A Qualified Security Assessor (QSA) is part of a PCI Security Standards Council (PCI SSC) program for assessing an organization’s adherence to the Payment Card Industry Data Security Standard (PCI DSS). The term can refer loosely to a qualified company or an individual assessor, but PCI SSC qualifies the company and its employees separately. A company’s QSA status alone does not mean every employee is qualified to perform QSA assessment work.
What does QSA mean in PCI compliance?
A QSA Company is an independent security organization qualified by PCI SSC to validate an entity’s adherence to PCI DSS. A QSA Employee is an individual employed by that company who meets the applicable qualification requirements. PCI SSC also has an Associate QSA Employee (AQSA) category; an AQSA may assist with assessment work subject to program rules.
PCI SSC’s QSA information and listing describes the company program. Its QSA Qualification Requirements v4.0, dated March 2021, describe the two-part process: the security company applies and submits an unmodified QSA Agreement, while each employee candidate seeking QSA Employee qualification submits a separate application.
Does QSA status belong to a person or a company?
It can involve both, but the qualifications are distinct. PCI SSC qualifies the security organization as a QSA Company and separately qualifies eligible individual employees. A job title, consultancy description, or general security credential does not by itself establish that a person is a PCI SSC-qualified QSA Employee.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
PCI SSC publishes QSA Companies on its QSA Company list and provides an assessor search tool for individual assessors. Check both the company and the people assigned to the work rather than assuming one listing covers everyone on a project.
What does a QSA’s qualification cover?
PCI SSC standards versions
Under the PCI SSC QSA Program Guide, Version 3.0, dated March 2021, assessors are qualified to work only on the version or versions of PCI SSC standards for which they have successfully completed training. Confirm that the assigned assessor’s training matches the standard version relevant to your assessment.
Rank #2
Authorized servicing markets
A QSA Company’s “Servicing Markets” identify the countries or regions where PCI SSC has authorized it to perform assessments and related QSA duties. Its “Place of Business” indicates physical presence; that location does not expand its authorization. PCI SSC’s FAQ on Servicing Markets and Place of Business states that a company must not perform assessments or act as a QSA Company outside its qualified markets.
What requirements apply to QSA Companies and employees?
The QSA Qualification Requirements v4.0 cover company legitimacy, independence, insurance, technical security-assessment capability and experience, administrative controls, quality assurance, protection of confidential and sensitive information, ongoing qualification, and assessor quality management. These requirements are a baseline; companies and assessors also need to follow current program documents and their applicable agreement.
The Program Guide says a QSA organization must remain qualified and in good standing. It also sets a specific threshold for the Associate QSA Program: a company must have been active as a QSA Company for at least two years before it is eligible to apply. This is an eligibility rule stated in the March 2021 guide, not a general qualification period for every QSA Company.
Can a QSA assess controls they helped implement?
Not when the same assessor would be assessing the control or an affected requirement. PCI SSC’s conflict-of-interest FAQ says that an employee who recommends, designs, develops, provides, or implements controls for an entity has a conflict if that same employee assesses those controls or requirements impacted by them.
Rank #4
A different assessor who was not involved may conduct the assessment if the company maintains adequate, documented, and defensible separation of duties. QSA Company policies also need to address independence and conflicts of interest.
How is QSA qualification maintained?
PCI SSC materials describe annual requalification for QSA Companies and individual Assessor-Employees. Company requalification is regional and tied to the company’s original qualification date. Individual requirements depend on the employee category and can include training, fees, continued compliance, and credential or continuing professional education evidence, as applicable.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fees and detailed requirements can change. For a current application or renewal, check PCI SSC’s current program documents, fee schedule, and assessor listings rather than relying solely on the March 2021 requirements and guide.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should you verify and choose a QSA?
- Confirm the company’s status. Search the current PCI SSC QSA Company list and check its good-standing status.
- Check the assigned assessor. Use PCI SSC’s assessor search tool to confirm the individual’s category and listing.
- Match scope to the work. Confirm the assessor’s training covers the relevant PCI SSC standards version and that the company is authorized for the entity’s servicing market.
- Discuss independence. Identify any work the assessor or company has performed designing, providing, or implementing relevant controls, and agree on documented separation of duties where needed.
- Evaluate practical fit. Ask about experience with the entity’s business and technical environment, as well as the company’s quality-assurance and reporting process.
PCI SSC listing status, permitted scope, and detailed program requirements can change; verify them directly in the current PCI SSC publications and listings before engaging a company.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
