Guide
The PCI QSA: who they are, and what only they may do
A PCI QSA, or Qualified Security Assessor, is a person working for a company approved by the PCI Security Standards Council. Only a QSA may perform a formal assessment for a Report on Compliance, so choosing one well matters.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What only a PCI QSA may do
The role is licensed, and the limits are clear.
| Task | Who may do it |
|---|---|
| Formal assessment and ROC | A QSA, or an internal assessor for merchants. |
| Sign the AOC on the ROC route | The QSA, with your executive. |
| Readiness and remediation | Anyone, including consultants. |
| Quarterly ASV scans | Only an approved scanning vendor. |
How to verify a PCI QSA
Check the company on the official QSA company list. Also ask which individual assessors will work on your engagement, because qualification belongs to people within approved companies.
PCI QSA readiness check
Tick what is in place before you engage a QSA.
Your result appears here as you tick, so you can see what is still open.
Choosing a QSA firm
Ask the same questions of every firm, so answers are comparable.
- How many assessments like ours do you perform each year?
- Who will lead our engagement?
- What evidence format do you prefer?
- Is the fee fixed for the agreed scope?
A QSA-led ROC assessment typically runs $50,000 to $250,000. So compare scope carefully, because two quotes can describe different work.
Why independence matters
A QSA tests your controls, so it should not have designed them. Therefore many businesses use a readiness firm to prepare, then an independent QSA to assess. That separation also keeps the assessment credible to your bank.
Our role alongside your PCI QSA
We prepare you, then coordinate with your QSA during the assessment. However, we are not a QSA, and we never perform or sign assessments.
Also ask about availability early, because many QSA firms book up before the year-end rush. A firm that cannot start before your deadline is no help, however strong its reputation.
PCI QSA questions
Do we always need a PCI QSA?
No. Many merchants self-assess with an SAQ, depending on level and acquirer.
Can our consultant be our QSA?
It is better to keep them separate, so the assessment stays independent.
How do we find a PCI QSA?
Use the official list on the PCI SSC website, or ask us for introductions.
Are you a QSA?
No. We prepare businesses and introduce independent QSA firms.
Related guides
Need a QSA introduction?
Tell us your level and scope. We reply with a readiness estimate and can introduce independent QSA firms.
Get my written estimate