QSA vs ISA vs ASV: Who Does What in a PCI Assessment

Official Definitions

• QSA (Qualified Security Assessor): QSA companies are qualified by PCI SSC to validate an entity's adherence to PCI DSS requirements (see QSA Qualification Requirements).
• ISA (Internal Security Assessor): An individual who meets PCI SSC ISA qualification requirements and assesses their own sponsoring organization. The program improves internal self-assessment quality and QSA interaction. Qualification is employer-specific.
• ASV (Approved Scanning Vendor): A company approved by PCI SSC to conduct external vulnerability scanning services (ASV scan solution) validating the external scanning requirements of PCI DSS Requirement 11.3.2.

Side-by-Side

How CyberSilo Helps

• Continuous evidence so QSA/ISA fieldwork is faster
• Integrate ASV and TEM findings into remediation workflows
• CSA maps controls QSAs sample

Frequently Asked Questions

Can my IT team run the quarterly external scan instead of an ASV?

No for Requirement 11.3.2 - external scans must be completed by a PCI SSC Approved Scanning Vendor. Internal scans under 11.3.1 follow different rules.

Does an ISA make us Level 1 ROC-ready without a QSA?

Brand and acquirer rules decide the validation method. ISAs strengthen internal capability; ROC validation still typically requires a QSA when a ROC is required.

Are QSA and ASV the same listing?

No. They are separate PCI SSC programs and directories.

Related PCI Resources

ROC and AOC · ASV scans · Requirement 11 · SAQ types · PCI hub