Also called: QSA, PCI Qualified Security Assessor
What a Qualified Security Assessor is
A Qualified Security Assessor, or QSA, is an assessor authorized by the PCI Security Standards Council (PCI SSC) to evaluate businesses against the Payment Card Industry Data Security Standard (PCI DSS). PCI SSC qualifies assessors and QSA companies. It does not assess your business’s compliance.
A QSA examines the systems, processes, and evidence within your cardholder data environment (CDE). That environment includes systems that store, process, or transmit cardholder data, and systems that could affect its security. The scope matters: including unnecessary systems can increase assessment work, while leaving relevant systems out can leave gaps.
As of 2026, PCI DSS version 4.0.1 is current. A QSA assessment checks applicable requirements against your actual environment and records findings. It is not a general security certification that guarantees your systems will never be breached.
A QSA assesses your PCI DSS compliance, but your payment brand sets the validation requirements.
How a QSA assessment works
Your payment brand sets the applicable validation requirements, including whether your business needs a formal assessment. When a QSA assessment is required, you select a company from PCI SSC’s QSA List that is qualified for the relevant region. The assessor and your team define the CDE scope, review documents and evidence, and test applicable controls.
The QSA documents a formal assessment in a Report on Compliance (ROC). An Attestation of Compliance (AOC) summarizes the compliance status. The QSA Employee and the QSA Company’s authorized officer sign the AOC, and your business also attests that the assessment documents are accurate.
If the assessment identifies gaps, your business must address them and provide evidence that the fixes work. For example, PCI DSS v4.0 requirements for multifactor authentication for all access into the CDE became mandatory on March 31, 2025. Missing a required control can mean more remediation and retesting before the assessment is complete.
What it means for your costs
A QSA’s assessment is a professional compliance service, not an interchange, card-network, or processor-markup fee charged on each sale. The research provides no standard merchant assessment price, so the total depends on the work and scope in your engagement. Preparation and remediation also take staff time.
A QSA assessment is not a standard card-processing statement line. PCI non-compliance fees are a separate charge that processors commonly bill when a merchant has not validated compliance. Do not treat paying a QSA as proof that your processor’s PCI fee should disappear; confirm that the required validation has been completed and recorded.
What you can actually change
- Confirm the requirement. Identify which payment brand’s validation rules apply to your business and whether they require a QSA assessment or another validation method.
- Check the QSA listing. Choose a QSA Company on PCI SSC’s list that is qualified for your region. Define the CDE scope and assessment deliverables before work begins.
- Prepare your evidence. Gather system inventories, data-flow information, policies, and control evidence. Track each finding through remediation and retesting.
Frequently asked questions
Does every business that accepts cards need a QSA?
No. Payment brands set validation requirements, and those requirements determine whether your business needs a QSA assessment. Do not assume a transaction-volume threshold applies to every brand or business type.
Does a QSA certify that my business is secure?
A QSA assesses your business against applicable PCI DSS requirements and documents the results. The assessment does not guarantee that a breach cannot happen or certify security beyond the assessment’s scope.
How much does a QSA assessment cost?
There is no standard merchant assessment price in the research. The fee depends on the assessment engagement and its scope. QSA training and qualification prices are not merchant assessment prices.
Will a QSA fee appear on my processing statement?
A QSA assessment is not a standard card-processing fee or network fee. PCI non-compliance fees are separate charges that processors commonly bill when a merchant has not validated compliance.