> what if you're not eligible for a self-assessment If you're doing higher transaction volume and are not eligible for a self-assessment, you have to have a ce

> what if you're not eligible for a self-assessment If you're doing higher transaction volume and are not eligible for a self-assessment, you have to have a certified QSA sign off on an audit of the internal processes. The QSA will make sure that all the required systems and processes are in place and sign off on it. PCI is definitely a fairly frustrating thing to deal with but there are some good practices underlying it that many orgs would simply not do if it weren't required by their merchant processor.