PCIP · ISA · QSA
The PCI Security Standards Council runs the credentials that gate careers in payment-card security. The Payment Card Industry Professional (PCIP) is the entry-level qualification that proves you understand PCI DSS v4.0.1, while the Internal Security Assessor (ISA) and Qualified Security Assessor (QSA) tracks authorize you to actually run compliance assessments. Banks, acquirers, processors, and any company that stores, processes, or transmits cardholder data lean on these qualifications — and a single failed attempt can stall a QSA company onboarding or block an internal audit team. This page breaks down each exam, how it's delivered through Pearson VUE, and how to pass it the first time.
Pay Only After You Pass
No upfront fee — you settle only after your verified passing result. We advertise guaranteed results — 100% pass guaranteed or money back.
Every credential the Council runs through Pearson VUE — and who each one is for
| Qualification | Code | Who it is for | Authorizes assessments? |
|---|---|---|---|
| PCI Professional | PCIP | Entry-level — anyone, no sponsorship required | No |
| Internal Security Assessor | ISA | Staff assessing their own employer; needs sponsorship | Internal only |
| Qualified Security Assessor | QSA | Assessors at an approved QSA company | Yes — for other organizations |
| Point-to-Point Encryption QSA | QSA (P2PE) | QSAs assessing P2PE solutions and applications | Yes — P2PE scope |
| Payment Application QSA | PA-QSA | QSAs validating software against the SSF / PA-DSS legacy | Yes — software scope |
| Software Security Assessor | SSA | Assessors validating against the Secure Software Standard | Yes — software scope |
| PCI Forensic Investigator | PFI | Investigators handling cardholder-data breaches | Investigations only |
PCIP stands alone as an individual credential you can pursue on your own. Every assessor qualification (ISA, QSA, and the specialized QSA tracks) builds on a shared PCI Fundamentals base, requires Council-run training, and — for QSA roles — must be sponsored by an approved assessor company or by your own employer. All of these exams are scheduled and delivered through Pearson VUE.
The PCIP draws from the PCI DSS v4.0.1 knowledge domains — bars show the rough emphasis you should plan around
The twelve core PCI DSS requirements — building secure networks, protecting stored cardholder data, encryption in transit, access control, logging and monitoring, and maintaining a security policy. The bulk of the exam lives here.
Cardholder data versus sensitive authentication data, the cardholder data environment (CDE), segmentation, payment-brand roles, merchant levels, and the precise PCI vocabulary the questions hinge on.
How compliance is validated and reported: SAQs, the Report on Compliance (ROC), Attestation of Compliance (AOC), the roles of QSAs and ISAs, and the supporting standards like PIN, P2PE, and the Secure Software Framework.
PCIP questions are heavily scenario- and definition-driven. Many candidates who know security in general still trip on PCI-specific wording — the difference between "do not store" and "render unreadable", which requirement covers anti-malware versus secure development, or which validation document a Level 1 merchant must file. The exam rewards precise recall of the standard, not gut instinct.
Two ways to sit a PCI SSC exam — and exactly what OnVUE expects on test day
You sit the exam in a quiet, monitored room at a Pearson VUE center. Staff verify your government-issued ID, store your belongings in a locker, and watch the room. ISA eLearning candidates in particular often take their qualification exam at a local Pearson VUE center after the course.
You take the exam from a private room at home or office, monitored by a live proctor through your webcam via OnVUE. You run a system test in advance, install the OnVUE secure browser, and the exam must be scheduled and completed within 30 days of receiving your scheduling information — in one uninterrupted sitting.
Arrive early to check in. You photograph a valid government photo ID and your testing area, and the proctor verifies your name matches your registration before unlocking the exam.
A clear desk, no second monitor, no phone or notes within reach, and a 360-degree webcam scan of the room. No one else may enter; talking aloud or leaving the frame can void the session.
The OnVUE browser locks down your machine — no other apps, no breaks for PCIP's 90 minutes, no scratch paper unless provided digitally. Your result appears as soon as you submit.
PCI qualifications gate roles across the payments ecosystem
PCIP is open to all — the assessor tracks are gated
Difficulty: The PCIP looks approachable at 75 questions, but the 75% bar is unforgiving — you can only miss about 18 questions. The standard is dense and the wording is deliberately exacting, so candidates who skim the requirements and rely on general security knowledge routinely fail. The assessor exams add reporting nuance and assessment procedures on top. That precision-under-time pressure is exactly the pain point our help removes.
PCIP and the assessor exams are precision tests of a long, exacting standard, delivered under a locked-down OnVUE session with a hard 75% bar. Exam Assist pairs you with a vetted PCI specialist and works on a pay-after-you-pass model — so the risk sits with us, not you. No upfront fee, guaranteed results: Exam Assist handles the sitting end to end, and you settle only after the verified result.
Tell us which qualification (PCIP, ISA, QSA, or a specialized track), your delivery method (center or OnVUE), test window, and timeline. Takes a couple of minutes over WhatsApp, Telegram, or Discord.
We review your qualification, the 30-day scheduling window, and your starting point and tell you plainly whether it's realistic — before any money is discussed. If it isn't a fit, we say so.
Exam Assist handles the sitting end to end. You're matched with a PCI DSS specialist who maps the work around the v4.0.1 requirements, the validation vocabulary, and the OnVUE check-in environment — discreetly and confidentially.
You only pay once your passing result is confirmed. No verified result, nothing owed.
Pay-after-you-pass support for vendor-neutral security and IT certification exams delivered through Pearson VUE.
Sister support for governance and audit credentials like CISA and CISM — the same results-first arrangement.
Worried about remote-proctored check-in and lockdown rules? Understand how proctored online exams work.
Tell us which exam you're sitting and get an honest feasibility answer — no upfront fee.
Straight answers about the PCIP and PCI SSC assessor exams
Service and sibling cybersecurity exams
Pair with a vetted specialist on a results-first arrangement. No upfront fee — settle only after a verified passing result.
Explore the service Security+The vendor-neutral baseline security certification — a common companion to PCI knowledge for compliance roles.
View exam CISAThe information-systems audit credential — natural next step for ISA and QSA assessors building an audit career.
View exam CISMSecurity management certification for professionals who oversee compliance programs, including PCI DSS scope.
View exam PenTest+Hands-on penetration testing certification — relevant for the testing requirements PCI DSS mandates on the CDE.
View examGet expert PCIP and assessor-exam help with no upfront fee — you settle only after your verified passing result. Honest feasibility answer first, results-first arrangement always.