The short answer
A PCI QSA, also called a PCI DSS QSA, is a Qualified Security Assessor employed by a company the PCI Security Standards Council has qualified to validate PCI DSS compliance. The QSA tests your controls, records the results in a Report on Compliance and signs the Attestation of Compliance. Level 1 merchants and service providers usually need one every year.
On this page
- What is a PCI QSA?
- What does a QSA do?
- Do you need a QSA, or can you self-assess?
- How do you find and verify a PCI QSA?
- What does a Sovereign QSA engagement deliver?
- How do we keep consultancy and assessment separate?
- Why does it help to have QSA, QPA and CPSA in one team?
- Why Sovereign Secure
- Talk to a QSA
A PCI QSA, also called a PCI DSS QSA, is the independent Qualified Security Assessor who validates your compliance with PCI DSS and signs the evidence your acquirer and customers rely on. Sovereign Secure is a PCI SSC-approved Qualified Security Assessor (QSA) company: our QSAs scope and test your cardholder data environment (CDE) against PCI DSS v4.0.1, write your Report on Compliance (ROC) and sign your Attestation of Compliance (AOC), or review your Self-Assessment Questionnaire (SAQ) and co-sign its AOC.
We are also approved as a Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA), and we sit on the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026-2028. If your business needs more than one PCI standard assessed, one team can plan the work together.
What is a PCI QSA?
A QSA is a security professional qualified by the PCI Security Standards Council (PCI SSC) to assess compliance with PCI DSS, working for a company the Council has qualified as a QSA company. The two go together: a QSA can assess only while employed by a QSA company, and only on that company’s behalf.
The PCI SSC qualifies QSA companies against its QSA Qualification Requirements, which cover independence, quality assurance, insurance and the skills of the people doing the work. Individual QSAs complete PCI SSC training and examinations, and both the company and its assessors re-qualify every year. The Council also reviews the quality of assessors’ work and can place a QSA company in remediation if that work falls short.
Qualification is not an endorsement. The PCI SSC states on its QSA list that qualification shows only that an assessor has met its requirements, and that it does not endorse the companies listed. That is why you should check the listing and ask who will actually assess you.
QSA, QSA company or ISA: what is the difference?
| Role | Who they are | Who they can assess | Can lead a ROC and sign the AOC? |
|---|---|---|---|
| QSA company | An independent firm qualified by the PCI SSC and listed on its website | Any merchant or service provider, in the regions shown on its listing | Yes: its QSA and an authorised officer sign the AOC |
| QSA | An individual employed by a QSA company who has passed PCI SSC training and re-qualifies each year | Any client of their employer | Yes, as lead assessor |
| Associate QSA (AQSA) | An employee of a QSA company who has passed the PCI SSC’s Associate QSA training but does not yet have the experience to qualify as a QSA | Clients of their employer, working under the supervision of a QSA | No: a QSA reviews the work and signs |
| Internal Security Assessor (ISA) | Your own employee, trained and qualified through the PCI SSC’s ISA programme | Their own employer only | Only for internal assessments, where the card brands and acquirer accept them |
| PCI consultant | Anyone offering PCI advice; not a protected title | Nobody, unless they are also a QSA or ISA | No |
What does a QSA do?
A QSA validates, independently, that the PCI DSS requirements that apply to you are in place and working. In a ROC assessment our QSAs:
- Validate scope. Confirm which people, processes and systems store, process or transmit account data, and which connected systems can affect its security, including how segmentation is used and tested.
- Test each requirement. Interview staff, review documents, examine configurations, sample systems and records, and observe processes, following the PCI SSC testing procedures for v4.0.1.
- Assess alternative approaches. Evaluate compensating controls and, for the customised approach, test the controls you designed against the requirement’s objective. The customised approach is validated through a ROC, not an SAQ.
- Report and sign. Record every finding in the PCI SSC ROC template, pass the report through our internal quality review, then sign the AOC.
Where you self-assess, a QSA can review your SAQ answers and evidence before anything is signed, and co-sign the AOC where your acquirer wants QSA involvement. The full audit process, from scoping to the day-by-day fieldwork plan, is on our PCI compliance audit page.
Do you need a QSA, or can you self-assess?
Your level, your acquirer and your customers decide whether you need a PCI compliance QSA or can self-assess. The card brands set the rules, and the table below summarises Visa’s and Mastercard’s published requirements (both checked on 13 October 2026).
| Your situation | Do you need a QSA? |
|---|---|
| Level 1 merchant (over 6 million transactions a year with one brand) | A ROC every year, normally by a QSA. Visa accepts a ROC by an internal resource if an officer of the company signs it, and Mastercard accepts a ROC whose AOC is signed by a PCI SSC-certified Internal Security Assessor (ISA) or, unless law or regulation prohibits it, an executive officer of the merchant, so check with your acquirer before relying on either |
| Level 1 service provider (over 300,000 transactions a year, and for Mastercard several provider types at any volume) | A ROC every year by a QSA |
| Level 2 merchant | Usually an SAQ, but Mastercard requires a QSA or ISA where a Level 2 merchant completes SAQ A, A-EP or D |
| Level 2 service provider | SAQ D for Service Providers is allowed, though Visa requires QSA validation before listing a provider on its Global Registry of Service Providers, and many customers ask for a ROC from a QSA |
| Level 3 or 4 merchant | Usually an SAQ, unless your acquirer requires more, for example after a security incident |
| You want to use the customised approach | Usually: it can only be validated through a ROC, so you need a QSA or, where accepted, an ISA |
| A customer contract requires a QSA-signed AOC | Yes, whatever your level |
Our guide to PCI DSS Level 1 explains what Level 1 validation involves for merchants and service providers. If you expect to self-assess, our free PCI compliance check suggests your likely SAQ and the gaps to fix first.
How do you find and verify a PCI QSA?
Check the PCI SSC’s list of Qualified Security Assessor companies before you sign anything. In practice:
- Find the company on the QSA list and confirm the name matches the legal entity on your proposal.
- Check the regions shown on its listing cover where you operate. An office in a country does not by itself grant an approval there.
- Check the people. Ask who will lead and perform the assessment, and confirm they are current QSAs with that company.
- Check other programmes if you need them: PIN security assessments need a QPA, and card production assessments need a CPSA.
Sovereign Secure Ltd is listed by the PCI SSC as a QSA company for Europe, CEMEA (Central Europe, Middle East and Africa), Asia Pacific, the USA and Canada, and as a QPA and CPSA for Europe, CEMEA, Asia Pacific and the USA. CEMEA includes the Middle East, and our guide to PCI PIN assessments in Dubai explains how the QPA programme works there. Our CPSA listing covers both logical and physical card production assessments. We checked these listings on 13 October 2026, and you should check them again yourself.
For the questions to put to each firm, see our guide on how to choose a PCI QSA.
What does a Sovereign QSA engagement deliver?
Every engagement ends in a document your acquirer, the card brands or your customers accept. Which one depends on who is asking. None of them is a certificate: as our guide to PCI DSS certification explains, the signed AOC is your proof of compliance.
| Engagement | Who it suits | What you receive |
|---|---|---|
| ROC assessment | Level 1 merchants and service providers, and anyone whose acquirer or customers want independent validation | A Report on Compliance and an AOC signed by our QSA |
| QSA-validated SAQ | Merchants and Level 2 service providers whose acquirer or customers want QSA involvement | An SAQ reviewed against your evidence, with the AOC co-signed by our QSA |
| Service provider assessment | Processors, gateways, hosting and SaaS platforms | A ROC or SAQ D for Service Providers, and an AOC for Service Providers listing the services assessed |
| PCI PIN assessment (QPA) | Acquirers, processors and key injection facilities that handle PINs and PIN keys | An assessment against the PCI PIN Security Requirements v3.1 |
| Card production assessment (CPSA) | Card manufacturers, personalisers and provisioning providers | An assessment against the Card Production and Provisioning logical and physical security requirements |
PCI DSS also needs testing evidence. We carry out penetration and segmentation testing (Requirement 11.4) and arrange quarterly external scans through our PCI SSC Approved Scanning Vendor partner (Requirement 11.3.2). Sovereign Secure is not itself an ASV.
How do we keep consultancy and assessment separate?
Some clients want help getting ready before they are assessed. Our PCI DSS consultancy covers scoping, gap analysis and remediation support. Where we both advise and assess the same client, advisory and assessment work are kept separate, as the PCI SSC expects of a QSA company:
- Nobody assesses controls or documents they designed, built or wrote for you.
- The assessment tests the same requirements, to the same standard, whether or not you used our consultancy. Consultancy never buys an easier assessment.
- You are free to use us for consultancy and another QSA for the assessment, or the other way round.
Why does it help to have QSA, QPA and CPSA in one team?
Payment businesses often fall under more than one PCI standard. A processor that acquires PIN transactions may need PCI DSS and PCI PIN; a card bureau may need PCI DSS and Card Production. Each standard has its own assessor programme, with its own PCI SSC approval and listing.
Because we are approved for all three, one team can plan the assessments together, collect shared evidence once and avoid contradictory findings on overlapping controls such as key management and physical security. See our PCI PIN security assessments and card production audits for how those programmes run. We are also listed as a P2PE Assessor (Europe and USA) and a 3DS Assessor, for providers that need P2PE assessments or PCI 3DS assessments.
Why Sovereign Secure
- A listed QSA company. Sovereign Secure Ltd (Companies House 08334453, incorporated 2012) is headquartered at 16 Whalley Road, Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.
- Five PCI SSC approvals. QSA, QPA, CPSA, P2PE Assessor (Europe and USA) and 3DS Assessor, so PCI DSS, PIN, card production, P2PE and 3DS work can be planned by one team.
- Part of the assessor community. We are a member of the PCI SSC Global Executive Assessor Roundtable for 2026-2028.
- Security we practise. We are ISO 27001 certified and ICO registered.
- Payments and banking clients. Clients shown on our site include Fiserv, Cashplus, Kuwait Finance House, Ahli United Bank and Nitecrest.
- Fixed quotes. You get a fixed price after a short scoping call, so you know the cost before work starts.
Talk to a QSA
Tell us how you take or process card payments, your level if you know it, and who is asking for proof. A QSA will confirm what you need to submit and send a fixed quote. Contact our PCI team or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
