Choosing a Qualified Security Assessor (QSA) or an Approved Scanning Vendor (ASV) on price alone is how merchants end up with a scope that grows mid-assessment, a Report on Compliance (ROC) that their acquirer queries, or quarterly scans that keep failing on findings nobody disputes properly. Both roles are qualified by the PCI Security Standards Council (PCI SSC), but qualification does not show whether a firm understands your payment flows. This vendor-neutral guide covers how to use the PCI SSC listings, how to define what you need before asking for quotes, what drives cost, how ROC and Self-Assessment Questionnaire (SAQ) support differ, and how to judge an ASV's handling of scan disputes. It is for compliance leads, payment security managers and procurement teams at merchants and service providers. The standard itself is covered in our PCI DSS 4.0 Guide, and assessor careers in the PCI ISA and QSA Certification Guide.
Key takeaways
- Check the Council's lists every time. PCI SSC advises clients to check its QSA and ASV lists when engaging a firm, and a firm marked "In Remediation" has been found by the Council to have breached programme requirements.
- Your acquirer or the card brands decide ROC or SAQ. Confirm your validation route and the forms your acquirer accepts before you scope the engagement, because it changes who you need and how many days.
- Scope is the main cost driver. A QSA quote is only comparable once every bidder has seen the same cardholder data flow, segmentation design and list of service providers.
- Judge an ASV by its dispute process, not its scanner. Every ASV runs approved scanning; the difference shows when you need a false positive accepted or a compensating control recognised before the quarter closes.
- Keep the assessor independent. Separate the firm that signs your ROC from the people who designed or run the controls being assessed.
Define requirements
Settle these points internally, ideally with your acquirer, before inviting bids.
- Validation route: whether you must submit a ROC with an Attestation of Compliance signed by a QSA, or can self-assess with an SAQ. The payment brands and acquirers set which entities need which, not PCI SSC. See the PCI DSS SAQ Types guide for which SAQ fits which acceptance channel.
- Entity type: merchants and service providers are assessed against the same PCI DSS v4.0.1 requirements, but service providers carry extra requirements and customers will ask for their AOC. See the PCI DSS for Service Providers and Responsibility Matrix Guide.
- Scope picture: current data flow diagrams, the cardholder data environment (CDE) boundary, segmentation controls and their last test, and every third party that stores, processes or transmits account data or can affect its security. The PCI DSS Scoping and Network Segmentation Guide explains how to get this ready.
- External attack surface: every internet-facing IP address, domain and service in scope for quarterly external scanning under Requirement 11.3.2, including cloud load balancers and payment pages.
- Geography and language: QSA companies are qualified for specific regions, and the Council's list can be filtered by place of business, region and language. Multi-country estates need a firm qualified everywhere you operate.
- Approach choices: whether you intend to use the customised approach for any requirement, which needs targeted risk analysis and more assessor time. See the PCI DSS Customised Approach and Targeted Risk Analysis Guide.
Capability areas
| Need | Who provides it | What to confirm |
|---|---|---|
| Independent assessment and signed ROC and AOC | QSA company, through its qualified QSA employees | Firm listed for your region; the lead assessor is a current QSA employee (use the Council's professional verification lookup) |
| Readiness or gap assessment | QSA company or other consultancy | Whether the same team would later assess you, and how independence is handled |
| SAQ support | QSA company, internal ISA, or your own team | Whether your acquirer requires QSA involvement or a signature for your level |
| Quarterly external vulnerability scans (Req. 11.3.2) | ASV company using its PCI SSC approved scan solution | ASV listed and not In Remediation; staff who review results are ASV-qualified |
| Internal scans and penetration tests (Req. 11.3.1, 11.4) | Qualified internal staff or third parties; not reserved to ASVs or QSAs | Tester qualifications and organisational independence. See the Penetration Testing Provider Buyer's Guide |
Two points often surprise buyers. First, PCI SSC states that its qualification means only that a firm "has successfully met all PCI Security Standards Council requirements" to perform assessments, and that the Council does not endorse the provider's business processes or practices. Second, ASV qualification is individual as well as corporate: ASV employees must hold at least three years of information security experience, including one year in vulnerability scanning or penetration testing, and re-certify every 12 months.
Evaluation criteria
An illustrative weighting for a QSA engagement: 30% assessor team, 20% scoping approach, 15% technical fit, 15% commercials, 10% independence, 10% reporting and service. For an ASV, give the dispute process and support the weight that team experience carries for a QSA.
| Criterion | Strong answer | Weak answer |
|---|---|---|
| Listing status | Current on the PCI SSC QSA or ASV list for your region, no remediation status, checked by you on the day of award | Logo on a proposal with no listing you can find |
| Named assessor team | Lead QSA and team named, each verifiable as current; experience with your entity type, payment channels and hosting model | "A qualified assessor will be assigned" |
| Scoping method | Walks the data flow, challenges segmentation evidence, confirms third parties and their AOCs before quoting | Fixed quote from a questionnaire with no scoping call |
| Technical fit | Assessors who have tested cloud, containers, tokenisation, payment page scripts and service accounts in similar estates | Experience limited to on-premises card present environments |
| Commercials | Days broken down by phase: scoping, testing, interviews, sampling, report writing, QA, remediation validation | Single lump sum; remediation validation and AOC rework charged as extras |
| Independence | Clear separation between any consulting, managed service or product the firm supplies and the assessment | The team that built your controls also assesses them |
| ASV dispute handling | Documented dispute workflow, evidence types accepted, named reviewer, turnaround time, rescans included | Disputes handled by email with no timeline; rescans charged per attempt |
| Evidence handling | Encrypted evidence portal, named access, retention and deletion terms | Evidence emailed as attachments and kept indefinitely |
What drives cost
No official price list exists for either service. A QSA engagement is priced mainly on assessor days, which rise with the number of in-scope locations and system components, the number of payment channels, the number of service providers to review, sampling size, customised approach requirements and how ready your evidence is. ASV services are usually priced per IP address or target per year, with differences in how many rescans, how much dispute support and how many scan profiles are included.
ASV scan disputes
Requirement 11.3.2 needs passing external scans by an ASV at least once every three months, and the ASV Program Guide sets what counts as a pass. A vulnerability scored at CVSS 4.0 or above normally causes a failing result unless it is fixed or the ASV accepts a dispute. Disputes cover false positives, findings mitigated by compensating controls and components you believe are out of scope; the ASV decides, based on the evidence you supply. Ask each ASV to show its dispute form, the evidence it accepts (configuration exports, vendor advisories confirming a backport, compensating control descriptions) and how long a decision takes, because an unresolved dispute at quarter end means no passing scan for that quarter.
Where identity fits
Assessors spend a large share of their time on Requirements 7 and 8, including system and application accounts under Requirement 8.6. Ask how the QSA samples service accounts, API keys and cloud roles, and whether its staff can read cloud identity policies rather than relying on screenshots. Give the firm named, expiring accounts only. See the PCI DSS Requirements for Service Accounts and NHIs Guide (8.6).
Questions to ask vendors
- For which regions is your QSA (or ASV) company currently qualified, and has it ever been placed In Remediation by PCI SSC?
- Who exactly will lead and staff our assessment, can we verify each person on the Council's lookup, and how many assessments of our entity type have they led?
- What will you need from us to fix scope before you quote, and what happens to price if scope changes during fieldwork?
- How many days are allocated to each phase, and are remediation validation, AOC reissue and follow-up questions from our acquirer included?
- What other services does your firm sell us or might sell us, and how do you keep those teams separate from the assessment?
- How do you assess the customised approach, and what evidence of targeted risk analysis do you expect?
- (ASV) What does your dispute process look like, what evidence do you accept, who decides and how quickly? How many rescans are included per quarter?
- Where is our evidence stored, who can access it, and when is it deleted?
Red flags
- A firm you cannot find on the PCI SSC list for your region, or that shows a remediation status it did not disclose.
- An offer to "guarantee" a compliant ROC or passing scans before seeing your environment.
- A quote produced without a scoping discussion, or one that does not change when you add locations or channels.
- The same people offering to design, operate and then assess your controls.
- An ASV that rejects every dispute without explanation, or accepts disputes with no evidence at all.
- Pressure to declare systems out of scope without segmentation testing to support it.
Proof of concept
You cannot pilot a ROC, but you can test how a shortlisted firm works before you commit to a multi-year relationship.
- Verify listings and people: check each firm on the PCI SSC QSA or ASV list for your region and verify the named individuals.
- Run a paid scoping workshop: give each finalist the same data flow and segmentation pack and compare the questions they ask, the scope they propose and the assumptions behind it.
- Ask for a redacted deliverable: a sanitised ROC section or scan report shows how findings, sampling and evidence are recorded.
- Trial the ASV on one quarter: run the first quarterly scan, raise one genuine false positive and measure how the dispute is handled and how long it takes.
- Check acquirer acceptance: confirm your acquirer will accept the firm's AOC format and timetable.
- Agree exit terms: evidence deletion and handover of scan history.
Once appointed, track days from fieldwork end to signed AOC, number of scope changes after kick-off, quarters with a passing ASV scan on first attempt, dispute decision time, and repeat findings year on year.
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support for assurance services, including how machine identities and service accounts will be assessed. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: PCI DSS 4.0 Guide · PCI Approved Scanning Vendor Scans Guide · PCI DSS Readiness Checklist · SOC 2 Auditor Selection