Qualified Security Assessor

good thing, is it? You could get complacent with it because the other thing to bear in mind is that when the client puts together a customised validation, The QSA has to accept that that is a valid customized validation before they build testing procedures for it.

So if you have the same customized validation year on year and you move QSAs or you switch, you might find that new QSAs go, well, actually, this isn't good enough anymore.

And that's going to become an issue when you revalidate.

It's going to become an issue when you first do it because you've got to agree.