How to Choose a PCI QSA Company: 11 Questions Before You Sign

What separates a good QSA company from an expensive rubber stamp — and the exact questions that reveal which one you’re talking to.

Start with accreditation

Before anything else: confirm the firm is currently listed as a QSA company on the PCI SSC’s assessor listings, and cross-check Visa’s Global Registry of Service Providers, which names the assessor on validated entities. Accreditation renews annually — last year’s status proves nothing about this year.

The 11 questions

1. Are you currently an accredited QSA company, and will you put it in the engagement letter? Verbal assurance is worthless.
2. Who exactly is on my assessment team — names and CVs? Not the sales contact. You want the QSAs who will be in your environment.
3. How many ROCs has that team completed in the last 12 months, in environments like mine? Volume in your vertical matters more than total headcount.
4. Is the fee fixed, and exactly what breaks it? Scope expansion is the classic fee-breaker — get the boundaries in writing.
5. How do you scope the cardholder data environment, and what happens if it grows mid-assessment? You want a defined re-scoping process, not a blank check.
6. What’s included: gap assessment, pen test, ASV scans, remediation support? Bundled vs. unbundled changes the comparison completely.
7. What’s your fieldwork window, and what happens if our evidence is late? Understand whose delay costs whom.
8. How do you handle findings — and do you also sell the remediation? A QSA that profits from finding problems has a conflict worth naming. Independence matters.
9. Can we speak to two reference clients our size, in our industry? Then actually call them and ask about timeline slips.
10. What does the report review process look like? You should get to correct factual errors before the ROC is signed.
11. What happens at renewal? Year-two pricing, evidence carryover, and whether the same team returns.

Red flags

• Guaranteed pass. No honest QSA guarantees an outcome before seeing your environment.
• A ROC in a week. For any non-trivial scope, that’s a signature, not an assessment.
• No named team. “We’ll staff it later” means you’re buying whoever’s free.
• Remediation upsell pressure. Findings should come with guidance, not a sales quota.
• Can’t explain v4.0.1 changes. If they’re fuzzy on the current standard, walk away.

The quote comparison

Get at least three scoped quotes and compare the engagement letters line by line — not just the headline fee. Our RFP and quote worksheet gives you the brief template and a printable comparison sheet.

Keep reading

Questions