Definition

QSA

A QSA, or Qualified Security Assessor, is a professional the PCI Security Standards Council has certified to audit organizations against PCI DSS and sign off on their compliance. QSAs work for approved assessor companies, complete required training, and requalify each year to keep their status current. When a merchant needs a Report on Compliance, a QSA performs the testing, reviews the evidence, and validates the results. Beyond the formal audit, many QSAs also advise on scoping and remediation, helping a company fix gaps before the assessment begins. Their independence is what gives a signed PCI report credibility with banks and card brands.