How to Select a Qualified Security Assessor (QSA) for PCI DSS

A Qualified Security Assessor (QSA) is the person who assesses an organisation against PCI DSS and prepares its Report on Compliance. Choosing one is choosing who will read your environment closely for weeks and whose conclusions your acquirer or the payment brands will rely on. This article covers what a QSA is, how to confirm the one you are talking to is listed, what to ask, and what to watch for.

What a QSA is

The PCI Security Standards Council qualifies companies as QSA companies and their employees as QSAs, and lists the companies on its site. A QSA assesses an environment against the standard's testing procedures: examining documents, configurations and records and interviewing staff. The ROC and the Attestation of Compliance the QSA produces are what a merchant or service provider submits when a brand or acquirer requires a ROC rather than a Self-Assessment Questionnaire.

Not everyone needs one. Whether you validate with a ROC or an SAQ is set by the payment brands and your acquirer; Do you need a PCI DSS audit? covers how that is decided. Some organisations train their own staff as Internal Security Assessors, who can assess their own employer; whether an ISA's work is accepted in place of a QSA's is a brand and acquirer decision.

Confirm the company is listed

Start with the Council's list of QSA companies. It shows each company and the markets it is listed to serve. Find an assessor on this site draws on the same listing. Ask for the names of the people who will do your assessment and confirm they hold QSA status with that company; a sales contact is not always the assessor. For Australia, PCI QSA companies in Australia lists the Council's Australian entries.

Match the assessor to your environment

The assessment goes faster, and misses less, when the assessor has seen environments like yours:

• How you take payments: card-present terminals, e-commerce through a hosted page or an iframe, a payment application you run yourself, a call centre.
• Where it runs: on premises, in one cloud provider or several, in containers, on shared platforms from a service provider.
• How big and how spread out it is: one site or many, one legal entity or several.

Ask for examples of similar assessments and for references you can speak to. Past clients are the best source on how thorough and how clear an assessor was.

Scope and cost

The standard does not price an assessment, and there is no reliable public figure to plan around. What drives the effort is what the assessor has to examine: how large the cardholder data environment is, how many locations and system types are in it, whether segmentation has to be tested and relied on, and how ready your evidence is. The single biggest lever you control is scope. Confirming it properly under 12.5.2 before the assessor arrives, and keeping account data out of systems that do not need it, reduces what the assessor has to cover.

Ask each company for a written statement of what its quote covers, how many days on site or remote, what happens if scope changes during the assessment, and whether a pre-assessment is included.

Separate advice from assessment

Many QSA companies also sell consulting, remediation and products. Think carefully before having the same organisation design a control and then assess it, and ask how the company keeps those roles apart. Warning signs:

• the assessor steers you towards a particular product, especially one the company sells or resells;
• a promise of a compliant result before anyone has looked at your environment;
• a timeline that leaves no room to examine what the testing procedures require.

Work with the assessor during the year

An assessor who knows your environment from last year spends less time relearning it. Share scope changes as they happen, raise questions about how a requirement applies before you build a control rather than after, and keep evidence as you go: each control page on this site lists what an assessor will examine, taken from the standard's testing procedures.

Feedback about an assessor

The Council runs a quality assurance programme for assessors and accepts feedback about them through its assessor and vendor feedback forms.