[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-202504-en":3,"doc-seo-202504-105":30,"detail-sidebar-cat-0-en-105":89},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},202504,16904993612988,"Olivia Brown","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",4,"Exam","Qualified Security Assessor (QSA) Industry-Recognized Professional Certifications - Frequently Asked Questions","An FAQ explains the PCI SSC change to the Qualified Security Assessor (QSA) industry-recognized professional certification requirement. It clarifies that QSA employees must progress from one to at least two certifications: one information security and one IT audit, effective for new hires in January 2019 and for existing employees by July 2019. The FAQ lists acceptable information security and audit certification options, provides timing and rationale, and outlines how QSA staff report the second certification through the PCI portal, while noting Associate QSAs are not subject to these requirements.","Frequently Asked Questions (FAQs) for Qualified Security Assessor (QSA) Requirement for Industry-Recognized Professional Certifications  \nAugust 2017  \nA QSA Company is a data security firm certified by the PCI SSC to perform PCI Assessments for clients to ensure that robust policies and procedures are in place to protect cardholder data. QSA employees are individuals who are employed by a QSA Company and have satisfied and continue to satisfy all QSA Requirements.  \nIn 2019 the PCI SSC will increase the industry-recognized professional certifications requirement for QSAs from one industry certification to a minimum of two: one information security and one IT audit certification.  \nThe change is part of the initiative announced in March 2017 to evolve the QSA Program to attract new cyber talent globally and ensure its sustainability and quality in a changing payment environment.  \nQ 1 What is the change being made to the QSA requirement for industry-recognized  \nprofessional certifications?  \nA The current QSA Qualification Requirements stipulate that QSA employees must hold either an information security certification or an audit certification. The PCI SSC is increasing this  \nrequirement to stipulate that QSA employees must have a minimum of two industry certifications: one information security and one IT audit certification.  \nThe new industry certifications requirement will be effective 1 January 2019 for new QSA employees. For QSA employees qualified and added to the PCI SSC website prior to 1 January 2019, this requirement will be effective 1 July 2019 (for example, upon annual requalification after 30 June 2019).  \nQ 2 Why is the PCI SSC changing this requirement?  \nA This change comes as part of the PCI SSC initiative announced in March 2017 focused on evolving the PCI QSA Program to attract new cyber talent globally and ensure its sustainability and quality in a changing payment environment.  \nQ 3 What qualifies as an information security certification?  \nA Information security certifications must come from this list:  \nList A – Information Security  \n􀁸 (ISC)2 Certified Information System Security Professional (CISSP)  \n􀁸 ISACA Certified Information Security Manager (CISM)  \n􀁸 Certified ISO 27001 Lead Implementer  \nQ 4 What qualifies as an IT audit certification?  \nA IT audit certifications must come from this list:  \nList B – Audit  \n􀁸 ISACA Certified Information Systems Auditor (CISA)  \n􀁸 GIAC Systems and Network Auditor (GSNA)  \n􀁸 Certified ISO 27001, Lead Auditor, Internal Auditor  \n􀁸 IRCA ISMS Auditor or higher (e.g., Auditor/Lead Auditor, Principal Auditor)  \n􀁸 IIA Certified Internal Auditor (CIA)  \nQ 5 When is this change effective?  \nA The new industry certifications requirement will be effective 1 January 2019 for new QSA employees. For QSA employees qualified and added to the PCI SSC website prior to 1 January 2019, this requirement will be effective 1 July 2019 (for example, upon annual requalification after 30 June 2019).  \nWhile QSAs have until 2019 to achieve a minimum of two industry certifications, the PCI SSC encourages QSA Companies not to delay in ensuring their QSA employees will be able to meet this updated qualification requirement.  \nQ 6 How long do existing QSA employees have to obtain this second industry certification?  \nA For QSA employees qualified and added to the PCI SSC website prior to 1 January 2019, this requirement will be effective 1 July 2019 (for example, upon annual requalification after 30 June 2019).  \nQ 7 Why is this change being introduced now?  \nA The PCI SSC is announcing the change now in order to provide companies and individuals with time to adapt to the change. The QSA Qualification Requirements document is being updated to reflect this change and will be available by the end of 2017.  \nQ 8 Is this change being made in response to QSA quality issues?  \nA This is not a change in response to specific QSA quality issues. It is part of the PCI SSC’s continued focus on ensur","cbCaidcdQPGzS41O","https://ap.wps.com/l/cbCaidcdQPGzS41O","pdf",197750,1,3,"English","en",105,"# Overview\n## Effective dates and rationale\n## Certification categories and accepted credentials\n## Reporting and scope","[{\"question\":\"What change is being made to the QSA requirement for industry-recognized professional certifications?\",\"answer\":\"QSA employees must hold at least two industry certifications—one information security certification and one IT audit certification—rather than qualifying with only one.\"},{\"question\":\"When does the updated certification requirement take effect?\",\"answer\":\"For new QSA employees, it takes effect on 1 January 2019. For QSA employees already listed on the PCI SSC website before that date, it takes effect on 1 July 2019 after annual requalification.\"},{\"question\":\"How do QSA employees alert the PCI SSC after achieving the second certification?\",\"answer\":\"They should log into the PCI portal and enter the required information in their consolidated statement page after earning the additional industry certification.\"}]","Qualified Security Assessor (QSA) Industry-Recognized Professional Certifications - Frequently Asked Questions | PDF",1788547533,8,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":84,"head_meta":86,"extra_data":88,"updated_unix":28},"qualified-security-assessor-qsa-industry-recognized-professional-certifications-frequently-asked-questions","",{"@graph":36,"@context":83},[37,52,66],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,50],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":21},"https://docshare.wps.com/document/exam/",{"item":51,"name":13,"@type":43,"position":11},"https://docshare.wps.com/document/qualified-security-assessor-qsa-industry-recognized-professional-certifications-frequently-asked-questions/202504/",{"url":51,"name":13,"@type":53,"author":54,"headline":13,"publisher":56,"fileFormat":59,"inLanguage":23,"description":14,"dateModified":60,"datePublished":60,"encodingFormat":59,"isAccessibleForFree":61,"interactionStatistic":62},"DigitalDocument",{"name":9,"@type":55},"Person",{"url":41,"name":57,"@type":58},"DocShare","Organization","application/pdf","2026-09-04",true,{"@type":63,"interactionType":64,"userInteractionCount":4},"InteractionCounter",{"@type":65},"ViewAction",{"@type":67,"mainEntity":68},"FAQPage",[69,75,79],{"name":70,"@type":71,"acceptedAnswer":72},"What change is being made to the QSA requirement for industry-recognized professional certifications?","Question",{"text":73,"@type":74},"QSA employees must hold at least two industry certifications—one information security certification and one IT audit certification—rather than qualifying with only one.","Answer",{"name":76,"@type":71,"acceptedAnswer":77},"When does the updated certification requirement take effect?",{"text":78,"@type":74},"For new QSA employees, it takes effect on 1 January 2019. For QSA employees already listed on the PCI SSC website before that date, it takes effect on 1 July 2019 after annual requalification.",{"name":80,"@type":71,"acceptedAnswer":81},"How do QSA employees alert the PCI SSC after achieving the second certification?",{"text":82,"@type":74},"They should log into the PCI portal and enter the required information in their consolidated statement page after earning the additional industry certification.","https://schema.org",{"og:url":51,"og:type":85,"og:title":13,"og:site_name":57,"og:description":14},"article",{"robots":87,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":90},[91,95,99,102,107,112,117,121,126,129,133],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":92,"show_sort_weight":93,"slug":94},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":96,"show_sort_weight":97,"slug":98},"Literature",80,"literature",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":100,"slug":101},70,"exam",{"id":103,"doc_module":4,"doc_module_name":46,"category_name":104,"show_sort_weight":105,"slug":106},5,"Comic",60,"comic",{"id":108,"doc_module":4,"doc_module_name":46,"category_name":109,"show_sort_weight":110,"slug":111},6,"Technology",50,"technology",{"id":113,"doc_module":4,"doc_module_name":46,"category_name":114,"show_sort_weight":115,"slug":116},7,"Healthcare",40,"healthcare",{"id":29,"doc_module":4,"doc_module_name":46,"category_name":118,"show_sort_weight":119,"slug":120},"Research & Report",30,"research-report",{"id":122,"doc_module":4,"doc_module_name":46,"category_name":123,"show_sort_weight":124,"slug":125},9,"Religion & Spirituality",20,"religion-spirituality",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":127,"show_sort_weight":124,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":46,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":46,"category_name":135,"show_sort_weight":103,"slug":136},19,"General","general"]