PCI DSS Assessments
PCI Assessments from a Qualified Security Assessor
- QSA validation of Self-Assessment Questionnaires (SAQs), so your acquirer gets an independently reviewed submission
- Reports on Compliance (ROC) and Attestations of Compliance (AOC) for merchants and service providers
PCI Assessment services
- QSA validation of SAQs: we confirm you're on the right SAQ type, review your evidence, and sign off as your QSA
- Report on Compliance (ROC) and AOC: full QSA assessment against all applicable PCI DSS requirements
- Scope validation: we confirm your cardholder data environment (CDE) and any segmentation are correctly defined
- Clear findings: every gap documented, so you know exactly what needs to be addressed
Beyond PCI: additional assessments
The same assessment discipline we bring to PCI DSS, applied to healthcare, defense, and enterprise cybersecurity frameworks.
HIPAA Compliance
An assessment of how you protect electronic protected health information (ePHI) under the HIPAA Security Rule.
- Security Rule risk analysis
- Review of administrative, physical, and technical safeguards
- Prioritized remediation plan
For: covered entities and business associates
CMMC Readiness
A readiness and gap assessment for defense contractors preparing for Cybersecurity Maturity Model Certification (CMMC).
- Gap assessment against CMMC Level 1 and Level 2 requirements (NIST SP 800-171)
- SPRS score and self-assessment support
- Preparation for a C3PAO certification assessment
For: DoD contractors and subcontractors handling FCI or CUI
NIST CSF Assessment
A maturity assessment against the NIST Cybersecurity Framework (CSF) 2.0 to benchmark your program and plan improvements.
- Evaluation across all six Functions: Govern, Identify, Protect, Detect, Respond, Recover
- Current-state and target profiles
- Prioritized roadmap to close gaps
For: organizations of any size or industry
Do I need a QSA, or can I complete an SAQ on my own?
Your acquiring bank or the card brands set your validation requirements, usually based on your transaction volume. Many merchants are eligible to self-assess using an SAQ, but some acquirers require a QSA to review and validate the SAQ, and larger merchants and service providers typically need a full Report on Compliance (ROC) completed by a QSA. We can help you confirm what applies to you.
Which SAQ applies to my business?
It depends on how you accept and process card payments. SAQ types include A, A-EP, B, B-IP, C, C-VT, P2PE, SPoC, and D (for merchants or service providers). Choosing the wrong SAQ is one of the most common compliance mistakes, and confirming eligibility is part of every QSA validation we perform.
What does QSA validation of an SAQ involve?
We review your scope and payment flows, confirm your eligibility for the SAQ type, examine supporting evidence for each applicable requirement, and document any gaps for you to address. Once the SAQ is accurate and complete, we provide QSA sign-off on your Attestation of Compliance (AOC).
Can ASG help us prepare for our PCI assessment and then perform it?
No. As a QSA company, we keep consulting and assessment strictly separate. If we help you prepare, or build and manage your compliance program, a different QSA company performs your assessment. If ASG is your QSA, we evaluate your controls objectively and report our findings, but we don't design or implement the fixes. See our Services page for our preparation and consulting offerings.
What's the difference between a ROC and an SAQ?
An SAQ is a self-assessment completed by the organization, with or without QSA involvement. A ROC is a detailed assessment report prepared by a QSA after independently testing your controls against all applicable PCI DSS requirements. Both are accompanied by an AOC.
How often do I need to validate compliance?
PCI DSS compliance is validated annually. Many organizations also need quarterly external vulnerability scans by an Approved Scanning Vendor (ASV), along with the ongoing controls the standard requires throughout the year.
