Which document must a QSA provide to their client at the start of the assessment?

The document that a QSA must provide to their client at the start of the assessment is the assessment plan. The assessment plan outlines the scope, timeline, and methodology for the assessment process. It sets clear expectations for both the QSA and the client, detailing what will be reviewed, how the assessment will be conducted, and when it will be completed. An assessment plan ensures that both parties are aligned on the objectives and processes, which is crucial for a successful evaluation and compliance verification.

Providing the assessment plan at the beginning helps to establish a framework for communication and collaboration throughout the assessment process. It ensures that any required documentation, systems, and personnel needed for the assessment are prepared in advance, facilitating an effective evaluation of the client's compliance with PCI DSS requirements.