Guide
Questions to ask a PCI QSA before you sign
Good questions to ask a PCI QSA reveal how the assessment will run. So send them before signing, and compare answers from two or three firms side by side.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Questions to ask a PCI QSA about the firm
First, confirm the company is on the official list. Then ask who will lead your assessment and how many assessments they handle each year.
Also ask about experience with your payment channels, for example e-commerce or card-present.
Questions about scope and fee
Ask which scope the quote assumes. Because scope drives effort, a quote built on a narrower scope can grow later.
| Topic | Question |
|---|---|
| Listing | Is the firm on the official QSA list? |
| Scope | Which systems and locations does the quote assume? |
| Fee changes | What changes the fee? |
| Onsite | How many onsite or remote days? |
| Timeline | When will the report be issued? |
| Findings | How are gaps handled during fieldwork? |
Questions to ask a PCI QSA: your check
Tick what each firm answered.
Your result appears here as you tick, so you can see what is still open.
Questions to ask a PCI QSA about the process
Ask when the evidence request arrives and how the firm handles gaps found during fieldwork. Then ask how long you have to fix them before the report.
In addition, ask how the firm handles providers' AOCs and responsibility matrices.
Questions about independence
A QSA that assesses you should not also build your controls. So ask how it separates consulting from assessment. Clear answers are a good sign.
Also tell the QSA about any consultant you use, so roles stay clear.
Red flags in the answers
Be careful with a quote far below others, vague team names or any promise of a passing result. Nobody can promise the outcome before assessing.
Also ask how the firm treats compensating controls. A clear process is better than an open promise.
Where Ashcroft helps
We help you compare proposals and prepare for the QSA you choose. Our gap analysis fee runs $8,000 to $40,000. We are not a QSA and we do not issue AOCs. Listed firms appear on the official QSA company list.
Questions to ask a PCI QSA: answers
How many questions to ask a PCI QSA are enough?
Around ten, covering listing, team, scope, fee, process and independence.
When should we send questions to ask a PCI QSA?
Before signing, ideally to two or three firms at once.
Should we ask for references?
Yes, from companies with similar payment channels.
Can a QSA promise a pass?
No. The result depends on the assessment.
Related guides
Bring questions to ask a PCI QSA
Send us the proposals you received. We reply with a written estimate, usually inside one business day.
Get my written estimate