Documentation needed from QuickBooks for PCI Compliance

For PCI DSS compliance documentation, the right team to contact is SecurityMetrics. They can provide the formal written TPSP responsibility agreement (12.8.2) and the security incident response contact information (12.10.1) that your SAQ-A requires.

They are Intuit's dedicated PCI compliance partner and are specifically equipped to help QuickBooks Payments merchants navigate SAQ-A requirements, including what documentation Intuit can provide to satisfy requirements 12.8.2 and 12.10.1. You can visit this link: www.securitymetrics.com/pcidss/intuit.

You should also keep a record of all correspondence, as your PCI auditor may want to see the communication trail alongside the documentation provided.

For more information and SecurityMetrics' contact number, refer to this article: Learn about QuickBooks PCI DSS Compliance Services.

Let us know if you have any other concerns.

Hi user2026,

You are entirely correct to push back on this. SecurityMetrics is a third-party compliance vendor Intuit partners with, but you are not obligated to buy their paid portal packages to validate your self-assessment. PCI DSS is a self-assessment standard, and because your card processing is fully hosted by QuickBooks Payments, you can satisfy these exact requirements directly using official Intuit documentation:

1. Requirement 12.8.2 (Written TPSP Agreement)

Auditors and merchant banks accept the published Intuit Payments Merchant Agreement alongside Intuit's Attestation of Compliance (AoC) to meet this control:

• In the standard Intuit Payments Merchant Agreement (under the Data Security and PCI Compliance sections), Intuit contractually binds itself as a Level 1 Service Provider and accepts responsibility for protecting cardholder data that it stores, processes, or transmits on your behalf.
• You can pair this clause with Intuit's current Level 1 Service Provider Attestation of Compliance (AoC), which is freely downloadable from Intuit's Security Center.
• In your SAQ documentation folder, cite that specific section of the Intuit Merchant Terms of Service as your written agreement, and attach the AoC as evidence.

2. Requirement 12.10.1 (Incident Response Strategy)

This requirement specifies that your internal Incident Response Plan (IRP) defines roles and communication paths if a breach occurs:

• In your IRP documentation, list Intuit Merchant Services Security and Fraud Operations as your primary Third-Party Service Provider escalation point.
• Note in your plan: "If an incident involves cardholder data processed through QuickBooks Payments, immediate notification will be submitted via the Intuit Security Center escalation form and Merchant Support, followed by notification to our acquiring bank."

Submitting Your SAQ A Once your SAQ A document and Attestation of Validation (AoV) are completed, you can submit them directly to your merchant acquiring bank or keep them on file for your annual compliance audit trail rather than paying a third-party vendor portal