All - to make things a bit more clear; the PCI Security Standards Council (formed by the card brands) has established the PCI-DSS and related requirements for scanning and auditing. Currently some (not all) processors are requiring more than just an SAQ and/or reports from an Authorized Scanning Vendor such as McAfee. In the situations where a more complete certification is being required, a Qualified Security Assessor such as those found on the VISA or MasterCard web sites or at the PCI Security Standards Council web site must be used. Our company is an ISO partnered with Global Payments. Currently Global is requiring Site Certification (by QSA) of all merchants regardless of size and volume.
