evident
Book a demo
Glossary

QSA (Qualified Security Assessor)

A QSA is a third-party auditor certified by the PCI Security Standards Council to conduct PCI DSS compliance audits and produce Attestations of Compliance (AOCs) for payment service providers.

Nate LeeCo-Founder, CEOPublished

QSA (Qualified Security Assessor) is an independent auditor certified by the PCI Security Standards Council to assess and certify organizations' compliance with PCI DSS.

QSAs are required for:

  • Service providers processing more than 300,000 transactions per year (Level 1 merchants)
  • Annual on-site audits for these high-volume organizations
  • Producing an Attestation of Compliance (AOC) and Report on Compliance (ROC)

Lower-transaction-volume merchants (Levels 2–4) can self-assess using a Self-Assessment Questionnaire (SAQ) without a QSA audit.

QSA audits are expensive and time-intensive, so most organizations focus on scoping the cardholder-data environment tightly to minimize what needs to be audited.