When does a PCI Internal Security Assessor make sense for your organization?
An Internal Security Assessor (ISA) is an employee your company sponsors to perform internal PCI DSS assessments, recommend remediation and act as liaison with the external QSA. The PCI SSC lists $4,000 for new ISA training and exam for non-Participating Organizations and $2,000 for Participating Organizations, with requalification at $1,600 ($1,350 for POs), in US dollars excluding taxes. Those are the listed training fees only. Your real cost also includes the candidate's time away from other work, the prerequisite PCI Fundamentals training, and the annual requalification. Ask any provider or the PCI SSC for the current figures before you build a budget, because listed fees can change.
The answer depends on three questions. First, how many assessments, SAQs and remediation cycles does your organization run each year? An ISA earns its keep when there is steady internal assessment work, not one annual validation that a QSA will perform anyway. Second, do you have a candidate with at least five years of relevant audit or security experience, and will your company sponsor them? The SSC recommends that experience level, and sponsorship is required. Third, do you still need a QSA for the Report on Compliance? You do. Only a QSA issues a ROC, and an ISA does not replace that role. Your company owns its controls throughout. The ISA helps you prepare, test and document them, and an independent QSA performs the formal assessment where one is required.
Before you commit, confirm three points in writing. Check how the ISA's annual requalification will fit into their workload, since the ISA must requalify every 12 months to keep the designation for your company. Agree in advance which tasks an ISA will handle on any SAQ you complete, because the ISA records their involvement in Part 3d of the SAQ. Finally, confirm that the person you train will not be asked to assess controls they helped design, since independence rules apply to QSA staff in the same way that they shape how your internal reviews are judged. Where these checks show low volume or no suitable candidate, a fixed-scope engagement with an outside provider is often the simpler path.
Who qualifies as an ISA and what the sponsor must provide
The ISA credential is granted to a person, but it is only useful to the company that sponsors them. The cards below cover what the employer must put in place before a candidate enrolls, and what the candidate must bring to the program.
Employer sponsorship is mandatory
An ISA candidate cannot enroll on their own. The sponsoring company must put them forward, and the credential exists to build assessment capacity inside that employer. Before committing budget, confirm with the PCI SSC that your organization's sponsorship arrangement meets current program rules, and check whether your employer's status as a Participating Organization affects the fees you will pay.
Five years of relevant experience
The SSC recommends that candidates bring at least five years of relevant audit or security experience. The recommendation is not a formal prerequisite that the SSC checks at enrollment, so the sponsor should assess candidates against it honestly. A person who has only operated firewalls or only run help desk support will need a stronger case than someone who has tested controls against a framework.
Experience that maps to PCI DSS
Useful experience includes internal audit, information security assurance, network or system administration with control ownership, and prior work on PCI DSS or similar frameworks. Ask candidates for evidence of the assessment work they have done, such as sample testing, evidence reviews or remediation tracking. Experience that is purely operational may still be valuable, but it will need supplementing with formal training before the candidate can assess confidently.
The ISA serves one sponsor only
An ISA is qualified to perform assessments for the company that sponsored them, not for its clients, partners or other employers. If your organization acquires another business, or you provide services to third parties that need validation, a separate qualification or a QSA will usually be needed. Confirm the boundaries of the credential against the current ISA program terms before planning how the role will be used.
Protecting independence and continuity
The sponsor should decide who can hold the role, how the ISA's time is protected from day-to-day control ownership, and what happens if the person leaves. An ISA who designed or operates a control should not be the only person judging it. Document this in the internal assessment plan and confirm the arrangement with your QSA before the first assessment cycle.
Confirm criteria before enrolling
Candidate criteria, prerequisite courses and fee schedules can change. Before enrolling anyone, check the current requirements on the SSC ISA page and ask the SSC directly if the sponsorship or experience question is unclear. Record the answers in your file, since you may need to show them to your QSA or to the company's assessor during a later review.
How ISA training and the exam work
The sequence runs from sponsorship and the required prerequisite through the ISA course and exam to an active qualification that lasts only as long as the candidate keeps requalifying for the sponsoring company.
Confirm sponsorship and experience eligibility
Your organization nominates the candidate, because the ISA program only trains staff sponsored by their employer. The SSC recommends at least five years of relevant audit or security experience. Ask the candidate's manager to document that background and confirm the sponsorship in writing before any payment is made. The step is complete when the sponsor and candidate both confirm eligibility and the candidate is cleared to enroll in the prerequisite.
Complete the PCI Fundamentals prerequisite
The candidate completes the PCI Fundamentals prerequisite before starting the ISA course. This gives the baseline knowledge of the standard that the ISA course builds on. Confirm with the SSC which course formats, languages and access arrangements are currently offered. The step is complete when the candidate holds the prerequisite completion record, which the candidate should keep for the enrollment file.
Attend the ISA training course
The candidate takes the ISA course, which covers how to perform an internal assessment, recommend remediation and act as the liaison with the external QSA. Ask the SSC for the current course outline, delivery mode and any materials the candidate must have ready. The step is complete when the candidate has finished the course and is eligible to sit the exam.
Sit the 60-question exam
The candidate sits a 60-question exam with a 90-minute time limit. A score of 75% or higher is a pass. Confirm scheduling, proctoring rules, retake policy and any accommodation requests directly with the SSC, since these details can change. The step is complete when the candidate receives an official result. A failed attempt means the candidate must follow the SSC's retake terms before the qualification can proceed.
Receive the ISA qualification for the sponsor
A passed exam results in an ISA qualification tied to the sponsoring company, not to the individual alone. The qualified person can then perform internal PCI DSS assessments and support SAQ work for that sponsor. Record the qualification, its date and the sponsor in your compliance file so assessors can verify it. The step is complete when the sponsor has the certificate or confirmation from the SSC and the role is assigned in writing.
Requalify every 12 months
ISAs must requalify every 12 months to remain ISAs for their sponsor company. Put the requalification date on your compliance calendar and confirm the current requalification route with the SSC well in advance. Budget for the requalification fee, which is set by the SSC and differs for Participating Organizations. The step is complete when the requalification is recorded. If it lapses, the person stops acting as an ISA until they requalify.
What the ISA program costs each year
The PCI SSC lists the ISA fees in US dollars, excluding taxes, and the amounts differ by Participating Organization (PO) status. A new ISA candidate pays for the training and exam. A non-Participating Organization pays $4,000 for new training and the exam, while a Participating Organization pays $2,000. These are one-time costs for each new ISA, and they are paid to the PCI SSC for the course and exam rather than to a consultant.
- New training and exam, non-PO: $4,000 per candidate, in US dollars, excluding taxes.
- New training and exam, PO: $2,000 per candidate, in US dollars, excluding taxes.
- Who pays: the sponsoring company, which must also sponsor the candidate.
- Cost drivers: whether your organization holds Participating Organization status and how many staff you train.
- Quote check: confirm the figures against the current fee schedule on the PCI SSC ISA page before budgeting, because fees can change.
Confirm your PO status and the current schedule with the PCI SSC before you commit the budget for a new candidate.
An ISA must requalify every 12 months to keep the credential for the sponsoring company. Requalification is the main recurring fee, and it applies for as long as the organization relies on that ISA. The PCI SSC lists $1,600 for requalification for non-Participating Organizations and $1,350 for Participating Organizations, in US dollars, excluding taxes. Budget these amounts every year for each active ISA, not only in the year of initial training.
- Non-PO requalification: $1,600 per ISA per 12-month cycle.
- PO requalification: $1,350 per ISA per 12-month cycle.
- Lapse risk: an ISA who misses requalification loses the credential, so the calendar belongs in your compliance plan.
- Multiple ISAs: fees multiply with the number of qualified staff, so decide how many you need before you train them.
- Quote check: ask whether the requalification figure has changed since your last cycle.
Add the requalification date for each ISA to your compliance calendar and confirm the current fee with the PCI SSC.
The largest recurring cost is usually the ISA's time, not the fee. An ISA performs internal assessments, recommends remediation and liaises with the external QSA, so the work repeats each assessment cycle. Your organization pays for that time through salary and overhead, and it does not appear on the PCI SSC fee schedule. The hours depend on the size and complexity of your cardholder data environment, the number of systems in scope and how many assessment cycles you run in a year.
- Assessment work: internal assessments, evidence gathering and sampling across the requirements in scope.
- Remediation support: the ISA recommends fixes and checks that they close the gaps.
- QSA liaison: time spent answering the external QSA's questions and preparing for the onsite or remote review.
- Scope changes: new payment channels or system changes trigger reassessment work.
- Estimating hours: no supplied figure exists for typical effort, so build the estimate from your own scope and past cycles.
Ask the ISA and your QSA to estimate the hours for your environment before you decide how many ISAs you need.
An ISA usually holds another job, such as security engineering, risk, audit or IT operations. When the ISA spends time on assessments, someone must cover those duties, and that cover is a real cost even though no invoice arrives. Backfill can take the form of overtime, a temporary hire, a reassignment of other staff or delayed projects. Organizations often underestimate this cost because it sits in another department's budget.
- Duty coverage: identify which tasks the ISA stops doing during assessment periods.
- Timing: assessment peaks may collide with releases, audits or incident response.
- Deputy planning: a second trained person reduces the risk that one absence stalls the program.
- Opportunity cost: projects that slip while the ISA is assessing carry a cost to the business.
- Budget owner: agree which department absorbs the backfill cost before the year starts.
Write down the ISA's regular duties and the months in which assessment work peaks, then agree the coverage plan with the managers involved.
A workable annual budget combines three lines: the fees paid to the PCI SSC, the internal time and backfill for each ISA, and any outside support you add. The PCI SSC fees are published and fixed for the schedule in force, but the internal costs depend on your environment. Ask a QSA, consultant or the PCI SSC for current figures in writing, and keep the source of each number so the budget can be reviewed at the next cycle.
- Fee lines: training for each new ISA, plus requalification for each ISA every 12 months.
- Internal lines: assessment hours and backfill, estimated from your scope.
- Outside support: any consultant or QSA time you add, quoted separately.
- Currency: fees are in US dollars, excluding taxes, so add applicable taxes for your jurisdiction.
- Review point: revisit the budget when the scope, the PO status or the fee schedule changes.
Before budgeting, ask the PCI SSC for the current fee schedule and confirm your Participating Organization status.
What an ISA does on SAQs and how QSA help is recorded
An Internal Security Assessor can perform internal PCI DSS assessments, recommend remediation and act as the liaison with the external QSA, but the ISA's involvement on an SAQ is recorded in a different place from a QSA's. If an ISA helped your team work through a Self-Assessment Questionnaire, that involvement is noted in Part 3d of the SAQ. Your organization still owns the answers. The organization, not the ISA, signs the Attestation of Compliance, and the signatory should be an officer who can stand behind the answers on every line of the form. Before the SAQ is completed, confirm internally who will sign, who will supply evidence and who will review the answers for accuracy.
A QSA who helps complete an SAQ is handled differently. The PCI SSC sets no specific reporting rules for this situation, so the parties should agree the QSA's role in advance, in writing, before work starts. The QSA then records that role in Part 3c of the SAQ. Agree the boundaries early: whether the QSA will explain requirements, review draft answers, or only validate evidence, and whether the QSA will design or implement any controls. The second case matters for independence. A QSA who recommends, designs or implements controls for an entity may not assess those same controls, so a later ROC would need a different QSA who was not involved.
Check these points against your own engagement plan. Ask whether the ISA's role is documented clearly enough that an acquirer reviewing the SAQ can see who did what, and whether any internal assessor involvement sits in Part 3d while any external QSA involvement sits in Part 3c. Confirm the current SAQ version and its instructions directly with the PCI SSC, since the form and its wording are the authority on where each entry belongs. If you plan to use both an ISA and an outside QSA, document the division of work in a short note kept with the evidence file, so that the record of who advised, who checked and who attested is consistent.
Independence rules that limit what your ISA can assess
Your ISA can run internal assessments, but the independence rules decide which controls that person may judge. The cards below cover the QSA principle that SSC guidance sets out, the parallel risk for staff who built or ran controls, and the checks to make before an ISA signs off on evidence.
The QSA independence principle
PCI SSC FAQ 1562 states that a QSA employee who recommends, designs or implements controls for an entity may not assess those same controls. A different QSA employee who was not involved may perform the assessment. The rule exists so that no one grades their own design work. Ask your QSA how they document this separation before fieldwork starts.
The **self-review risk** for ISAs
An ISA who designed, configured or operated a control is in the same position as a QSA who implemented it. The ISA's own work becomes the thing being tested, and the review loses its value as an independent check. Before assigning an ISA to a requirement, list every control they have touched in the past assessment period and exclude those from their review.
Mapping ISA involvement to requirements
Keep a simple register that records, for each requirement, who designed, implemented, operated or reviewed the control. Illustrative example: an ISA who rebuilt a firewall rule set should not be the reviewer for Requirement 1 on that ruleset. The register also supports the involvement notes that appear on SAQ forms.
Recording ISA and QSA roles on SAQs
For SAQ work, PCI SSC expects the parties to agree the QSA's role in advance, with the QSA noting it in Part 3c. An ISA records any involvement in Part 3d. Settle these entries before the form is finalized, because they show an assessor how each person contributed. Vague or missing entries invite questions during validation.
Confirming current independence expectations
The independence wording in SSC FAQs and program documents can change between PCI DSS and program revisions. Confirm the current expectations with the SSC and your QSA before each assessment cycle, and ask in writing how they apply to your ISA's role. Keep that written confirmation in the evidence file so an assessor can see it.
ISA or QSA: which option fits which work
This table compares three ways to run a PCI DSS assessment: an in-house ISA-led effort, an outsourced QSA assessment, and a mix of both. Read each row to see who does the work, what the output can support, who signs the resulting documents, and the situations where each option fits.
| Decision point | In-house ISA-led assessment | Outsourced QSA assessment | Mixed model |
|---|---|---|---|
| Who performs the assessment | Employees qualified as Internal Security Assessors under your sponsorship | A Qualified Security Assessor employed by a QSA company | ISAs prepare and test internally, and a QSA performs the formal assessment |
| What it can produce | Internal assessment work and SAQ support, including remediation recommendations | A Report on Compliance (ROC) and the related Attestation of Compliance | Internal evidence and gap analysis feeding a QSA-issued ROC |
| Who signs what | The merchant or service provider signs the SAQ AOC. An ISA records any involvement in Part 3d of the SAQ. | The QSA signs the ROC and the AOC for the ROC. The entity signs its AOC as well. | The QSA signs the ROC. The ISA's involvement is recorded where the SAQ or ROC template calls for it. |
| Independence limits | An ISA who designed or implemented a control should not be the one judging it in a formal review | A QSA who helped build a control may not assess that same control; another uninvolved QSA must | Keep the ISA's internal work separate from the QSA's independent testing of controls |
| When it fits | Simpler SAQ-based environments, internal readiness checks, and teams that want continuous internal assessment capacity | Formal ROC validation where the payment brands or acquirer require an independent assessor | Larger or changing environments where internal teams carry the evidence and an outside QSA validates the result |
| What to confirm before starting | Sponsorship terms, requalification timing, and whether the ISA's role is accepted by your acquirer | The QSA's scope, sampling plan, and the reporting template the acquirer expects | Written agreement on who does which task, and how the QSA will rely on ISA work |
Where an implementation partner fits when staff train as ISAs
An implementation partner can help prepare the systems, controls and evidence that an ISA-led readiness review or an external QSA assessment will examine, but it cannot issue a Report on Compliance, an Attestation of Compliance or any certificate. Only an independent QSA or other qualified assessor issues validation documents. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure, and it can support ISA-led readiness work within a fixed scope agreed in writing before work starts. Hiring a partner does not guarantee a passing result, and the organization remains responsible for its controls, its sponsorship of the ISA and its own compliance decisions.
In practice, the useful split is clear. The ISA performs internal assessments, recommends remediation and acts as liaison with the external QSA, so the ISA's time is best spent on evidence review and gap analysis rather than building configurations from scratch. A partner can take on defined technical work such as hardening baselines, logging pipelines, access review tooling or documentation of network and data flows, and deliver it as named deliverables with a timeline. Before signing, ask the partner to state in the scope which tasks it performs, which evidence it hands over, and that it will not sign or judge the controls it helped build. A useful check is whether the QSA later assessing the environment would be independent of that work under the rules in PCI SSC FAQ 1562.
Ask for a written statement of what is included, what is excluded, who holds the evidence and how remediation items will be tracked. Confirm the partner's role on any SAQ, since the QSA's involvement is recorded on the questionnaire itself, and ensure your ISA, not the partner, makes the internal assessment decisions. Costs to confirm include the one-time scope and deliverables fee and any recurring retainer for re-testing or updates. Keep the ISA's own training and requalification costs separate in your budget, as they are paid to the PCI SSC and apply regardless of who else you hire.
Questions buyers ask about the PCI ISA program
What does it cost to train an internal security assessor?
The PCI SSC lists a fee of $4,000 for new ISA training and exam for organizations that are not Participating Organizations, and $2,000 for Participating Organizations, in US dollars excluding taxes. Requalification is listed at $1,600 for non-Participating Organizations and $1,350 for Participating Organizations, per the PCI SSC ISA program page. Those are the SSC's fees only. Your total also includes the PCI Fundamentals prerequisite, course materials if billed separately, the employee's time to study and sit the exam, and the cost of covering their regular duties. Ask a training provider to separate the SSC fee from its own charges, and confirm which fees apply to your organization's status before budgeting.
How often must an ISA requalify, and what does it cost each cycle?
An ISA must requalify every 12 months to remain an ISA for their sponsoring company. The SSC lists the requalification fee at $1,600, or $1,350 for Participating Organizations, in US dollars excluding taxes. This is the recurring cost of the program, and it applies for as long as you want the person to hold the designation. Plan the requalification date when you schedule the ISA's yearly work, because a lapsed ISA cannot act in that role until they requalify. Confirm the current requalification steps and fees on the SSC page before each cycle.
Can one ISA cover more than one entity?
An ISA is qualified for a specific sponsoring company, so the designation is tied to that employer rather than to a set of unrelated businesses. If your group contains several legal entities, confirm with the PCI SSC how sponsorship applies to each one before assuming a single ISA can serve them all. Each entity still needs its own validation, and the ISA's independence from the systems they assess must be clear. Asking this early avoids training someone whose role does not match your corporate structure.
How much of an ISA's year does the role take?
The time depends on how many assessments you run, how many systems are in scope, and how many SAQs or internal reviews the ISA supports. The ISA's work includes performing internal assessments, recommending remediation, and acting as liaison with the external QSA, so the load grows with scope and with the number of remediation cycles. Ask your training provider for typical hours per assessment cycle, then compare that against your own system inventory before committing. Treat this as an estimate to confirm internally, not a fixed figure.
Can an ISA sign the Attestation of Compliance?
Whether an ISA can sign depends on the type of validation, so check the current PCI SSC templates before planning. The ISA is the person who performs internal assessments and records their involvement on SAQs, while a Report on Compliance must be completed by a Qualified Security Assessor. Where a QSA is required, the QSA carries the assessment. For SAQs, the PCI SSC guidance says a QSA who helps complete the questionnaire records that role in Part 3c, and an Internal Security Assessor records any involvement in Part 3d. Confirm the signing rules for your specific validation level with your acquirer before relying on an ISA for the AOC.
When is a QSA still required?
A QSA is still required whenever the validation you owe calls for a Report on Compliance, which is normally the case for the largest merchants and service providers. An ISA cannot replace that external, independent assessment. A QSA is also needed where the independence rules would be breached, such as when the same person helped design a control and then tests it. Under the QSA independence guidance, a QSA employee who recommends, designs or implements controls for an entity may not assess those controls, and another uninvolved QSA employee must do it. Confirm with your acquirer which validation type applies before you decide how much work the ISA can carry.
What should I ask a training provider or QSA before committing?
Ask for the written scope, the deliverables, and a split of fees between the SSC and the provider. Confirm that the candidate meets the SSC's recommendation of at least five years of relevant audit or security experience, and that your organization can sponsor them. Ask how the provider handles the 12-month requalification and whether support is included afterward. For a QSA, ask how they will document independence if your team has also received advice from them, and which validation types they will sign. Ask both parties to confirm everything in writing before work starts.
How DeployOpen prepares your environment and evidence for assessment
DeployOpen does not certify ISAs, and it does not replace the ISA's judgment. Its role is to prepare the systems and records that your ISA, and any QSA who later reviews the work, will examine. The engagement starts with a written scope that names the systems, networks and data flows inside the cardholder data environment, the self-hosted open-source platforms involved, the requirements each platform supports, and who on your side owns each decision. Scope is agreed before work begins, so your ISA can confirm early which components are in and out of the assessment boundary. Any figures for the engagement are set out in the written quote, which follows from that scope.
Implementation and hardening happen inside your own cloud accounts, data centers or air-gapped networks, so the configuration, logs and keys stay under your control. Typical work includes building the platforms, applying secure configurations, setting up logging and file integrity monitoring where the scope requires it, and documenting each setting with the reason for it. DeployOpen then prepares the evidence an assessor samples: change records, configuration baselines, access review exports, and test results with dates and owners. Your ISA should confirm the format and retention period for each artifact against the current standard before work starts, since sample sizes and evidence expectations depend on how each requirement is tested.
At handover, you receive the configuration documentation, the evidence index, the open items and a record of any role DeployOpen played, so your ISA can state its own involvement accurately in Part 3d of the SAQ or in the ROC. Keep this separation clear: if DeployOpen recommended or implemented a control, the ISA or QSA who assesses that control must be a different person from the one who designed it. Ask any implementation partner to confirm in writing which tasks it performed, and ask your ISA to confirm which parts of the evidence it will rely on.
