I have another point I want to highlight (sorry but this matter is a really sore point for me and probably a lot of others too):

SecurityMetrics, as part of the process will scan one IP address at some point in the near future. If your IP address changes or you wish to add another IP address then they will charge you extra! My web servers are behind a web and DNS proxy and the root record is a flattened CName by Cloudflare, not to mention they are cached on 300+ Edge servers around the planet. Using a single IP address is going to be a bit limiting.

Another point, if anyone uses Shared/Retail webhosting, then their website is co-located on a server - does that mean you have to certify everyone on that server too?

These are all complex questions, if QB wants to enforce compliance, then it needs to provide comprehensive guidance prior to having to sign up with the likes of SecurityMetrics.