Internal Security Assessor (ISA)
PCIComplianceHubLast updated
An employee who has completed PCI Security Standards Council training and certification, qualifying them to perform PCI DSS assessments for their own organization. An ISA can complete internal assessments and Self-Assessment Questionnaires, and some payment brands accept ISA involvement where a Qualified Security Assessor would otherwise be required. An ISA cannot assess other organizations; that requires a QSA.
Applies to. No PCI DSS v4.0.1 requirement names the ISA; the role belongs to the Council's ISA Program, which trains and qualifies employees of a sponsoring organisation to assess that organisation's own environment, with annual requalification and a qualification that stays with the sponsoring employer. An ISA can lead the internal assessment, complete the SAQ and keep compliance work running between assessments; whether an ISA may sign a Report on Compliance in place of a QSA is set by the payment brand and acquirer, not by the standard. As with any assessor, an ISA should not be the person who operates the controls being assessed.