PCI ISA and QSA Guide: Eligibility, Exams, Fees, Renewal

PCI DSS assessor qualifications are not open certifications: you cannot simply book an exam, because the PCI Security Standards Council (PCI SSC) only qualifies people sponsored by an eligible employer, and the qualification ends when that employment does. The two most common routes are the Internal Security Assessor (ISA), for staff of merchants and service providers who assess their own organisation, and the Qualified Security Assessor (QSA), for employees of independent QSA companies who assess clients and sign Reports on Compliance. This guide sets out what PCI SSC publishes about eligibility, the Fundamentals prerequisite, training, exams, fees, annual requalification and continuing education for both, then adds a preparation plan and career context. It is for internal auditors, compliance leads and security assessors considering either path, and for managers deciding whether to sponsor an ISA. Facts are from pcisecuritystandards.org pages and Council documents checked on 26 October 2026; fees and programme rules change, so confirm on the linked pages before enrolling.

Key takeaways

Your employer is part of the qualification. ISA candidates must be sponsored by their employer, and QSA candidates must be full-time employees of a qualified QSA company; neither qualification transfers when you change jobs.
The scopes differ. An ISA may assess only the sponsor company that employs them, while a QSA performs independent PCI DSS assessments for client organisations in the regions where their QSA company is qualified.
QSA entry is gated by certifications and experience. QSA candidates need one certification from List A (for example CISSP or CISM) and one from List B (for example CISA), plus at least one year in each of five security and audit areas; for ISAs, experience is recommended rather than required.
The new-candidate exams have the same shape. Both are closed book, 60 multiple-choice questions in 90 minutes with a 75% pass mark, after the online PCI Fundamentals course and exam.
Both requalify every 12 months. Each year brings requalification training and a remote 50-question, 75-minute exam at 75%; miss the window and you start again as a new candidate.

Who the certification is for

Aspect	Internal Security Assessor (ISA)	Qualified Security Assessor (QSA)
Employer	Sponsor company: a merchant, processor, service provider or other organisation required to comply with PCI DSS, which processes transactions with the public and has a dedicated internal audit function	A QSA company qualified by PCI SSC; the candidate must be a full-time employee
Who PCI SSC targets	Experienced internal auditors and internal security or risk assessment professionals at retailers, institutions, acquiring banks and processors	Assessors who conduct independent PCI DSS assessments for clients
What you can assess	Only the initiating sponsor company; qualification "may not entitle an ISA to perform special functions or conduct PCI DSS Assessments"	Client entities, within the regions or countries where the QSA company is qualified
Validation use	Whether a sponsor can use its ISAs for its own compliance validation is decided by each payment card brand	QSAs perform the assessments that lead to Reports on Compliance (ROCs)
Portability	Not transportable; ends automatically if employment with the sponsor ends	Tied to the QSA company; assessor employees may work for only one QSA company at a time

Choose ISA if: you work in internal audit, GRC or security at an organisation in scope for PCI DSS and want to run internal assessments, prepare evidence and act as the liaison with the external QSA. PCI SSC describes ISAs managing interactions with the QSA and recommending remediation.
Choose QSA if: you want a consulting or assurance career assessing many organisations. It needs an employer that is a QSA company, so the route usually starts by joining one, sometimes through the Associate QSA programme.
Consider PCIP or neither if: you need PCI DSS knowledge but will not assess. The Fundamentals course and the PCI DSS 4.0 Guide may be enough.

Exam format and domains

Item	ISA (new)	QSA (new)
Prerequisite	Online PCI Fundamentals course and exam before the class. PCI SSC pages describe the course as five hours in one place and eight hours in another. For QSA candidates, PCI SSC states the Fundamentals exam is 40 multiple-choice questions, 75% to pass, two attempts; the ISA page states three attempts
Training	Instructor-led in person or virtual, or self-paced eLearning with 90 days from payment to complete all components and the exam (via Pearson)	Two-day in-person instructor-led course with the written exam on the afternoon of day two, or virtual over two consecutive days of four-hour sessions
Exam	Closed book; 60 multiple-choice questions; 90 minutes; 75% to pass	Closed book; 60 multiple-choice questions; 90 minutes; 75% to pass
Results	In-person within 10 business days; on completion via Pearson	In-person within 10 business days
Failing	One retake within 30 days of the failure notice ($200)	The company's Primary Contact must register you for new QSA training again
Requalification exam	Every 12 months; non-proctored, remote; 50 multiple-choice questions; 75 minutes; 75% to pass

PCI SSC does not publish a weighted domain outline for either exam in the way CompTIA or ISACA do. The content is the PCI DSS standard and the assessment process: scoping and segmentation, the testing procedures for each requirement, sampling, the customised and defined approaches introduced in PCI DSS v4.x, compensating controls, and reporting in the ROC and Attestation of Compliance templates. Expect questions that test how you would validate a requirement, not just what it says. For the standard itself, PCI DSS v4.0.1 is the current version as published in the PCI SSC Document Library (from own knowledge; check the library for any newer revision).

Prerequisites and experience

QSA employee requirements

Employment: full-time employee of a QSA company; the company's Primary Contact enrols you through the PCI SSC portal. Registration closes 14 days before instructor-led training.
List A (information security): at least one of CISSP, CISM, ISO 27001 Lead Implementer or METI RISS. See the CISSP Certification Guide and the CISM Certification Guide.
List B (audit): at least one of CISA, GSNA, ISO 27001 Lead Auditor or Internal Auditor, IRCA ISMS Auditor or higher, or IIA CIA. See the CISA Certification Guide and the ISO 27001 Lead Auditor and Lead Implementer Guide.
Experience: at least one year in each of application security, information systems security, network security, IT security auditing, and information security risk assessment or risk management, shown on your CV.
Conduct: a background check, and signing the PCI SSC Code of Professional Responsibility at training. The QSA Qualification Requirements (v4.0) also require at least two qualifying certifications at annual requalification and bar an employee who fails a required exam from leading assessments until they pass.

Associate QSA

The Associate QSA (AQSA) programme is the Council's entry route into a QSA company. The QSA Qualification Requirements set eligibility as a university or college diploma in an information security or IT field, or at least two years' experience in one, with a background check and annual training. The QSA company must have been active for at least two years and provide a mentor who has been certified for at least three years and led at least three PCI DSS assessments resulting in ROCs for three different clients in that time; a mentor may oversee no more than three AQSAs at once.

ISA expectations

For ISAs, the ISA Qualification Requirements (v2.0) make experience and certifications recommendations rather than conditions: a degree, five years of applicable work experience and at least one certification such as CISSP, CISM or CISA. The current ISA programme page says registrants "must have significant relevant security audit and assessment experience" and recommends a minimum of five years. Candidates sign the ISA employee certification form when starting online training.

Preparation plan

Confirm eligibility first: for ISA, agree sponsorship with your employer and check it meets the sponsor criteria; for QSA, confirm your List A and List B certifications and that your CV evidences each of the five experience areas.
Read the standard end to end: PCI DSS v4.0.1 requirements and testing procedures, plus the glossary. Note every requirement where scope, sampling or frequency is defined by your targeted risk analysis.
Complete PCI Fundamentals early: it is a prerequisite, and its attempt limit means you should treat it as an exam, not a formality.
Work through real evidence: scoping diagrams, network segmentation tests, account and key management records. Identity requirements are where many findings sit: requirement 8 (identify users and authenticate access), including system and application accounts, and requirement 7 (restrict access by need to know). See the PCI DSS Readiness Checklist.
Practise reporting: draft a section of a ROC for one requirement using the current ROC template, including how you validated it.
Attend training and sit the exam: for eLearning ISAs, schedule the 90-day window so the exam lands before other commitments.
Diarise requalification: registration opens 90 days before expiry and exam access four weeks before; set reminders well ahead of both.

Cost, renewal and continuing education

Fee (USD, excl. VAT/GST/HST, checked 26 Oct 2026)	ISA	QSA
New training and exam	$4,000 (non-Participating Organisation); $2,000 (Principal or Associate PO)	$3,600
Requalification	$1,600 (non-PO); $1,350 (PO)	$2,200 ($2,900 Japanese)
Other	Exam retake via Pearson $200; class change $185	Class change $185
Company-level fees	Paid by the sponsor through the course fee	QSA companies also pay application, regional qualification and annual requalification fees per the PCI SSC Programs Fee Schedule

Annual cycle: both qualifications must be renewed every 12 months. Registration must be in by the expiry date (midnight ET for QSAs), and failing to register or pass in time means re-enrolling as a new candidate at the new-candidate fee.
Continuing education: a 2019 PCI SSC blog based on the CPE Maintenance Guide then in force set QSAs at 20 CPE hours a year and 120 per rolling three years, and listed no evidence submission for ISAs. The QSA Qualification Requirements v4.0 (March 2021) removed the requirement to submit CPEs to PCI SSC, and the ISA requirements recommend annual audit training. In practice, your List A and List B certifications carry their own CPE obligations, which keep you current. Check the current CPE page in the PCI SSC portal for the rule that applies to you.
Who pays: QSA fees are normally borne by the QSA company; ISA fees by the sponsor. Clarify repayment terms before you start, given the qualification does not leave with you.

Where it fits on the career path

ISA suits internal audit and GRC careers inside a merchant or service provider: it gives credibility with the external QSA, reduces dependence on consultants for readiness work, and pairs well with ISO 27001 and SOC 2 work. See the GRC Analyst Career Guide and the Internal Audit for Cybersecurity Guide. QSA is a specialist assurance career: assessors build broad exposure across many environments and often move into security architecture, audit leadership or compliance management. Because both qualifications are employer-bound, the lasting assets are the standard knowledge and the underlying certifications such as CISA and CISSP, which stay with you.

For a small merchant, sponsoring an ISA is rarely worth the cost if a self-assessment questionnaire is the validation route; for a large merchant or service provider with an annual ROC, an ISA can cut external assessment time and improve evidence quality. No salary claims are made here: PCI SSC pages read for this guide state none.

Common mistakes

Assuming ISA lets you sign your own ROC: PCI SSC leaves that to the payment brands; confirm with your acquirer before planning around it.
Missing the requalification window: a lapsed ISA or QSA restarts as a new candidate.
Studying requirements without testing procedures: the exams test how you assess, not only what the requirement says.
Under-scoping system and application accounts: assessors who treat requirement 8 as a human-user topic miss service accounts and keys. See the Human vs Non-Human Identity.

Practitioner checklist

Decide whether you need to assess (ISA or QSA) or only to understand PCI DSS (Fundamentals or PCIP).
For ISA, confirm your employer meets the sponsor criteria and agree sponsorship and repayment terms in writing.
For QSA, confirm one List A and one List B certification and evidence of each of the five experience areas.
Complete PCI Fundamentals early and treat its attempt limit seriously.
Study PCI DSS v4.0.1 testing procedures, the customised approach and the ROC template, not just the requirements.
Check with your acquirer or the payment brands how ISA work is accepted for your validation.
Set calendar reminders 90 days and four weeks before expiry for requalification.
Keep the CPE for your underlying certifications current and retain evidence.

PCI ISA and QSA Certification Guide: Exam, Prerequisites and Career Value