PCI DSS assessments for companies in the United States

There is no federal law that requires PCI DSS. The card brands require it through their contracts with acquiring banks, and acquirers pass that duty to merchants. A few states write card-security rules into law:

• Nevada (NRS 603A.215) requires data collectors that accept payment cards to comply with PCI DSS.
• Minnesota (Plastic Card Security Act, Minn. Stat. 325E.64) bars keeping full track data, card verification codes or PIN data after authorisation.
• Washington (RCW 19.255.020, from HB 1149 of 2010) lets card issuers recover reissue costs from processors, and from businesses processing more than six million card transactions a year, that failed to take reasonable care to protect card data.

Other rules often apply at the same time. The FTC Safeguards Rule covers non-bank financial institutions under GLBA. State privacy laws such as the CCPA set breach and data-handling duties. Healthcare merchants also fall under HIPAA. We map PCI DSS controls to these so one set of evidence serves several audits.

1. Check the PCI SSC QSA list. The company must be listed, and its listing must include the USA region.
2. Check the named assessors. Each QSA employee is listed individually by PCI SSC. Ask who will sign your ROC.
3. Match your entity type. Service providers and merchants have different ROC and SAQ paths. Ask for experience with your type.
4. Ask about independence. A QSA should not assess controls it designed or operates for you.
5. Ask about v4.0.1. The future-dated requirements became mandatory on 31 March 2025. Your QSA should explain how it tests them, including targeted risk analyses and the customised approach.
6. Ask how the work is delivered. Confirm remote and on-site arrangements and US time-zone availability before you sign.