What is a PCI QSA?

If a business handles credit or debit card transactions online, they are required to audit the systems and processes by which they secure cardholder data annually. While some smaller businesses may be able to perform this audit themselves, larger companies are required to use a Qualified Security Assessor (QSA) to ensure they are compliant with the Payment Card Industry Data Security Standard (PCI DSS). 

The PCI DSS was created in response to the data security concerns facing debit and credit card transactions by the PCI Security Standards Council, made up of Visa, MasterCard, American Express, Discover, and JCB. To remain in compliance with this standard, Level 1 merchants (merchants with over 6 million transactions annually) will need the help of a QSA to complete an official Report on Compliance (ROC). This ROC will verify a merchant’s PCI compliance and, after completion, will be sent to the merchant’s bank, which will send it to the appropriate credit card companies. 

What does a PCI QSA do? 

 A QSA is an individual employed by a QSA company (QSAC) and certified by the PCI Security Standards Council as a PCI compliance assessor.  As noncompliance can result in fines, having a QSA assess potential security threats will lower the risk of fines or an even more costly security breach.  

The QSA security assessment will begin with a risk assessment for all hardware and software, which should be solved before the assessment. For the assessment itself, the QSA will look at the Cardholder Data Environment (CDE), which includes all infrastructure that encounters or stores cardholder data, as well as the IT policies and procedures to ensure that all data is, and will remain, secure.  

Who needs a PCI QSA?  

Any company that accepts credit or debit card payments needs to either complete an annual Self-Assessment Questionnaire (SAQ) or be assessed by a QSA to remain compliant with the PCI DSS.  

Only Level 1 merchants, or those that have suffered a significant hack that compromised important data, are required to use a QSA. However, some level 2, 3, or 4 merchants (merchants with less than 6 million transactions annually) may opt to enlist the guidance of a QSA to ensure PCI DSS compliance.  

When choosing between filling out an SAQ yourself or utilizing a QSA to fill out a ROC, it’s important to understand what a PCI QSA brings to the table. A QSA can bring credibility to your report, create a plan to maintain compliance, strategize ways to improve security and provide specific guidance and advice tailored to the challenges your business may face. For this reason, even those who are not required to use a QSA may enlist one to help recognize potential threats to the security of their business. 

QSA Certification Process 

What makes a QSA qualified to assess a company’s security needs and fill out a Report on Compliance (ROC)? A QSA will work at a QSAC certified by the PCI Security Standards Council, be familiar with PCI DSS procedures, have at least one year of experience in IT or IT security, and possess relevant industry certificates. The QSA training process includes an online course that gives an overview of PCI DSS requirements, followed by a comprehensive instructor-led course and an exam. The training covers brand-specific requirements, testing procedures, validation, and reporting requirements. To ensure continued compliance, QSAs must also update their certification annually online. The required training, and background, ensure that any company offering QSA services must employ individuals who have a comprehensive understanding of PCI DSS compliance and the potential threats businesses may face. 

How to find a QSA for PCI compliance 

When looking for a QSA to ensure your company’s compliance with PCI DSS, it’s important to find a QSA who works at a QSAC qualified by the PCI Security Standards Council. You should also ask about past clients and whether the QSA helped them maintain compliance. You should also ask about ways a QSA has helped a business improve its security. You want to find a QSA that will not only focus on bringing your company into compliance but also implement a plan to continue PCI requirements and improve current security practices. 

While PCI DSS compliance is necessary to avoid fines from the PCI Security Standards Council, a good QSA will not only bring attention to things out of compliance but also find areas for improvement. Certified companies like 3Factor not only employ QSAs for PCI DSS compliance but also provide guidance on ways to further secure your data. An excellent QSA will not only look at your company’s PCI DSS compliance but also the overall security needs of your company, analyzing potential weaknesses and identifying areas of improvement. 

Not being compliant with PCI DSS can be costly, but the cost of a security breach leading to the loss of customer data and customer trust is incalculable.  If you’re getting ready for an audit on PCI DSS compliance, consider contacting our team at TokenEx to see how you can minimize your scope by keeping your customer data secure through tokenization. By securing and storing customer data for you, we reduce the number of people and systems that encounter your customers’ data, which both simplifies PCI audits and keeps sensitive data secure.