Getting outside help with PCI DSS: what a consultant does, keeping consulting and assessment independent, who QSAs, ASVs and ISAs are, and splitting the work between your team, providers and assessors.
What PCI DSS consultants and implementation partners do, from scoping and gap analysis to building controls and preparing evidence, what drives the cost, why the SSC publishes no price, and why the consultant cannot also assess the same controls.
The roles PCI SSC qualifies and what each may do: QSAs and the ROC, ASVs and external scans, Internal Security Assessors, who may run internal scans and penetration tests, and how to check an assessor's listing.
Whether the firm that assesses you can also design or build your controls: the QSA independence rule, separating consulting and assessment teams, QSA help with SAQs, evidence collected by other auditors and who keeps responsibility for the ROC.
A split of PCI DSS work between your team, providers and assessors: responsibilities that stay with you after outsourcing, independent testers, internal scanning without an ASV, service provider evidence, and the quarterly program reviews providers must run.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.