A Payment Card Industry Qualified Security Assessor or PCI QSA is a professional who works for a QSA company qualified by the PCI Security Standards Council to assess compliance with the Payment Card Industry Data Security Standard (PCI DSS). Many QSA companies provide both PCI assessments and consulting services pertaining to PCI compliance. If you are considering hiring a professional to help your Australian business, here are a few helpful guidelines.
While it may be tempting to opt for the services of an assessor who asks for the lowest professional fee, remember that you almost always get what you pay for. Remember that PCI Compliance is not just another item to tick off your to-do list. Failure to obtain it can lead to serious consequences. Although there are some assessors who do ask for low professional fees, these are more an exception than the rule.
It does not necessarily mean that when an assessor is qualified, he can offer the best advice. Most professionals vary in their ability and proficiency. The best are often employed by companies with a dedicated PCI DSS practice, rather than companies that simply provide the service amongst a range of other services.
Your QSA should perform two important roles in order to help your business. As an auditor, he will thoroughly assess the structures you have put into place. But before and after the audit, your QSA should act as a business partner who can readily provide you with invaluable advice.
The PCI Security Standards Council requires QSA companies to keep these roles independent. A QSA employee who designs or implements a control for you cannot also assess that same control; a different QSA employee who was not involved must assess it.
Before hiring a QSA, it is worthwhile to invest ample time into assessing his knowledge, skill and experience. Here are areas worth delving into.
Often, the best professionals have several years of experience and have worked with different organisations of varying sizes. If you’d ask them for references, they readily give you a list of their past clients.
Your QSA should readily answer your queries and explain complicated issues in a clear and simple manner. Prior to hiring a QSA, it is worthwhile to do some research and ask him about contentious issues in his field. What you’d want are answers that are fairly consistent. Why? Consistent answers mean that the QSA knows what he is talking about. In turn, should he recommend some measures to be implemented, you’ll know that your investment toward those are well worth your money.
A true professional knows that his role extends beyond auditing. Rather than giving advice to clients, they offer solutions and explain the merits of each. The best auditors also subscribe to the ideal of transparency. If your organisation has pitfalls, he will readily explain why such things happened and what options are available to you in order to rectify these. Finally, quality professionals adhere to a strict code of ethics. Rarely will you hear the best professionals name past clients and the issues they have encountered.
StickmanCyber is a PCI DSS QSA company. Our PCI DSS compliance service takes you from scope to attestation in 5 steps, with your assessment signed off by a QSA. Book a free consultation today.
It depends on your merchant level. Australian acquirers such as Westpac require Level 1 merchants, which process more than 6 million Visa or Mastercard transactions a year, to have an annual Report on Compliance completed by a QSA company. Most smaller merchants validate with a Self-Assessment Questionnaire, although some Level 2 merchants may still need a QSA, depending on how they handle card data.
Search the PCI Security Standards Council’s list of Qualified Security Assessors before you engage one, and again at each renewal. You can filter the list by region to find QSA companies that service Australia. A company shown as “In Remediation” has been found by the Council to have violated its QSA validation requirements.
Yes, but not with the same people. The PCI Security Standards Council requires separation of duties, so a QSA employee who designed, developed or implemented a control cannot assess that control. Another QSA employee from the same company who was not involved may assess it.
A QSA works for an independent QSA company qualified by the PCI Security Standards Council to validate PCI DSS compliance. An Internal Security Assessor (ISA) is an employee trained by the Council to carry out internal PCI DSS assessments for their own organisation, recommend fixes and act as the liaison with the external QSA.
A QSA assessment produces a Report on Compliance (ROC), which details the findings for each requirement, and an Attestation of Compliance (AOC), which summarises the result. The PCI Security Standards Council does not recognise “PCI DSS certificates” for validation, so ask for the official documents. Your acquirer or payment brand decides which of them you must submit.