Who performs regular AQM audits of CPSA companies?

The PCI Security Standards Council (PCI SSC) is the global body that develops, manages, and maintains security standards and assessor qualification programs for the payment card industry. The Assessor Quality Management (AQM) program is a PCI SSC initiative specifically designed to ensure the quality, consistency, and performance of its certified assessor companies, which includes Card Production and Security Assessor (CPSA) companies. As the governing body for the CPSA program, the PCI SSC is solely responsible for conducting these regular AQM audits to validate that CPSA companies and their employees adhere to all program requirements and maintain the highest assessment standards.

A. Issuing banks are financial institutions that provide payment cards to cardholders; they do not oversee or audit the PCI SSC's certified assessor programs.

B. Payment brands (e.g., Visa, Mastercard) mandate compliance with PCI standards but delegate the management and quality assurance of assessor programs to the PCI SSC.

D. The term "Vendor" is too generic. The CPSA company is itself a vendor; the PCI SSC is the specific organization that performs the quality audit.

1. PCI Security Standards Council, Assessor Quality Management (AQM) Program Guide, Version 2.1 (October 2022):

Page 5, Introduction: "The PCI SSC Assessor Quality Management (AQM) Program defines the quality-assurance requirements and activities for all PCI SSC Assessor Companies..."

Page 6, Section "AQM Program Scope": Explicitly lists the "Card Production Security Assessor (CPSA) Program" as being within the scope of the AQM Program.

2. PCI Security Standards Council, Card Production Security Assessor (CPSA) Program Guide, Version 3.0 (June 2022):

Page 11, Section 3.5 "Quality Assurance": "PCI SSC maintains a quality-assurance program to ensure that all program participants perform their duties in a professional manner and in accordance with the requirements of the CPSA Program. PCI SSC performs an annual review of each CPSA Company..." This section directly states that the PCI SSC performs the quality assurance reviews.