For most merchants, achieving and maintaining PCI compliance is a time-consuming process that distracts from the daily activities of growing the business. While PCI compliance is important and necessary, some business owners may be tempted to look for the cheapest solution out there that will check the compliance box and allow them to move on to the next thing. But like most things in life, you get what you pay for. If you don’t work with a Qualified Security Assessor (QSA), you are leaving your business, your customers and your brand exposed to a possible data breach and ultimately more expenses.
So what exactly do you get when you work with an QSA?
Knowledge
Your QSA will possess the network design experience and security training to conduct technically complex security assessments. The payment card technology environment, even for a small merchant, has evolved into a complex system that requires specific IT skills to ensure your security measures meet the ever changing PCI requirements.
Experience
Your QSA will have practical experience in each of the following disciplines: application security, information systems security, network security, IT security auditing and information security risk assessment or risk management. This isn’t your college-age nephew serving as your in-house “IT guy.” A QSA is a professional that brings real-world experience to deliver professional services to your store.
Certification
Your QSA will possess one or more industry-recognized professional certifications in Information Security (e.g. Certified Information System Security Professional (CISSP), Certified Information Security Manager (CISM)) and/or Security Auditing (e.g. Certified Information Systems Auditor (CISA), GIAC Systems and Network Auditor (GSNA)). These designations demonstrate a commitment to professional standards and continuing education that keeps him or her at the forefront of an ever-changing security landscape.
In addition, QSA professionals possess knowledge about the PCI Data Security Standards and all applicable documentation, attend annual QSA Employee training and adhere to the PCI SSC Code of Professional Responsibility.
Think of it this way… Your dentist may be qualified to work on your teeth, but you wouldn’t want him or her performing oral surgery. It’s a similar field, but a completely different type of qualification is required. The same holds true when deciding who to partner with to secure your payment card operations. Working with a QSA will give you peace of mind and allow you to focus on growing your business.
