How do you choose a QSA for your PCI DSS assessment?
When a customer, acquirer or contract requires a PCI DSS validation, you have to pick who assesses it, and only a Qualified Security Assessor (QSA) company can issue a Report on Compliance (ROC). Before you engage anyone, check that the company holds a current listing on the PCI SSC list of QSA companies, because the Council advises clients to check it each time they engage a QSA. Then compare shortlisted firms on independence, relevant experience with your payment environment and fit with your timeline. Confirm the listing status directly on the PCI SSC QSA list, and treat a company listed as In Remediation as a serious question to put to it in writing, since that status means it has violated program validation requirements.
Keep the roles separate in your own planning. Your organization owns its controls and the decisions about scope and validation path. A consultant or implementation partner can prepare systems, configurations and evidence, but it cannot stand in for the assessor. Only the QSA issues the ROC and the Attestation of Compliance, and it keeps ultimate responsibility for the workpapers even when colleagues at the same firm collect evidence. Ask each candidate how it separates consulting from assessment internally, and confirm that the people who designed or implemented a control will not be the ones who assess it. A firm that cannot answer that question clearly has a problem you should resolve before signing.
Price and timing depend on your scope and validation path, which you set with the QSA in writing before work starts. Ask each firm for a quote tied to a defined scope, the assessment deliverables, the named QSA employees and the expected schedule, and ask what it will and will not rely on from other reports. A QSA cannot rely on a SOC 2 report for a PCI DSS assessment, though it may reuse evidence from one after independent review. Also ask whether the firm will need onsite work for a validated third-party service provider, since the Council does not require onsite retesting of requirements already covered by that provider's current assessment. Finally, record your engagement terms in writing and confirm the QSA's current listing again before the contract is signed.
How to verify a QSA company and its employees on the PCI SSC list
This sequence confirms that the firm and the individual assessor are both currently recognized by the PCI SSC before any engagement, and leaves a dated record of the listing status in your vendor file.
Understand the company and employee distinction
A QSA company is an independent security organization qualified by the PCI SSC to validate an entity's adherence to PCI DSS. A QSA employee is an individual at one of those companies who meets and continues to meet all QSA requirements. Procurement and security leads own this step: before searching, confirm that the firm you are evaluating is the company and that the people proposed are employees of that same company. Done when the team can state both definitions in its own words and knows the two checks are separate.
Search the PCI SSC QSA list for the company
Open the official QSA list on the PCI SSC website and search for the firm by its legal or trading name. Compare the listed name, address and contact details with the proposal and the signed contract, since similar names can belong to different companies. The PCI SSC advises checking the list each time you engage a QSA, so run this search at selection and again before signing any renewal or new work order. Done when you have confirmed a listed company that matches the contracting entity.
Filter by place of business, region and language
Use the list's filters for place of business, region and language to confirm that the company is listed for the locations and languages your assessment needs. This matters when the assessed environment spans several countries or when your team needs reports in a particular language. Ask the firm to name the office that will perform the work, then match that office against the filtered result. Done when the assessing office appears in the filtered listing and the choice is recorded.
Check the listing status of the company
Read the status shown against the company. A QSA listed as In Remediation has violated program validation requirements and may be working to restore compliance. Ask the firm in writing whether it is in remediation, what it did to correct the issue, and whether the issue affects the team you propose. Do not proceed with a company in that status until you have reviewed the written answer and decided whether the risk is acceptable. Done when the status is recorded as listed, in remediation, or not found, with the reviewer's decision noted.
Confirm each assessor is a QSA employee
Ask for the full names of the individuals who will perform the assessment, then confirm each one appears as a QSA employee of the same company. Individual status is separate from company status, so a listed firm does not automatically make every staff member a QSA. Ask the firm to explain any individual who is not on the list, such as a support analyst, and confirm that person will not sign off on conclusions. Done when every assessor is matched to a QSA employee record at the verified company.
Separate consulting staff from assessing staff
Ask the firm to name which people designed or implemented controls for your organization and which people will assess them. A QSA employee who designs or implements controls for a client may not assess those controls, so consulting and assessment must be separated within the firm. Record the names and roles on both sides in writing. Done when the proposal shows a clear split, or the firm confirms in writing that the same people are not on both sides.
Record the date and status in the vendor file
Save a dated record of the company search, the filters used, the listing status, each assessor's QSA employee match and the independence confirmation. Include a screenshot or printed copy of the listing and the date you checked it. Set a reminder to repeat the check before each future engagement, because the listing status can change. Owned by the vendor risk or compliance lead. Done when the vendor file contains a dated entry that a reviewer or assessor can later reproduce.
What an In Remediation listing means for your engagement
A QSA company's listing status is a direct signal about whether it can sign off your assessment. The cards below set out what an In Remediation listing indicates and the decisions it should trigger before you commit to a firm.
What the listing signals
A QSA listed as In Remediation has violated the PCI SSC's program validation requirements and may be working to restore compliance. The listing does not say whether the firm will recover, how long that will take, or which violation caused it. Treat it as a reason to stop and investigate, not as a finding about your own assessment.
Pause before signing
Hold any engagement letter, statement of work or assessment kickoff until the status is clear. A signed contract with a firm that cannot validate your work may leave you paying for an assessment the payment brands will not accept. Tell the firm in writing that signing is on hold pending the status check.
Confirm status on the PCI SSC list
Check the status directly on the PCI SSC QSA list rather than relying on the firm's website, sales material or a salesperson's assurance. The PCI SSC advises checking the list each time you engage a QSA, and the list can be filtered by place of business, region and language. Record the date and time you checked and keep a copy for your file.
Request a written remediation plan
Ask the firm for a written remediation plan that states the violation as far as it may be disclosed, the corrective steps, the owner of each step and the expected date when the listing will be restored. Ask who at the firm will be accountable for your engagement during remediation and whether any of your assessment staff are affected.
Escalate to your acquirer or brand
Your acquirer or payment brand decides which validation you must complete and which assessors it accepts, so ask it directly whether a firm in remediation is acceptable for your validation. The PCI SSC does not manage that decision. Record the answer in writing before you proceed with the firm or choose a replacement.
Reassess the QSA relationship
If the remediation plan is unclear, late or incomplete, consider moving the assessment to a QSA company whose listing is active. Check the independence of any consultant you have already used at the firm, because a QSA employee who designed controls for you may not assess them. Document the decision and your reasons for changing or keeping the firm.
Why consulting and assessment must be separated inside a QSA company
A QSA employee who designs or implements a client's controls may not assess those same controls. The PCI SSC expects the QSA company to keep its consulting work and its assessment work apart, so the people who build or configure a control are not the people who judge it. For you, this means the independence question is not answered by the firm's name or its listing. It is answered by who is on the proposed assessment team and what each of those people did for your environment in the past. A firm that sells remediation help and then assesses the same systems has to show a clear internal wall between the two teams.
Before you sign, ask the firm to name the assessment team and to state, for each member, whether they designed, configured, installed or operated any control in your cardholder data environment or the systems connected to it. Ask how the firm records that separation, such as a written independence statement, a conflict check against the engagement scope, and a log of which staff worked on remediation. Ask who signs off on the assessment if a consultant on the same account raises a concern. Confirm these answers in writing so they can be checked when the Report on Compliance is reviewed.
Where DeployOpen is involved, its role is to prepare systems, documentation and evidence for your assessment. It does not issue reports, attestations or certificates, and it cannot stand in for the QSA. The assessing QSA must therefore be independent of any preparation work DeployOpen performs for you, and that work should be scoped and recorded so the QSA can see exactly what was configured and when. Ask your QSA how it wants preparation evidence delivered and which preparation tasks it will accept without reperforming. Confirm the split of responsibilities before any work starts, because the assessor's independence depends on it.
What a QSA may and may not rely on from other audits
A SOC 2 or SOC 3 report describes an examination of controls against the AICPA Trust Services Criteria, and it is not a PCI DSS validation. The PCI SSC's position is that a QSA cannot rely on either report as the basis for a PCI DSS assessment. That restriction does not make the report useless. A QSA may reuse evidence drawn from the underlying testing, but only after performing its own independent review of that evidence against the PCI DSS requirement it supports.
- No substitution: The report itself cannot be cited as proof that a PCI DSS requirement is met.
- Evidence reuse: Specific samples, logs or configuration exports may be reused if the QSA reviews them and confirms they cover the PCI DSS requirement and the assessed period.
- Mapping gaps: SOC 2 criteria and PCI DSS requirements do not align one for one, so some PCI DSS requirements will have no usable SOC 2 evidence.
- Period and scope: Confirm that the SOC 2 examination period and system boundary match the cardholder data environment in your PCI DSS scope.
- Written reliance plan: Ask the QSA to list which SOC 2 artifacts it intends to reuse, the requirements each supports and the independent review it will perform.
Before engaging a QSA, confirm in writing how it will treat any SOC 2 or SOC 3 report you hold.
A QSA company may employ other auditors, including SOC 2 auditors, who collect evidence for their own engagements. The PCI SSC's position is that evidence gathered by another auditor at the same firm may inform a PCI DSS assessment, but the QSA conducting the assessment keeps ultimate responsibility for the Report on Compliance and its workpapers. The QSA cannot hand that responsibility to the colleague who collected the material.
- Single point of accountability: The assessing QSA signs off on every conclusion, regardless of who gathered the evidence.
- Workpaper ownership: The QSA must hold the workpapers that support each finding, including those drawn from a colleague's files.
- Review before use: Material from another engagement should be reviewed by the assessing QSA before it supports a PCI DSS conclusion.
- Independence still applies: A colleague who designed or implemented controls for you cannot assess those controls, even inside the same firm.
- Traceability: Ask how the QSA records the origin, date and reviewer of each piece of borrowed evidence.
Ask the QSA who will collect each evidence set, who will review it and where the resulting workpapers will be held.
When your payment environment depends on a service provider that has its own current PCI DSS validation, the PCI SSC does not require your QSA to go onsite to that provider and retest the requirements already covered by the provider's current assessment. The QSA may rely on the provider's validated status for those requirements, but it still needs to confirm the provider's validation is current and that the responsibility split between the two parties is clear. Requirements that fall to your organization remain your assessor's responsibility to test.
- Current status: Obtain the provider's current Attestation of Compliance and confirm its validity period covers your assessment.
- Covered scope: Check that the services the provider validated match the services you use, including any optional features.
- Responsibility matrix: Use a written matrix to separate requirements the provider covers from those you must meet yourself.
- Gaps at the boundary: Integration points, configuration you control and access you grant remain yours to evidence.
- Changes: A change in the provider's services or validation status may remove the reliance you planned.
Request the provider's current Attestation of Compliance and ask your QSA to confirm in writing which requirements it accepts from that document.
Which QSA model fits your organization
This table compares three common QSA firm models: a large firm with several assessment teams, a boutique firm, and a firm that also offers consulting under separated teams. Read each row against your scope, payment environment and continuity needs, then confirm the specifics with each firm's written proposal and its current status on the PCI SSC list.
| Factor | Large QSA company with several assessment teams | Boutique QSA firm | QSA firm with consulting under separated teams |
|---|---|---|---|
| When it fits | Multi-region scope, many locations or entities, or a need for assessors in several languages | Smaller or single-region scope, a specialized payment environment, or a single experienced assessor who knows your systems | You want consulting help on gaps and an assessment from the same firm, with the two work streams kept apart |
| Capacity | Usually the most capacity to staff peak assessment periods; confirm team availability for your dates | Limited headcount; a single absence or conflict can delay the engagement | Capacity depends on how many assessors are not on the consulting side; ask how many are available |
| Continuity of assessor | Assessor rotation is more likely; ask who leads and who would replace them | Often the same named assessor across years, which helps year-to-year continuity | Continuity can be good, but confirm that the assessor who advised you is not the one who assesses you |
| Independence risk | Lower risk when consulting and assessment teams are clearly separated within the firm | Fewer conflicts if the firm does not sell consulting, but check for other advisory work | Highest scrutiny: the firm must separate staff who design or implement controls from those who assess them |
| Questions to ask | Which team leads the assessment, and how are workpapers and sign-off handled across regions? | How do you cover absences, and what is your process for reviews and quality checks? | Which individuals worked on our controls, and how are consulting and assessment staff separated? |
Who owns the controls, who prepares evidence and who signs the ROC
The organization owns its PCI DSS controls, and only the organization can make the decisions about scope and validation path. It decides which systems sit inside the cardholder data environment, whether a Report on Compliance or a Self-Assessment Questionnaire applies, and which requirements it addresses through the defined approach, the customized approach or a compensating control. An implementation partner such as DeployOpen can prepare systems, configurations, network diagrams and evidence on the organization's behalf, and it can fix gaps found before the assessment. Preparation is not validation. The partner does not decide whether a requirement is met, and it should not sign off on its own work.
The QSA company performs the assessment, issues the ROC and the Attestation of Compliance, and keeps ultimate responsibility for the report and its workpapers, even when other auditors at the same firm collect evidence. Before engaging anyone, confirm the QSA company's listing on the PCI SSC list and check that it is not In Remediation. Ask the QSA to name the individuals who will test each requirement, and confirm that none of them designed or implemented the controls they will assess. Ask in writing which party is responsible for each piece of evidence.
Submission is a separate question. QSAs and ASVs do not send ROCs or scan results to the PCI SSC. They follow the procedures of each payment brand, which runs its own compliance program. Before the assessment starts, ask your acquirer or payment brand in writing what it must receive, in what format, by what date and through which channel, and who on your side is named as the contact for that submission.
Questions to ask a QSA before you sign
A QSA's listing, staffing, independence and evidence rules determine whether your ROC will be accepted and whether you can rely on it later. These cards turn those rules into questions you can put to any firm before you sign a statement of work.
Confirm current listing and remediation status
Check that the firm and the specific individuals are on the PCI SSC QSA list today, not only when the proposal was written. The list can be filtered by place of business, region and language, and the PCI SSC advises checking it each time you engage a QSA. A firm listed as In Remediation has violated program validation requirements, so ask what it is doing to restore compliance and how that affects your engagement.
Name the QSA employees on your engagement
Ask for the names of the QSA employees who will lead and sign the assessment, and confirm each one is a current QSA employee. Ask how many years they have assessed environments similar to yours, such as card-present retail, e-commerce with redirects, or a multi-tenant hosting platform. Request references from comparable engagements, and confirm that the people who attend your onsite work are the people in the proposal.
Separate consulting from assessment
A QSA employee who designs or implements controls for you may not assess those same controls. Ask which team will help you build controls and which team will test them, and confirm that the assessing staff have not done the design work for your environment. If the firm offers both, ask how it documents the separation in the contract and workpapers. This matters most when you need help closing gaps before assessment.
Ask how SOC 2 and third-party evidence is used
A QSA cannot rely on SOC 2 or SOC 3 reports for a PCI DSS assessment, though it may reuse their evidence after independent review. Ask which of your existing reports the firm plans to reuse, how it will review them, and which requirements it will test directly. If a provider holds a current PCI DSS assessment, ask whether the firm will rely on that provider's ROC for the covered requirements, since the standard does not require onsite retesting in that case.
Get the scope and deliverables in writing
Before signing, require a written statement of the systems in scope, the validation type (ROC or the applicable SAQ), the sampling approach, the testing periods, the interview list and the exact deliverables, including workpapers and the Attestation of Compliance. Confirm who is responsible for scope confirmation and what happens if scope grows during the assessment. Vague scope is the most common reason timelines and fees change after signature.
Confirm who signs the ROC
The QSA conducting the assessment keeps ultimate responsibility for the Report on Compliance and workpapers, even when another auditor at the same firm collects evidence, such as a SOC 2 examiner. Ask who will sign the ROC and Attestation of Compliance, who reviews the work before signature, and how your team will be told of unresolved findings. Your organization owns its controls, while the QSA owns the validation opinion.
Plan how you will give feedback
Clients can give the PCI SSC feedback on a QSA's or ASV's service, so keep a record of how the engagement goes from kickoff to signed report. Agree in the contract how escalations are handled, who at the firm you contact about disputes, and how you will raise a concern about quality. Documenting these points early gives you evidence if the relationship needs to change.
Questions buyers ask when choosing a QSA
How much does a QSA engagement cost and what drives the price?
No official price exists, and the PCI SSC does not set QSA fees, so the figure comes from a written quote tied to scope. The main drivers are the number of in-scope systems and locations, the validation route (a Report on Compliance is far more work than a Self-Assessment Questionnaire), how many payment channels and third parties must be examined, and how ready your evidence is on the first day. Ask each firm to itemize its fee by assessment phase, state which evidence it expects you to provide, list travel and sampling assumptions, and say whether a re-assessment or retest of remediated findings is included. Costs recur every year because validation is annual, so compare multi-year pricing and what changes when scope grows.
How long does it take to select a QSA and complete an assessment?
Selection usually takes weeks, and the assessment itself depends on scope, the number of locations and how prepared your controls and evidence already are. Start by confirming your validation route, then request proposals with a defined scope so firms can estimate effort on the same basis. Plan time for scope confirmation, evidence collection, interviews, sampling, remediation of findings and the reporting review, since an assessor cannot accept evidence that did not exist during the review period. Ask each firm for its own schedule and the dependencies it expects from your team, and treat any firm that cannot explain its timeline as a risk.
Can a QSA company help prepare our environment and still assess it?
Yes, but only when the people who design or implement controls are separated from the people who assess them. PCI SSC FAQ 1562 says a QSA employee who designs or implements controls for a client may not assess those controls, so consulting and assessment must be walled off within the firm. In practice, ask whether the proposed assessment team had any role in building your controls, and whether a different team would handle any readiness work. Many organizations use an independent consultant for preparation and a QSA company for validation, which keeps the assessor's independence clear. Your own team still owns the controls, and the assessor still issues the Report on Compliance.
Can a SOC 2 report replace PCI DSS testing?
No. A QSA cannot rely on a SOC 2 or SOC 3 report to satisfy a PCI DSS assessment, as PCI SSC FAQ 1567 states. The assessor may reuse evidence gathered for a SOC 2 examination, but only after reviewing it independently and confirming it addresses the PCI DSS requirement and the in-scope systems. Your SOC 2 auditor's work also does not transfer responsibility, since the QSA keeps ultimate responsibility for the Report on Compliance and its workpapers, as PCI SSC FAQ 1566 explains. Plan for PCI DSS-specific testing even when a SOC 2 examination exists, and ask the QSA early which of your existing artifacts it intends to review.
What happens if our QSA company is listed as In Remediation?
A QSA listed as In Remediation has violated program validation requirements and may be working to restore compliance, according to the PCI SSC's QSA listing. Check the status on the PCI SSC QSA list each time you engage a firm and again before signing, because status can change. If the listing shows In Remediation, ask the firm in writing what the violation involved, whether it affects your engagement, who will sign the Report on Compliance, and when the status is expected to clear. Do not rely on the firm's word alone. Confirm the individual assessor's listing as well, and document your decision in your third-party risk file. Clients can also give the PCI SSC feedback on a QSA's service.
Can our own team run the PCI DSS assessment instead of a QSA?
Your team can prepare and test controls, but the Report on Compliance must be completed by a QSA company, so an internal team cannot issue it alone. Where the validation route allows self-assessment, the Self-Assessment Questionnaire is completed by your staff and signed through its Attestation of Compliance, which is a different route with its own eligibility rules. Internal assessors who support a Report on Compliance are covered separately in PCI DSS assessment guidance. Confirm with your acquirer or the relevant payment brand which route applies to your entity before choosing, because the payment brands decide which validation you must submit.
How DeployOpen prepares your environment before a QSA assesses it
DeployOpen prepares the systems, controls and evidence that a QSA will look at, but it does not assess, certify or report on them. Its work covers self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. That can include planning the platform layout, implementing and hardening components, integrating them with your existing identity, logging and change processes, backing them up, and documenting how each control operates. The output is an environment and a body of evidence your team can hand to the assessor. Only the independent QSA decides whether the controls meet the standard and issues the Report on Compliance or Attestation of Compliance.
Before any of that work starts, the scope is agreed in writing. The written scope names the systems, the platforms, the deliverables and the timelines, along with the responsibilities of your team, DeployOpen and the QSA. Ask for that document to state which items are yours to own, such as policy approval, access reviews and the decision on which validation path applies, and which are DeployOpen's, such as configuration, hardening notes and evidence preparation. Confirm with your QSA that the proposed evidence format and sampling approach are acceptable before the build begins, because the assessor, not the implementation partner, sets what evidence it will accept.
To request a quote, send your scope as you currently understand it: the cardholder data environment boundary, the platforms you want self-hosted, the current validation method and your target QSA. DeployOpen will return a proposal based on that written scope. Quotes follow from the scope, so a clearer description of your environment produces a more accurate proposal. Nothing in the engagement guarantees a particular assessment result or the outcome of any QSA review.
