The wrong PCI DSS consultant costs money and can still leave card data exposed. The right one helps narrow scope and guides fixes so validation can proceed with less repeat work.
Is the consultant an active Qualified Security Assessor?
Start with credentials, but don’t stop there. A Qualified Security Assessor (QSA) is certified by the PCI Security Standards Council to perform formal validations. That status can lapse or be put on hold, so a logo on a website isn’t enough when a directory check takes only a minute. Ask for the QSA company name and the lead assessor’s name, then check both in the Council directory.
Credentials don’t equal fit.
Not every validation needs a QSA. Your acquirer and the payment brands set the validation path for your business. That path is often linked to merchant level and transaction volume, yet level alone doesn’t decide it. A small e-commerce merchant may self-validate with a Self-Assessment Questionnaire (SAQ) while a high-volume merchant needs a Report on Compliance (ROC). Ask the consultant which path fits your case and why. If you don’t need a QSA-led ROC, ask how they support SAQ work.
How will they scope your cardholder data environment?
Scoping strongly influences cost and effort. If the cardholder data environment is too wide, you test and document systems that don’t need to touch card data. A careful consultant maps how card data enters and leaves your network before they quote controls. Ask them to walk through your payment flows in the first call. Vague answers there are a red flag.
Good scoping also looks for ways to shrink what is in scope. Network segmentation can separate payment systems from office systems. Tokenization or hosted payment pages can remove card data from your servers. The discussion should cover what is in scope now. It should also identify what could be taken out of scope safely.
Ask for a diagram that shows each flow and each touchpoint. Without one, it’s hard to judge whether the scope is sound.
Do they find gaps or help fix them?
Some engagements end with a gap assessment and a list of control deficiencies, leaving the internal team to plan and implement fixes. That model may fit a business with sufficient security expertise. Others need more guidance, so clarify the division of work before comparing proposals.
Ask who writes the remediation plan and who stays involved during follow-up work. An engagement can cover scoping, gap assessment, remediation guidance, and support preparing the applicable ROC or SAQ and Attestation of Compliance. Confirm who prepares, signs, and submits each document. When comparing pci compliance services, including those offered by IS Partners, ask how remediation guidance is coordinated with assessment work. Define the responsibilities of internal teams and outside specialists rather than assuming implementation is included.
Also ask how they coordinate testing. PCI DSS includes penetration-testing and vulnerability-scanning requirements, with applicability and timing depending on the requirement. External vulnerability scans under Requirement 11.3.2 must use an Approved Scanning Vendor (ASV). Your consultant need not perform every test, but should explain responsibilities and how findings feed into remediation.
How hands-on is their PCI DSS 4.0.1 experience?
Ask about PCI DSS v4.0.1 and the v4 requirements, including targeted risk analyses for certain controls and the customized approach. These require careful application and documentation; the customized approach is not simply permission to bypass a prescribed control. Experience limited to the older 3.2.1 standard may leave gaps that affect your validation.
Don’t accept general claims of familiarity. Ask how many v4.0.1 validations they have led in the past year. Have them describe a targeted risk analysis they wrote and how they set the review frequency. Ask when they have used the customized approach and when they talked a client out of it. Clear answers show real practice. You want notes your team can reuse next year, not jargon that only the assessor understands. Hesitation may suggest they have read the standard but haven’t applied it.
What will you get, what will it cost, and who else have they helped?
Get the scope of work in writing before you sign. It should list interviews and the final reporting pack. There’s a gap between a short SAQ assist and a full ROC with on-site testing. Ask what is included in the fixed fee and what triggers extra charges. Retests and travel are common areas where budgets slip.
Ask for a work plan with milestones and owner names. You won’t get a firm date until scoping is done, yet a good consultant can describe phases. Late evidence and open remediation tasks often cause delays. A plan that names owners makes responsibilities clear on both sides. Ask what happens after the Attestation of Compliance is signed. Controls drift fast when patches pile up and staff change roles.
Last, ask for references you can check. You want merchants near your size and in a similar setup, such as retail or e-commerce work. Ask which SAQ types they handle most and how they work with acquirers when an Attestation of Compliance is questioned. An assessor who knows your model can spot odd card flows faster than a generalist who is still learning how your payments work on your time.
Pick the consultant who asks hard questions early. That habit can reduce rework later and help address card data risks beyond producing a clean report.
