In response to the staggering increase in cybercrime, the Payment Card Industry Security Council (PCI SSC) was formed in 2006. It was the mission of this group to create a set of security requirements for online merchants. Their solution was the Payment Card Industry Data Security Standard (PCI DSS). This set of continually evolving requirements must be followed by all companies that accept credit card payments on the internet.

Why are they important? Let us take a moment to explain how selling on the internet actually works. When a company makes the decision to sell online, they must first obtain a merchant service account. These accounts are issued through banks and other financial institutions. But before any bank will issue a company an account, that company must prove that their website is PCI DSS compliant.

There are three ways for a company to prove that they are, in fact, compliant. The first is and most common validation tool is called a Self-Assessment Questionnaire (SAQ). Then there is the PCI SSC Validation Scan, which must be administered by an approved Scanning Vendor (ASV). Finally, there is the Qualified Security Assessors QSAs.

Because they are professionals with years of experience in the industry rather than a questionnaire or a simple scan, QSAs are often considered the most thorough and reliable option for companies that want to prove that they are PCI DSS compliant.

What do they do? QSAs typically begin by making certain that the company in question has correctly completed the two previous steps. That is, they will examine the SAQ as well as the results of the validation scan. Often, the QSA will choose to complete an additional Self-assessment Questionnaire, since there are several versions from which to choose.

If everything is in order, the QSA will give the company a certificate of compliance. This certificate can then be submitted to the banks along with the SAQ and the results of the PCI SCC Validation Scan.