Our methodology

Exactly how we choose QSA companies, what we verify, how we label prices — and what we refuse to do.

Which firms get listed

A firm appears in our directory only if, as of our last check, it meets all three:

• It operates an active public website offering PCI DSS assessments — verified by a direct load check (HTTP 200), not a database scrape.
• It presents itself as a PCI QSA company (QSAC) — accreditation cross-checked against the PCI SSC’s QSA listings and Visa’s Global Registry of Service Providers.
• Its PCI assessment service is real and current — service pages describing assessments, not just a keyword on a services list.

What we verify — and what we don’t claim

For each firm we record headquarters, firm type, and the frameworks its own public materials say it supports. Directory facts were last verified in September 2026; we aim to re-check quarterly.

How we label every price

QSA fees are scoped per engagement, so firms almost never publish prices. Where we show a planning range, it always carries one of three labels:

None of these are quotes. Your fee depends on scope, locations, service providers, readiness, and the QSA’s brand. Treat every band as a planning figure and get scope and fee in writing.

Timelines

Where shown, the “fieldwork window” is the QSA’s assessment phase once evidence is ready — not the full engagement. Scoping, gap work, and remediation add weeks to months. Vendor marketing timelines don’t count.

What we will never do

• No star ratings or review scores. We have not hired these firms’ clients and won’t compress fit into a number.
• No testimonials. Every quote-like line on this site would be fabricated — so there are none.
• No pay-for-rank. Ever. Firms cannot pay to be listed, ranked higher, recommended, or have a profile softened. Some directories sell “featured” placement; we don’t sell placement at all.
• No invented statistics. Every number on this site has a clickable source or a clear “planning estimate” label.

How we make money

When you request quotes, matched QSA companies may pay us a lead or referral fee. That payment cannot change which firms we list, what our guides say, or which firms we recommend — the firewall is absolute, and firms can’t buy their way around it.

Corrections

Wrong price, stale fact, firm missing? Tell us. We check corrections against the firm’s own public materials and note material fixes on the affected page with a date.

Verification log

This log is append-only: new entries go on top, old entries are never silently rewritten. Row-level: firm name, URL, HTTP status, date checked.