PCI DSS guide
PCI DSS assessor questions: what QSAs ask, and the evidence that answers them
The questions a Qualified Security Assessor typically puts to your people across the twelve requirements, who is asked each one, the evidence that answers it, and how to prepare your team without scripting a single answer.
Key points
- A Qualified Security Assessor does not simply read your policies. For each requirement it examines documents and system settings, interviews the people who run the control and watches the control work, then records what it saw in the ROC.
- Most questions are the same few ideas asked twelve ways: show me where card data goes, show me the rule, show me it ran, and show me what happened when it failed.
- The answer to almost every question is a record with a date on it. If the record does not exist, no rehearsed explanation will replace it.
- Prepare people by walking them through their own evidence, not by handing them lines to learn. Assessors notice scripted answers quickly and then dig deeper.
How a QSA asks: examine, interview, observe, sample
Each PCI DSS v4.0.1 requirement carries testing procedures that tell the assessor how to test it: review documents, inspect configurations and system output, interview the responsible people and observe the process running. Fieldwork questions are those procedures spoken aloud. When the assessor asks your engineer to open the firewall console on screen, it is because the setting must be seen, not described.
Assessors also sample. They choose system components, people, sites and dates, and the ROC records how the sample was chosen. Expect a request for one particular week of review records, three recent leavers or the build record of one server, at short notice. Evidence that is complete only for the systems you would have picked is found out this way.
The detail of how fieldwork is run, day by day, belongs to our guide to the PCI DSS assessment and what a QSA tests. This page stays with the questions themselves and the evidence that answers them.
Questions on requirements 1 to 6: network, configuration, data, malware and software
| Question the assessor asks | Who is asked | Evidence that answers it |
|---|---|---|
| 1. Walk me through this diagram: where does card data enter, and which controls sit between it and the internet? | Network lead | Current network and data-flow diagrams that match the live environment |
| 1. Why is this inbound rule open, and who last reviewed it? | Firewall administrator | Ruleset with a business justification per rule; the latest periodic rule review with its decisions |
| 2. Show me the hardening standard for this platform, and prove this server was built to it. | System administrator | Configuration standard; build checklist or configuration output for the sampled server |
| 3. What account data do you keep, where, and for how long? | Data owner, IT lead | Retention policy; data discovery results; evidence of the last purge |
| 3. Is any sensitive authentication data kept after authorisation, even in logs or tickets? | Application owner | Discovery scan output across databases, logs and support tools |
| 3. Show me a stored card number. How is it made unreadable, and who holds the keys? | Database administrator, key custodians | Masked or tokenised records on screen; key management procedure; custodian acknowledgements |
| 4. What does an agent do if a customer e-mails a card number? | Front-line staff, team leader | Written rule, training record and a handled example |
| 5. Which systems have no anti-malware, and why is that acceptable? | Security operations | Coverage list with justified exceptions and the periodic evaluation behind them |
| 6. How do you learn about new vulnerabilities, and how fast are critical ones patched? | Patch manager | Vulnerability sources; risk ranking; patch reports against the defined timeframes |
| 6. Show me the last change to a CDE system from request to release. | Change manager, developer | Change record with impact assessment, approval, testing and back-out plan |
| 6. Which scripts run on your payment page, and how would you know if one changed? | Web developer | Script inventory with authorisation and integrity or tamper checks |
Questions on requirements 7 to 12: access, physical security, logging, testing and the programme
| Question the assessor asks | Who is asked | Evidence that answers it |
|---|---|---|
| 7. Why does this person have access to the CDE, and who approved it? | Access administrator, line manager | Role-based access model; approved request for the sampled user |
| 7. Show me your last user access review and what was removed as a result. | System owner | Six-monthly review record with decisions and completed removals |
| 8. Log in to the CDE for me from a remote session. | Administrator | MFA observed working; MFA configuration settings |
| 8. When did this leaver's accounts stop working? | HR, access administrator | Leaver record matched to account disablement dates |
| 9. Who can enter this room, and who came in last Tuesday? | Facilities | Badge access list; visitor log; the sampled day's entries |
| 9. How would you spot a tampered payment terminal? | Store or counter staff | Device inventory; inspection records; front-line training |
| 10. Show me yesterday's log review. What did the tooling flag, and who looked at it? | Security analyst | Automated review output and the analyst's follow-up records |
| 10. What happens when logging on a critical system stops? | Security operations | Alert for control failure and the record of how it was handled |
| 11. Show me four quarters of passing external scans, and any rescans. | Security lead | ASV scan reports, including rescans after fixes |
| 11. What did the last penetration test find, and how do you know it is fixed? | Security lead | Test report; remediation evidence; retest results |
| 12. When was the security policy last reviewed, and what changed? | Policy owner | Policy set with a dated annual review |
| 12. Which third parties can affect card data, and what do you hold from each? | Vendor manager | Provider register; each provider's AOC; responsibility matrix |
| 12. When did you last exercise the incident response plan, and what did you learn? | Incident lead | Exercise record; lessons and plan updates |
The number at the start of each question is the principal requirement it belongs to. Assessors also ask, early and often, when the scope was last confirmed and who signed that confirmation; our guide to PCI DSS scoping and segmentation explains what that confirmation must cover.
Preparing people without scripting them
The people interviewed are rarely the policy authors. They are the administrator who reviews access, the analyst who reads alerts, the supervisor on the contact centre floor. Their plain account of what they do is strong evidence, and it is lost once they recite lines.
What works
- Walk each person through their own records. An analyst who has looked at last month's review tickets beforehand can answer the sampled week without hesitation.
- Explain the method, not the answers. Tell people the assessor will ask them to show rather than tell, may choose any date, and is entitled to follow up.
- Make "I will check" acceptable. A person who says they do not know and then fetches the record comes across far better than one who guesses.
- Run a mock interview. An internal assessment with the same questions shows which answers depend on one individual and which records are hard to retrieve. Our guide to PCI DSS internal audit and the ISA covers that exercise.
How Sterling prepares teams for the QSA
Every requirement tested the way the assessor will test it, before the assessor arrives.
In Sterling's internal assessment, expert and experienced consultants put these questions to the people who own each control, ask for the sampled evidence and close what is missing while there is still time. You choose Design™, where your team does the work with Sterling's structure and coaching, or Drive™, where Sterling takes on the agreed remediation with your system owners. Evidence sits in Effivity from the first workshop, so a request for a specific week takes minutes to answer. We ensure successful validation for our clients. The ROC and AOC are the QSA's to issue; Sterling does not validate.
Book a free discovery callWhat not to do in front of an assessor
- Producing evidence overnight. Records with identical timestamps, or a policy dated fieldwork week, suggest the control never ran.
- Answering for someone else. A manager speaking over the administrator suggests the process depends on the manager.
- Offering only the systems you prefer. The assessor picks the sample. Steering it signals that other systems would not stand up.
- Arguing a requirement away. Where a control genuinely differs from the standard's wording, the route is a documented compensating control or the customised approach, prepared in advance. Our guide to compensating controls and the customised approach sets out how.
The patterns that most often end in a failed assessment are collected in our guide to PCI DSS common mistakes.
PCI DSS assessor questions: questions buyers ask
Will the QSA send us the questions in advance?
Most assessors send an evidence request list before fieldwork, organised by requirement, and some share an interview schedule. The follow-up questions depend on what they find, so treat the list as a starting point rather than the whole assessment.
Can our consultant answer questions during the assessment?
A consultant can help you locate evidence and may attend if the assessor agrees, but interviews are with the people who operate the controls. An environment that only an outside adviser can explain raises doubts about whether it runs without them.
How many people will the assessor want to interview?
It depends on the scope and the sample. Expect the owners of each requirement area, a sample of administrators and, where card data is handled by staff, a sample of front-line people at the sites in scope.
What if we cannot produce a record the assessor asks for?
Say so plainly. The assessor will consider whether the control operated by other evidence; if it did not, the requirement is recorded as not in place and has to be remediated before the ROC can show it as in place.
Are the questions different for a self-assessment questionnaire?
An SAQ covers a subset of the requirements, chosen by your payment channel, and is completed by you rather than a QSA. The questions are narrower but the evidence behind each answer should be just as real, because your executive signs the AOC.
Do assessors look at anything outside the twelve requirements?
They confirm the scope itself: the data flows, the connected systems and the third parties. A scope that turns out to be larger than you stated changes every answer that follows.
More PCI DSS guides
Every guide in the PCI DSS series is written for one question and links back to the hub for the whole picture.
- The PCI DSS annual cycle
- PCI DSS in Australia
- PCI DSS for banks and financial services
- PCI DSS for call centres and BPOs
- PCI DSS compliance cost: what moves the price
- PCI DSS vs ISO/IEC 27001 and SOC 2
- PCI DSS requirements explained, requirement by requirement
- PCI DSS scoping and segmentation: shrinking the CDE
- PCI DSS v4.0.1: what changed and what your next assessment tests
- PCI DSS validation step by step: ROC, SAQ and AOC
- How to verify a PCI DSS AOC and check a provider's compliance
- Which SAQ applies to you: eligibility explained
Keep exploring
Explore more about PCI DSS
Watch a video on how to implement PCI DSS here.
Watch a video on PCI DSS requirements here.
PCI DSS resources
Services for PCI DSS
Talk to a consultant
Put your team through the QSA's questions before the assessment does.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice