Is your company required to demonstrate compliance with PCI standards such as PCI DSS and are you looking for the ideal Qualified Security Assessor (QSA) for your company? As one of the leading QSAs in Europe, we have compiled some quality characteristics that your QSA should definitely have.
Here are the top five qualities we believe a QSA should have to provide you with the best service:
Expertise
This is probably the aspect you look at first when selecting your QSA. Every compliance project is as individual as the people, processes and technologies in different companies. Experience shows that this is always accompanied by very unique challenges and starting points. Therefore, you should make sure that your QSA can provide you with a team of specialists with extensive PCI-relevant experience and qualifications. Ideally, it should also become clear during the initial contact with your QSA that IT security in your company is important to them as a whole - above and beyond proof of compliance.
Competence
It should be your QSA's own aspiration to deliver consulting and auditing services of the highest quality. Standardized tools, internal quality management, qualification and further training programs for employees - all these aspects should not be neglected by your QSA. Ask your QSA whether corresponding measures are implemented in his company and, if necessary, ask him to show you certificates, for example according to DIN EN ISO 9001. This way, you can be sure that your QSA is seriously committed to providing you with first-class services at all times. At some QSA companies, prospective auditors go through the PCI SSC's "Associate-QSA" (A-QSA) training program. This ensures that the QSA first builds an expertise before serving you as a project manager.
Transparency
Many companies initially perceive their PCI compliance proof as a small feat of strength. Among other things, this is probably due to the complexity of the various PCI standards, which initially confronts many a company with the questions of which certifications they actually need and how corresponding audits actually work. Get in-depth advice from your QSA on this and make sure that processes, deadlines and contributors, information and materials you need are clearly communicated to you. A good QSA will also keep communication channels open with you throughout the audit and keep you informed of any developments. Some QSA companies offer special ticketing tools, a more modern and efficient version of the traditional Excel lists.
Independence
Your QSA must not be tied to specific solutions, products or service providers, or even recommend them to you. Any consulting and audit activity should always be professionally sound, independent and based on the best solution for your business.
Partnership
Humanity and helpfulness should be values that your QSA places a high value on. After all, you place a high degree of trust in your QSA's auditors when you disclose your internal business processes and IT environments to them and have them audited. If your QSA acts first and foremost as your security partner who is there to advise you and help you effectively improve your IT security level, you have made a good choice.
About usd AG
Since 2004, we have been acting as an assessor accredited by the PCI Security Standards Council (PCI SSC) in all relevant standards of the payment card industry. Our team of around 20 PCI auditors is as diverse as our customers: We advise companies worldwide in twelve languages and certify them according to the security standards of the Payment Card Industry. As a centrally organized team that is in constant professional exchange with over 100 usd security experts, we deliver first-class results from a single source. The successful completion of your certification project is our top priority.
Do you need support with your PCI compliance project or would you like advice from our team? Contact us, we are happy to help.
