I’m being asked by external company called security metrics to confirm PCI metrics. Is this legit or not coming from outside QuickBooks?

Yes, John. Security Metrics is a legitimate partner of QuickBooks, providing services to help our clients validate and maintain PCI (Payment Card Industry) compliance.

If you accept credit card payments through QuickBooks Online Payments, you're required to validate PCI compliance. This compliance is essential to protect sensitive cardholder data, reduce the risk of fraud, and avoid costly penalties.

For more information about PCI compliance, refer to this article: Learn about the PCI DSS Compliance Services.

To help you recognize official Intuit communications and avoid phishing or scams, refer to this article: Identify suspicious activity, phishing scams, and potential fraud.

You can revisit this thread if you have additional questions.