Which of the following is NOT a responsibility of Payment Brands?

• A. Develop and enforce compliance program
• B. Offer training for QSAs, PA-QSAs and ASVs
• C. Endorse QSA, PA-QSA and ASV company qualification criteria
• D. Accept validation documentation from QSAs, PA-QSAs and ASVs

Answer: (B)

Payment brands oversee how PCI standards are applied and enforced. They’re responsible for developing and enforcing the overall compliance program and for accepting the validation documents (such as ROC and AOC) produced by QSAs, PA-QSAs, and ASVs as part of confirming a merchant or service provider’s PCI status. Training for QSAs, PA-QSAs, and ASVs, however, is handled by the PCI Security Standards Council and its approved training partners, not by the payment brands themselves. The qualification criteria for QSA, PA-QSA, and ASV companies are defined and maintained within the PCI SSC framework, in coordination with the brands, rather than being a training offering provided by the brands.