QSA (Qualified Security Assessor)
An auditor certified by the PCI council to assess PCI DSS compliance, whose signature is what acquirers and card networks actually look at.
A QSA works for an approved assessment firm and is certified by the PCI Security Standards Council. The largest merchants, in Visa's tiering those with more than six million card transactions a year, and most payment service providers need an on-site assessment every year. The output is a Report on Compliance (ROC) in which every requirement must be backed by evidence. Large companies can instead train in-house assessors, known as ISAs.
A certificate only describes the day the assessment took place. Heartland Payment Systems had been signed off shortly before Albert Gonzalez and his associates drained more than 100 million card numbers from it in 2008, and Target was certified ahead of its 2013 breach. The industry's response has been to stress that compliance is a continuous state. The audit is still annual.