A company trained and qualified by the PCI Security Standards Council to install and maintain payment systems for merchants. QIR training targets the configuration mistakes that most often cause card data breaches at smaller merchants: vendor default credentials left in place, insecure remote access, unnecessary services left enabled, and payment applications deployed outside their validated configuration. Qualification is held at company level through named trained employees and is maintained under the rules of the Council's QIR programme. The programme exists for merchants who depend on an integrator or reseller rather than running a security function of their own, and some acquirers require a QIR for payment system installations.
Applies to. Merchants that rely on an outside integrator or reseller to install, configure or maintain their point-of-sale or payment application, and the integrators and resellers that want to be listed by the Council. QIR is a Council listing programme, in the same family as the QSA and ASV lists, not a PCI DSS requirement: no v4.0.1 requirement obliges a merchant to use one. The work a QIR does lands on requirements the merchant must still evidence, such as configuration standards applied before a component goes live (2.2.1), security parameters set to prevent misuse (2.2.6) and encrypted non-console administrative access with insecure remote login services removed (2.2.7).
Example. A restaurant group has a reseller roll out a new point-of-sale system across its sites. Choosing a company on the Council's QIR list, or asking whether the installer's staff hold QIR status, is a way to reduce the chance of vendor defaults, open remote support access or an untested configuration being left behind. At assessment the group, not the reseller, has to show 2.2.1 and 2.2.7 are met on each terminal and back-office server.
Limits. A QIR is not a QSA, which assesses compliance, nor an ASV, which runs external scans, nor a PCI Forensic Investigator. Using a QIR does not make a merchant compliant and does not transfer the merchant's obligations to the installer. It does not validate the payment software either; software listings come from the Software Security Framework and the older PA-DSS programme. Where an acquirer requires a QIR for installations, that comes from acquirer or brand rules, not from the standard.