Certification is legitimate for 5 (five) yrs within the day the Preliminary certification examination is handed and is just legitimate after PCI has finished the decision to problem the certificate. E-commerce retailers who outsource all payment processing to PCI DSS validated 3rd parties, and that have an internet site(s) that https://www.nathanlabsadvisory.com/blog/nathan/fast-affordable-soc-2-certification-services-in-the-usa/