PCI DSS QSA Services

ProCheckUp's PCI DSS QSA service supports merchants and service providers assessing payment security, defining scope and preparing the evidence for their validation route. Confirm the applicable route with your acquiring bank or payment brand before commissioning the assessment.

Discuss your PCI DSS assessment with an outline of your payment channels, current compliance position and deadline.

Choose the stage of support you need

• Initial scoping: map payment channels, cardholder data flows, connected systems, locations, suppliers and responsibilities. Establish what belongs in the assessment.

• Gap analysis and readiness: examine existing controls and evidence to identify what needs attention before the formal assessment.

• Consultancy: work through scope and evidence questions, and assess the implications of changes to the payment environment.

• Formal QSA assessment: evaluate the applicable requirements and supporting evidence, resolve findings and complete the reporting agreed for your validation route.

Payment scoping in practice

In our UK payment security consultancy case study, ProCheckUp helped a business clarify payment flows, assessment scope and an evidence pathway. An architectural change was identified that could reduce future scope. This illustrates a scoping decision, not a guarantee that every environment can reduce its obligations.

Who needs a QSA engagement?

Merchants accept card payments for their own business. Service providers may store, process or transmit payment data for others, or provide services that affect its security. An organisation can perform both roles. That distinction, the payment arrangements and the requirements of the relevant payment programme affect validation.

Do not choose a validation route from transaction volume alone. Confirm whether a Report on Compliance, an eligible Self-Assessment Questionnaire and the relevant Attestation of Compliance are required, and who receives them. Outsourcing payment processing does not automatically remove all responsibilities.

Check ProCheckUp Ltd in the PCI SSC Qualified Security Assessor directory and use the PCI SSC document library for current standards and reporting documents.

What to prepare

• Payment-flow and network diagrams, locations and an inventory of the systems involved.

• Details of payment service providers, hosting suppliers and shared responsibilities.

• Existing assessments, policies, configuration records and evidence of operating controls.

• A business owner and technical contacts who can explain the environment and coordinate remediation.

• The required validation route, reporting recipients, submission deadline and planned changes.

Assessment and reporting

Agree the assessment boundaries, evidence requests, interviews, technical checks and reporting responsibilities at the start. Evidence gaps and findings need to be addressed through the agreed process. Assessment completion depends on the evidence and results; a readiness review does not guarantee compliance.

The number of payment channels, locations, suppliers, connected systems and unresolved evidence gaps influences effort. Discuss dependencies and milestones before fixing a schedule. Maintaining controls remains the organisation’s responsibility after an assessment.

QSA assessment, ASV scans and penetration testing

• ASV scanning addresses external vulnerability scanning requirements. It is distinct from the wider QSA assessment.

• Penetration testing investigates exploitable weaknesses within an authorised scope. It does not replace the full PCI DSS assessment.

• Segmentation testing examines whether the agreed boundaries isolate the cardholder data environment.

• PCI compliance overview explains the wider payment security context.

Discuss your PCI DSS assessment

Discuss your PCI DSS assessment. Tell us whether you are a merchant, service provider or both, and the assessment decision you need to make. Share sensitive payment diagrams and evidence only through an agreed channel.