The PCI Security Standards Council writes payment security standards and qualifies the people and firms that assess them. It does not inspect your store, pick your questionnaire, or stamp your business as compliant. If you accept cards, match the Council program to the job in front of you. That job might be an outside assessment, an internal specialist, a vulnerability scan, an encryption review, or a forensic investigation. Managed IT services can help you gather the system facts before you hire one of those firms.
Talk with IGTech365 about this article
Send a note and we will reply from this page.
Talk through your payment security setup
What PCI Security Standards Council programs actually cover
The Council describes itself as a global forum that develops, stores, and shares security standards for account data. Its public About page says it does four kinds of work: it manages the standards, it validates and lists products and solutions, it trains and qualifies security professionals and organizations, and it publishes free guidance. Those four jobs are the whole of what a Council program can do for you.
A listing on the Council site means that firm or product met the program rules the Council published. It does not mean the Council reviewed your network, your staff, or the way you connected the product. Your acquiring bank or payment brand still tells you which validation you owe and by when. A qualified firm can perform the work. It cannot replace that instruction.
The Council’s own About page is the source for that role. Its training and qualification overview is the source for the program names below. For what the standard itself asks a small business to do, use the separate guide to PCI compliance requirements. This page stays on the hiring question.
Which program matches the job you have
Start with the job, not the acronym. Most businesses that accept cards only need two of these names in a normal year. You need someone who can run or support the assessment. When the bank requires it, you also need a firm that can run the external vulnerability scan. The other programs matter only when you sell a listed solution, produce cards, or suspect a compromise.
| Job in front of you | Council program | What that firm is qualified to do |
|---|---|---|
| An outside firm must assess your card environment. | Qualified Security Assessor (QSA). | Perform PCI DSS assessments of merchants and service providers. |
| Your own employee should run internal assessments. | Internal Security Assessor (ISA). | Improve internal PCI DSS self-assessments and work with the QSA. |
| The bank wants an external vulnerability scan. | Approved Scanning Vendor (ASV). | Run external scans against PCI DSS Requirement 11.3.2. |
| A vendor wants a point-to-point encryption solution listed. | P2PE Assessor. | Validate P2PE solutions, components, or applications. |
| You suspect card data was compromised. | PCI Forensic Investigator (PFI). | Help determine whether a compromise occurred and how. |
Read the middle column as a lookup, not a shopping list. Buying every line does not make the environment safer. Hiring the wrong line wastes the engagement, because each program is trained for one kind of work.
When you need a QSA instead of an internal ISA
A Qualified Security Assessor is an outside firm the Council has qualified to perform PCI DSS assessments of merchants and service providers. You bring a QSA in when your bank or brand requires an outside assessment, or when you want an independent firm to test whether your evidence would stand up. The QSA works from the standard and from the scope you and your acquirer agree. The QSA does not set that scope for the brand.
An Internal Security Assessor is different. The Council’s ISA program trains employees of sponsor companies so they understand PCI DSS, run better internal self-assessments, and work more cleanly with a QSA. An ISA is your person. An ISA is not a substitute for the outside assessor when the bank requires one.
Use this test before you hire:
- Ask the acquiring bank, in writing, whether this year’s validation is a self-assessment or an outside assessment.
- If it is a self-assessment, an ISA on staff can raise the quality of that work. A QSA is optional unless you want an outside review.
- If it is an outside assessment, hire a QSA company and confirm the person assigned is listed for that company.
- If you have both, let the ISA gather evidence and keep the QSA on the formal assessment. Do not ask the ISA to sign work the bank expects from a QSA.
Confirm the listing before you sign a statement of work. The Council’s qualified professionals overview points to the employee and company lookups. A proposal that says “PCI certified” without a current listing is not the same thing.
When the scan, the encryption review, or the investigator is the right call
An Approved Scanning Vendor is an organization with its own scan tools, qualified to run external vulnerability scans. The Council ties that work to PCI DSS Requirement 11.3.2, the external scanning requirement. Your IT team, your firewall vendor, or a general penetration tester can still test the network. They are not the ASV unless the firm is on the Council’s ASV list. If the bank asks for an ASV scan, the report has to come from a listed firm. A useful related read is how often a business should run penetration testing, which is a separate test from the ASV scan.
A P2PE assessor is a specialist for vendors, not a default hire for a merchant. The Council qualifies these firms to validate point-to-point encryption solutions, components, and applications so the vendor can be listed. If you only use a terminal or a hosted checkout, you do not hire a P2PE assessor to “get compliant.” Ask the vendor whether the solution is listed. Then confirm with your bank which responsibilities stay with you. Using a listed solution does not erase staff procedures, admin access, or exception handling.
A PCI Forensic Investigator is the incident role. The Council describes PFIs as the firms that help determine whether a cardholder-data compromise occurred, and when and how it may have happened. Call a listed PFI when your acquirer or brand tells you to, or when you have a credible sign that card data left the environment. Do not treat a PFI as the firm that writes your annual assessment. That job stays with the QSA or with your internal assessment. For the wider audit habit, see how a small business prepares for a cybersecurity audit.
See how managed IT supports the day-to-day work
What a Council listing does not decide for you
A current listing is a qualification check. It is not a promise about fit, price, or how the firm will treat your evidence. Three limits matter more than the logo on the proposal.
- The listing is not your scope. The Council qualifies the assessor. Your acquirer still decides which systems, locations, and channels are in the assessment. Hand the assessor a short description of each payment channel before they quote.
- The listing is not a product warranty. A validated payment application or a listed P2PE solution met the program rules for that product. Your configuration, your staff, and your other systems are a separate question. Ask what the listing covers and what it leaves with you.
- The listing expires as a qualification, not as a relationship. Programs such as the Payment Card Industry Professional credential are renewable. Before you rely on a named person, check that their qualification is current on the Council lookup, not only on last year’s proposal.
Other Council programs exist for narrower work. Card production assessors validate firms that produce cards. PIN assessors work against the PIN standard. Secure software assessors review payment software and its lifecycle. 3-D Secure assessors review the parties behind online card authentication. You do not need those names unless your business is in that line of work. Naming them here is only so a sales deck cannot blur them into “the PCI person.”
IGTech365 can help you prepare the operational facts. That includes which systems touch payments, who has admin access, and which vendors already send evidence. which systems touch payments, who has admin access, and which vendors already send you evidence. That preparation is managed IT and cybersecurity support. It is not a QSA opinion, an ASV scan, or a forensic finding. If a page on the site claims a qualification the Council listing does not show, treat the listing as the source.
How to check a firm before you sign
Do this before you book anyone, including a firm you have used before. Qualifications move, and the person on the kickoff call may not be the person who is listed.
- Write the job in one sentence. “Outside PCI DSS assessment,” “external vulnerability scan for Requirement 11.3.2,” or “forensic review after a suspected compromise.” If the sentence needs two jobs, you may need two firms.
- Look up the company and the person. Use the Council’s program listings. Match the company name on the proposal to the listed company. Ask which person will do the work and look that person up too.
- Ask what they will not do. A QSA should say they do not pick your validation path. An ASV should say the scan is not a penetration test and not a full assessment. A PFI should say they investigate a compromise. They should not sell you the annual assessment in the same breath.
- Bring your own channel list. In person, website, phone orders, and recurring billing. You do not need a finished data-flow diagram to hire. You do need enough detail that the quote is for your setup, not for a generic small business.
- Keep the Council’s instruction and the bank’s instruction separate. The Council tells you who is qualified. The bank tells you what you must submit. File both. If they seem to conflict, ask the bank, not the sales contact.
If the operational inventory is the part you cannot finish internally, that is the conversation to have with IGTech365 before you pay for an assessment you are not ready to evidence. Start from the common cybersecurity gaps that show up when a business has grown past its original payment setup.
Call IGTech365 at (866) 365-7798
Frequently asked questions
Does the PCI Security Standards Council certify my business?
No. The Council develops the standards and qualifies assessors, scanning vendors, and certain products. Your acquiring bank or payment brand tells you how your business must validate. A Council listing on a vendor is not a certificate with your company’s name on it.
Is a QSA the same thing as an ISA?
No. A QSA is an outside firm qualified to perform PCI DSS assessments. An ISA is an employee trained to improve that company’s own internal assessments and to work with a QSA. Use an ISA to strengthen internal work. Hire a QSA when an outside assessment is required or wanted.
Can my IT provider run the ASV scan?
Only if that provider is a listed Approved Scanning Vendor. An external vulnerability scan from a firm that is not on the Council’s ASV list does not satisfy a request for an ASV scan. General network testing can still be useful. It is a different deliverable.
Do I hire a P2PE assessor if I use encrypted terminals?
Usually no. P2PE assessors validate a vendor’s point-to-point encryption solution so it can be listed. As the merchant, you confirm the solution is listed and you confirm with your bank which duties remain yours. You do not hire the assessor to certify the terminal you already bought.
When should I call a PCI Forensic Investigator?
Call a listed PFI when you suspect cardholder data was compromised, and follow the instruction your processor or acquiring bank gives you. A PFI investigates the compromise. A QSA or your internal assessment still covers the ordinary validation work.
What to do before the first call
Write down every way a customer can pay you, then match one Council program to the job your bank actually asked for. Look the firm up on the Council site before you sign. If you want help getting the system list and the vendor evidence in order first, contact IGTech365 and bring that channel list to the call.