, you or the merchant?
Bundled services: Which services are bundled (scans, breach coverage, support), and can we drop the ones we don't need?
Switching and renewals: Can we export every merchant's status, SAQ type, AoC and validation dates as CSV? What do our contract's notice and data-return terms say?

More on each criterion in our guide to choosing a merchant PCI compliance program.

Where Compliance Assessment Tool fits

CAT is a PCI DSS compliance engine for ISOs, acquirers and PayFacs, under your brand. Each merchant describes how they take payments; AI picks the right SAQ for each payment method (all nine merchant SAQs under PCI DSS v4.0.1), and every question is written in plain English for that business and payment method, with each answer shaping the next. The merchant reviews and confirms every answer, signs digitally, and gets the official PCI SSC SAQ and AoC, filled in. You launch through a white-label portal, an embeddable iframe, the REST API or an MCP server, and see your whole portfolio through a portfolio API, CSV export and signed webhooks. Annual renewals carry prior answers forward. Pricing is $25 per completed assessment.

When CAT is not the better fit: if you want one provider to bundle ASV scans, breach coverage and a merchant call center under a single contract, a managed program is likely a better match. You can also pair CAT with a scanning vendor.

Switching programs

Read your current contract. Note the term, the notice period, the renewal date and what it says about returning your data.
Export your merchant list. For each merchant: merchant ID, legal and DBA name, contact email, payment channels, SAQ type, AoC date and validation expiry. A CSV is enough.
Keep existing AoCs valid until they expire. A merchant that validated last quarter does not need to start again. Keep its SAQ and AoC on file, and move it at its next annual renewal.
Re-validate at renewal. Invite merchants to CAT in renewal-date cohorts with a bulk CSV invite and branded emails, or build it into your portal with the iframe or API. Their next renewal on CAT carries this year's answers forward.
Board new merchants on CAT from day one, so the old program only has to cover merchants until their renewal.
Keep scanning covered. Merchants whose SAQ requires quarterly ASV scans still need them; keep your scanning vendor or choose one.
Tell your sponsor bank or acquirer, and agree how portfolio reporting will look during the overlap. CAT's CSV export and portfolio API cover the merchants it handles.
Update merchant communications and billing, including any program or non-compliance fee wording in your merchant agreement.

Compare it with your own merchants

Free sandbox credentials as soon as you verify your email. It runs the same API and engine as production.

Get a free sandbox → How it works

Common questions

Why would an ISO switch merchant PCI vendors?

Common reasons are wanting more merchants to finish, wanting the experience under the ISO's own brand, needing an API to build PCI validation into onboarding, wanting clearer portfolio reporting for the sponsor bank, or changing how the program is priced. Whatever the reason, compare vendors on the same questions and with your own merchants' descriptions.

Are ControlScan and VikingCloud the same company?

ControlScan was acquired by Sysnet Global Solutions in December 2020, and Sysnet rebranded to VikingCloud in April 2022, with ControlScan operating under the VikingCloud name. controlscan.com now redirects to vikingcloud.com.

Is Compliance Assessment Tool a full replacement for a bundled PCI program?

For the SAQ and Attestation of Compliance, yes: SAQ selection for all nine PCI DSS v4.0.1 merchant SAQs, a plain-English assessment, and the official signed SAQ and AoC, with portfolio reporting. CAT does not provide ASV scans, breach insurance or a merchant call center; if you need those, pair CAT with providers for them or choose a bundled program.

Do merchants have to redo their SAQ when we change PCI vendors?

Not straight away. A merchant's current SAQ and Attestation of Compliance cover its current validation year, whichever tool produced them. The usual approach is to keep each AoC on file until it expires and move that merchant to the new program at its next annual renewal. Your acquirer sets the validation requirements, so confirm the plan with them.

Can we try Compliance Assessment Tool before we switch?

Yes. Sandbox credentials are free and issued as soon as you verify your email, and the sandbox runs the same API and engine as production. Run your own merchants' descriptions of how they take payments through it and compare the questions and documents side by side.

SecurityMetrics, ControlScan and VikingCloud are trademarks of their owners. Compliance Assessment Tool is not affiliated with, endorsed by or sponsored by any of them, and names them only to describe their published offerings. Descriptions of other companies come from their own websites as of October 2026 and may have changed; confirm details with each vendor. Compliance Assessment Tool facilitates merchant PCI DSS self-assessment. It is not a Qualified Security Assessor and does not certify compliance; acquirers set each merchant's validation requirements.