A Qualified Security Assessor (QSA) is a person approved by the PCI Security Standards Council to audit merchants for compliance with the Payment Card Industry Data Security Standard.
The primary purpose of an individual holding the PCI QSA certification is to assess a firm that processes credit card data against the high-level control objectives of the PCI Data Security Standard (PCI DSS).
Consultants holding the QSA certification must recertify every year to make sure they are familiar with any changes in PCI DSS requirements and guidelines.
In Turkish, it can be translated as “Kalifiye Güvenlik Eksperi (Yetkilendirici)”.
How does a QSA assessment work in practice?
The assessment starts with scoping: the systems that store, process or transmit card data are identified. Then the requirements are tested one by one; documents, configurations and interviews are reviewed.
Gaps are closed with a remediation plan. If compliance is achieved, the QSA prepares the Report on Compliance (ROC) and the related attestation. The report is submitted to the payment brands or the bank.
The process is usually repeated once a year. Reducing the scope (for example, by using tokenization) significantly reduces both cost and time.
