QSA (Qualified Security Assessor)

A Qualified Security Assessor (QSA) is an individual employed by a company approved by the PCI SSC (PCI Security Standards Council) who has been specifically trained and certified to conduct PCI DSS assessments. QSAs perform on-site audits of merchants' and service providers' environments, evaluate compliance with PCI DSS requirements, and produce the formal ROC (Report on Compliance) that Level 1 merchants and service providers submit to their acquiring banks.

QSA certification is not trivial. QSAs must complete PCI SSC training, pass a qualification exam, and be employed by a PCI SSC-approved QSA company. QSA companies must meet security and qualification standards set by the PCI SSC and are subject to requalification. The PCI SSC publishes a list of qualified QSA companies on its website, a starting point for merchants seeking an assessor.

Not every merchant needs a QSA. Level 1 merchants (typically those processing more than six million Visa/Mastercard transactions annually) are required to undergo annual QSA assessments. Service providers processing more than 300,000 transactions annually are generally required to use a QSA. Lower-volume merchants and service providers may validate compliance through a SAQ (Self-Assessment Questionnaire) without a QSA, though they may choose to engage one for guidance. Many organizations also use QSAs in an advisory capacity, reviewing their environments and controls in preparation for a formal assessment, before the assessment itself.

Frequently Asked Questions

What is the difference between a QSA and an ISA?

An ISA (Internal Security Assessor) is an employee of a merchant or service provider who has been trained by the PCI SSC to perform internal PCI DSS assessments for their own organization. Unlike QSAs (who are independent third parties), ISAs assess their own employer's environment.

What does a QSA assessment involve?

A full QSA assessment involves on-site visits to the merchant's or service provider's environment, review of policy and procedure documentation, interviews with key staff, technical testing of system configurations, review of network diagrams and data flow documentation, and testing of specific technical controls (access controls, logging, encryption configuration, vulnerability scan results). The assessment culminates in a Report on Compliance (ROC), a detailed document covering every applicable PCI DSS requirement, the testing performed, and the findings.

How do I choose the right QSA for my organization?

Key factors include industry experience (QSAs with experience in your business model, e-commerce, subscription, marketplace, will assess more efficiently and accurately), size and scope (larger QSA firms have more resources for complex environments; boutique firms may offer deeper expertise for specific niches), geographic coverage (important for multinational organizations), and references from similar organizations. The PCI SSC's QSA company list is the starting point, but direct reference checks and pre-engagement conversations are essential.

QSA (Qualified Security Assessor)

Frequently Asked Questions

What is the difference between a QSA and an ISA?

What does a QSA assessment involve?

How do I choose the right QSA for my organization?

Related Terms

Insights and updates you actually care about