Sign in Apply for early access

Notes from the assessor's chair

Enpasse
A field of open circles seen from one point. Four lines run from that point to four circles, which are drawn solid and hatched: the questions an assessor's work brings into focus.

This blog covers the operational side of PCI assessment: how QSA firms run engagements, what changes when AI assists with drafting, and what it takes to stand behind a report long after it ships.

#What to expect

A few commitments about what you’ll read here:

01

#Written from practice

The questions come from assessor work, not from a content calendar: the consent conversation at scoping, the evidence that doesn’t support the claim, the QA pass that catches a determination drifting from its testing.

02

#Assessor-side only

Merchant and service-provider compliance is well covered elsewhere. We write for the firm performing the assessment: the people who examine the evidence, make the determinations, and sign off the report.

03

#Sources named

When a post leans on a PCI SSC document, we name the document and quote it precisely, starting with “Integrating Artificial Intelligence in PCI Assessments” (Guidelines v1.0, March 2025).

04

#No pitches

Articles are for working assessors first. Where Enpasse is relevant we say so plainly, and that’s the extent of it.

#Topics on the slate

  • Client consent for AI-assisted engagements.
  • What “suggested wording” means in day-to-day practice.
  • Treating AQM readiness as a record-keeping habit rather than a year-end project.
  • Human-in-the-loop QA that holds up to review.

If that’s your work, we hope this earns a place in your reading.

Enpasse