Hello there, Stacy.
To clarify, QuickBooks has partnered with Security Metrics to provide a streamlined compliance validation process and associated services, which is why you are repeatedly prompted to purchase a package after completing the initial Self-Assessment Questionnaire (SAQ).
Merchants who complete SAQ and don’t handle cardholder data typically don’t need extra services under PCI DSS. However, QuickBooks Payments may still require merchants to purchase Security Metrics packages for two main reasons. First, these packages provide formal compliance certification and reporting, ensuring the merchant’s compliance is officially documented. Second, QuickBooks Payments may mandate additional monitoring to protect the security of its broader payment ecosystem, even if the merchant doesn’t directly handle cardholder data.
You can also check out this article to know more about PCI DSS Compliance Services: Learn about QuickBooks PCI DSS Compliance Services.
Let us know if you have additional questions or concerns. We're here to help.
