PCI DSS has a vocabulary of assessor roles that confuses people who come to it from SOC 2 or ISO 27001. There is no single kind of auditor. There are Qualified Security Assessors, Internal Security Assessors, Approved Scanning Vendors and several more, each qualified by the PCI Security Standards Council for a specific job.
The two that matter most for your annual validation are the QSA and the ISA. The difference is simple to state: a QSA works for an independent assessor company and can assess any organization; an ISA works for your organization and can assess only it. What each one is allowed to produce for you, and whether your card brands and acquirer will accept it, is the harder part.
This article explains both roles, who decides which you need, the other roles you will meet, and how to choose a QSA firm.
What a QSA is
A Qualified Security Assessor is an individual qualified by the Council and employed by a QSA company, which the Council also qualifies. Both the company and its assessors appear on the Council's public list. The Council runs a quality assurance program for QSA companies, so check the list for the firm's current standing before you sign.
A QSA can assess any merchant or service provider. When a report on compliance (ROC) is required from an independent assessor, the QSA performs the assessment, documents it in the Council's ROC template, and signs the Attestation of Compliance alongside your executive officer. A QSA can also support a self-assessment, and the attestation has a place to record that involvement.
Independence is part of the role. The Council's qualification requirements for QSA companies include rules on independence from the entities they assess. If the firm you want to assess you also designed, built or operates controls in scope, raise it with them early. It may limit what they can assess.
What an ISA is
An Internal Security Assessor is an employee of your organization who has completed the Council's ISA training and qualification. The ISA program is sponsored by the employer, and the qualification covers internal work only. An ISA cannot assess another company.
An ISA brings PCI DSS expertise inside the business. In practice, an ISA can:
Run internal readiness assessments against the standard
Complete or review your self-assessment questionnaire with an informed eye
Coordinate with your QSA during an external assessment, and challenge scoping or sampling decisions knowledgeably
In card brand programs that allow it, perform your organization's own assessment and prepare a ROC
That last point depends on rules the Council does not set.
Who decides which you need
Card brands and acquirers decide how you validate. Each brand assigns merchants and service providers to levels, and its rules say what each level must submit: a ROC, an SAQ, or something else. The brand or your acquirer also decides whether a ROC must come from a QSA or can be prepared internally.
Some brand programs accept an internally prepared ROC for some merchant levels, typically signed by an officer of the company. Some ask that whoever completes an SAQ at certain levels has ISA training. Others require a QSA. The levels and conditions vary by brand and change over time, so confirm in writing with your acquirer, or with the card brand if you are a service provider. Your customers can add requirements of their own in contract; an enterprise buyer may want a QSA-signed attestation whatever your level.
Keep the answer you receive, with the date and the name of the person who gave it. Validation rules are the kind of thing that gets remembered differently a year later, usually in the week a report is due.
If you self-assess, the choice of SAQ is a separate decision, covered in choosing the right PCI DSS self-assessment questionnaire.
The other roles you will meet
The Council qualifies several other roles. You will meet some of them whatever your level.
| Role | What they do | Who they work for |
|---|---|---|
| Approved Scanning Vendor (ASV) | Runs the quarterly external vulnerability scans required by 11.3.2 | An ASV company you engage |
| PCI Professional (PCIP) | Holds an individual credential showing knowledge of PCI DSS; not an assessor | Anyone, often internal staff or consultants |
| PCI Forensic Investigator (PFI) | Investigates suspected account data compromises | A PFI company, engaged under card brand rules after an incident |
| Qualified Integrator and Reseller (QIR) | Installs, configures and supports payment applications for merchants | An integrator you engage |
| P2PE and software assessors | Validate products and solutions, such as P2PE solutions and payment software, for the Council's listings | An assessor company engaged by the vendor whose product is assessed |
The ASV relationship is the one to manage closely, because a missed quarter cannot be recovered. What makes a scan pass is covered in ASV scans: what passes and what fails.
Choosing a QSA company
Most QSA companies can assess most environments. The differences show up in how well they understand yours and how they run the engagement. Ask:
Who is the lead QSA, and will they stay for the engagement? Check that they appear on the Council's list.
What experience do they have with environments like yours? Cloud-native service providers, retail estates and call centers raise different questions.
How do they approach sampling? Ask how they choose samples of system components and business facilities, and how they document the rationale.
Have they assessed customized approach controls? If you plan to use the customized approach for any requirement, the assessor derives testing for it. Experience matters.
How do they handle evidence and remote work? Find out what they will examine in person, what remotely, and how evidence is exchanged and retained.
What does the timeline look like? Agree fieldwork dates, review cycles and the date the ROC and attestation will be delivered, against when your acquirer or customer needs them.
What happens if they find a gap? Ask how they handle requirements not in place during fieldwork, and whether there is time to remediate before the report is finalized.
Much of the good practice in working well with your auditor applies directly to a QSA engagement. One difference helps you prepare: a QSA follows the testing procedures printed in the standard and reports in the Council's ROC template, so you can read both before fieldwork starts.
Getting value from an ISA
Training an ISA is an investment, and it pays off when the role has real work attached to it.
Give the ISA ownership of scope. The annual scope confirmation under 12.5.2 is a natural fit, and it is where most assessment surprises start.
Run a readiness assessment before the QSA arrives. Use the ROC template or the SAQ as the checklist, and record findings with owners and dates.
Make the ISA the QSA's counterpart. One informed internal contact shortens every evidence request and every scoping discussion.
Keep the qualification current. ISAs must maintain their qualification with the Council. Plan for requalification as part of the role.
The PCI DSS framework page summarizes the requirements either assessor will test.
How TrustLynce helps
TrustLynce gives your QSA an auditor portal with evidence rooms, requests and findings in one place, so an ISA or compliance lead can track every open item. If you want help preparing for a first assessment, our audit readiness services include a dedicated advisor.