Overview
A Qualified Security Assessor (QSA) is an individual whom the PCI Security Standards Council has qualified to perform PCI Data Security Standard assessments. It can't be earned alone. The candidate must be a full-time employee of a QSA Company, hold one information security certification and one audit certification from the Council's approved lists, and have at least 1 year of experience in each of application security, information systems security, network security, IT security auditing, and information security risk assessment or risk management.
QSA Employees perform PCI DSS assessments for merchants and service providers through their QSA Company, which may work only in the regions or countries it's qualified for. The qualification lasts 12 months. Each year the assessor completes requalification training and an exam, and must be trained on the version of PCI DSS they assess against. Accepted prerequisites include CISSP, CISM, and ISO 27001 Lead Implementer on the information security list, and CISA, GSNA, ISO 27001 Lead Auditor, IRCA ISMS Auditor, and the IIA's CIA on the audit list, so the QSA usually sits on top of those certifications rather than beside them.
What the exam covers
The Council does not publish weighted exam domains for the QSA. The qualification is built from these training and exam stages.
| Part |
|---|
| PCI Fundamentals prerequisite course, about 8 hours online, followed by a 40-question multiple-choice exam (75% to pass, 2 attempts) |
| QSA instructor-led training over 2 days, in person |
| New QSA exam, 60 multiple-choice questions in 90 minutes, on the afternoon of day 2 |
| Annual requalification exam, 50 multiple-choice questions in 75 minutes, non-proctored and remote |
Requirements
At least 1 year of experience in each of 5 disciplines: application security, information systems security, network security, IT security auditing, and information security risk assessment or risk management. The candidate must also be a full-time employee of a validated QSA Company.
- Format
- Multiple-choice written exam at the end of the QSA training course
- Questions
- 60
- Time
- 90 minutes
- Passing score
- 75%
- Delivery
- In person, on the second day of instructor-led QSA training
Candidates must hold at least one certification from List A (information security, for example CISSP, CISM, ISO 27001 Lead Implementer) and one from List B (audit, for example CISA, GSNA, ISO 27001 Lead Auditor, IRCA ISMS Auditor, CIA), complete the PCI Fundamentals prerequisite, and sign the PCI SSC Code of Professional Responsibility.
Cost
Exam fee: USD 3,600 for new QSA training, which includes the exam. Fee from the PCI SSC QSA qualification page, checked 2026-10-12. The Council lists fees in US dollars, company-level program and regional fees are separate, and prices change.
Keeping it current
- Cycle
- 12 months (annual requalification)
- Continuing education
- 20 CPE hours a year and 120 over a rolling 3-year cycle, per the PCI SSC CPE Maintenance Guide. QSA Employees who show 2 active industry-recognized certifications at requalification don't report CPEs to the Council for that year.
- Fees
- USD 2,200 annual requalification training (USD 2,900 for the Japanese-language offering)
How to verify that someone holds it
Anyone can search the Council's Verify a Professional tool by last name and first initial, or by certificate number, to see a QSA's status. The QSA Companies list shows which firms are qualified and where. Use the issuer’s verification page.
On InfoSecHub, a QSA listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.
In Canada
PCI SSC qualifies QSA Companies by region or country, so organizations in Canada can check the Council's QSA Companies list for firms authorized to assess there.
Typical roles
- PCI DSS assessor
- Security auditor
- Payment security consultant
- Compliance assessor
Related frameworks
Official resources
From PCI Security Standards Council. Links open the issuer’s site.
- QSA official page, PCI Security Standards Council
- QSA Program Guide, version 3.0, PCI Security Standards Councilhandbook
- Verify a professional, PCI Security Standards Councilverification
- Qualified Security Assessor Companies, PCI Security Standards Councilverification
References
- Qualified Security Assessor (QSA) qualification, PCI Security Standards Council
- QSA Program Guide, version 3.0, PCI Security Standards Council
- Continuing Professional Education (CPE) Maintenance Guide, version 2.0, PCI Security Standards Council
- Digital badges, PCI Security Standards Council
Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the PCI Security Standards Council website before you register. InfoSecHub is not affiliated with PCI Security Standards Council.