Choosing a QSA: what to ask before you sign the assessment contract

What you are choosing when you choose a QSA

A Qualified Security Assessor is two things at once. There is the QSA company, an organisation the PCI Security Standards Council has qualified to perform PCI DSS assessments, and there are its QSA employees, the individuals who carry out and manage the fieldwork. An individual can hold QSA status only while employed full time by a qualified QSA company, and each one must requalify every twelve months. When you engage an assessor, you are contracting with the company and relying on the competence of the people it sends.

The QSA assesses your cardholder data environment against PCI DSS v4.0.1 and records the result in a Report on Compliance (ROC) and an Attestation of Compliance (AOC). Whether you need a ROC at all is covered in PCI DSS validation step by step: ROC, SAQ and AOC. Sterling sits on the other side of the table: we help you scope, remediate and prepare; the QSA assesses and signs. Sterling does not validate.

Check the Council's listings, not the brochure

The PCI Security Standards Council publishes a searchable list of QSA companies, filterable by place of business, region and language. The Council advises clients to check it every time they engage a QSA, because status can change. Three checks settle most doubts.

The company is listed, and in good standing

Search for the exact legal name on the proposal, not a trading name or parent group. An "In Remediation" flag means the company fell short of the Council's qualification requirements and is restoring its standing; ask what happened and how it affects you.

The company is authorised where you operate

QSA companies may assess only in the regions or countries for which they are qualified. A contact centre in Manila, a data centre in Frankfurt and a head office in Dubai need a company authorised for all three; get that confirmed in writing and compare it with the listing.

The people are qualified

The Council also offers a lookup for individual professionals. Ask who will lead and perform your assessment and confirm each is current.

Approved Scanning Vendors are on a separate Council list. The ASV runs your quarterly external scans; a QSA listing does not make a company an ASV. Check each listing for the service it will actually provide.

Independence: the assessor must not mark its own work

The Council's qualification requirements oblige a QSA company to act with objectivity and prevent it from assessing any entity it controls or is controlled by. The Council's published guidance goes further at the level of the individual: a QSA employee who recommends, designs, develops, provides or implements a control for a client may not assess that control or the related requirements. A different QSA employee from the same company, with no involvement in the work, may assess it, provided the separation of duties is documented.

So ask: has the QSA company designed or operated any control in scope, and if so, who assesses it and how is the separation recorded? Does it sell security products you use? Such relationships should be disclosed in the ROC, and you should know before you sign. The cleanest arrangement keeps roles apart from the start: Sterling, as consultant, helps build and evidence the controls, and an independent QSA of your choice tests that evidence itself.

Sector and technology experience

Qualification shows the company meets the Council's baseline, not that its assessors know an environment like yours. A payment facilitator on microservices, a hotel group with terminals in every property and a contact centre taking card numbers by telephone raise very different questions about scope and evidence.

Ask for anonymised examples in your sector and on your technology: your cloud platforms, containers, telephony and call recording, point-to-point encryption, tokenisation, payment page scripts. Ask how they treat shared responsibility with hosting providers and third-party AOCs. An assessor who understands your architecture samples sensibly; one who does not tests the wrong things at length.

What a QSA proposal should state

A proposal is the first evidence of how the assessment will run. It should state:

• Scope: the payment channels, the cardholder data environment and connected systems as understood, with the assumptions.
• Locations: every site, data centre and cloud environment, and which will be visited.
• Sampling: how components, locations and processes will be sampled and justified.
• On site and remote: which activities happen where, and when.
• Segmentation testing: whether your tester's results are reviewed or further testing is expected, and by whom.
• Deliverables: the ROC, the AOC and any draft review.
• Timing: fieldwork, time to address findings, and the final ROC date against your deadline.

The table compares three illustrative proposals, not real companies, with price deliberately left out.

Questions to ask before you sign

• Which QSA employees will perform and review the assessment, and are they listed as current?
• Does your authorisation cover every country where our assessed locations are?
• Have you, or any related company, designed, provided or operated any control in our scope?
• How will you sample our sites, systems and processes, and how will you justify it?
• How do you handle findings raised during fieldwork, and how long do we have to address them before the ROC is finalised?
• How do you treat compensating controls and the customised approach? (See PCI DSS compensating controls and the customised approach.)

An assessor who explains the method plainly and declines to predict the outcome is usually the one you want.

Warning signs in a QSA offer

• A compliant result promised before scoping. No genuine assessor can predict the outcome of an assessment it has not yet planned.
• A "PCI certificate". PCI DSS has no certificate. The documents that count are the ROC or SAQ and the AOC.
• No sampling, or no explanation of it. Either every component is tested, which is rare, or the sample is chosen and justified. Silence means neither.
• An unlisted company or unlisted people. If the company or its assessors do not appear on the Council's listings, the work will not stand.
• An offer to fix and assess. The same people designing your controls and then assessing them is the conflict the Council's rules forbid.

What happens during fieldwork is explained in The PCI DSS assessment: what a QSA tests, and how.

Choosing a QSA: questions buyers ask