17 PCI QSA companies, profiled
Every firm below is an accredited Qualified Security Assessor company with a load-verified website. Prices are planning estimates (September 2026) — QSA firms almost never publish fees — and every band carries its source label. Listings are not endorsements and cannot be bought.
Coalfire Systems
Coalfire is one of the largest QSA companies operating in North America. It is the named assessor on Amazon and AWS PCI DSS validations in Visa's Global Registry of Service Providers, and its published materials describe deep cloud-first PCI assessment work for SaaS and technology companies, including helping AWS develop its original shared-responsibility model.
Schellman
Schellman is a large assessment firm operating both a CPA practice and a QSA company, known for senior-led engagement teams and a strong reputation with regulated and enterprise buyers. It is frequently cited in industry coverage as a premium, independence-focused assessor.
A-LIGN
A-LIGN is a high-volume QSA company listed in Visa's Global Registry of Service Providers as the assessor of record for validated service providers. Its materials emphasize a technology-enabled assessment process and broad multi-framework coverage for mid-market and enterprise clients.
VikingCloud
VikingCloud is the successor to SecureTrust and Trustwave's compliance business. Industry coverage describes it as fielding one of the largest QSA teams in the world, with services spanning the full PCI lifecycle — from program development and gap analysis through the annual ROC assessment.
SecurityMetrics
SecurityMetrics is a PCI-focused QSA company whose published materials emphasize practical, deadline-driven assessments with strong communication. Its practice covers the full PCI spectrum — SAQ guidance, ASV scanning, penetration testing, and full ROC assessments — making it a common choice for companies doing PCI alongside other security work.
ControlCase
ControlCase is a QSA company built around managed compliance and automation. Its published materials describe an automation-first approach — continuous monitoring and a multi-framework evidence model — aimed at organizations that want PCI to run as an ongoing program rather than a once-a-year scramble.
KirkpatrickPrice
KirkpatrickPrice is an assurance firm with PCI DSS, SOC, ISO, HIPAA, and HITRUST practices. Its published materials emphasize a concierge-style client experience and flexible (fixed-fee or time-and-materials) engagement structures, positioning it as a specialist alternative to larger national practices.
BARR Advisory
BARR Advisory announced its accreditation as a PCI QSA company by the PCI Security Standards Council in January 2024 (Business Wire), adding PCI DSS to a practice that already covered SOC, ISO 27001, HITRUST, and CSA STAR. Its materials emphasize cloud-native clients and a consulting-led approach to compliance programs.
Prescient Assurance
Prescient Assurance is a security-led assurance firm founded in 2021, pairing audit teams with application-security and cloud experience. Its published materials emphasize startup-friendly, technology-driven engagements across PCI DSS, SOC 2, and ISO 27001.
Comparing firms? Tell us your scope once — get quotes from your shortlist. Free · 2 minutes · no obligation.
Get matched quotesSensiba
Sensiba is a top-75 U.S. accounting and consulting firm with a PCI DSS assessment practice alongside its SOC and ISO work. Its published materials emphasize flat-fee, remote-first delivery — national-firm credibility with a delivery model shaped for technology companies.
360 Advanced
360 Advanced provides audit and cybersecurity services across PCI DSS, SOC, ISO, HIPAA, and HITRUST, with integrated penetration testing. Industry coverage notes its responsiveness and strength in regulated industries, positioning it as a one-vendor option across several assurance tracks.
Truvantis
Truvantis is a cybersecurity consulting firm operating a PCI QSA practice. Its published materials describe assessment-led engagements for mid-market companies, with adjacent penetration-testing and security-advisory services that pair naturally with PCI remediation.
RSI Security
RSI Security is a cybersecurity compliance firm with a PCI QSA practice covering merchants and service providers. Its published materials describe assessment, advisory, and testing services aimed at mid-market organizations building multi-framework compliance programs.
NCC Group
NCC Group is a global cybersecurity firm headquartered in Manchester, UK, operating a PCI QSA practice across regions. Its published materials describe enterprise PCI assessments alongside deep penetration-testing and security-research capabilities — a natural fit for organizations that want the assessor to think like an attacker.
Foregenix
Foregenix is a payment-security specialist operating as a PCI QSA company, a PCI Forensic Investigator (PFI), and an Approved Scanning Vendor (ASV). Its published materials emphasize deep payments expertise — assessment, forensics, and testing from one payments-focused team.
VENZA
VENZA is a hospitality-industry security firm confirmed by the PCI Security Standards Council as an accredited PCI DSS v4 Qualified Security Assessor (announced 2025). Its published materials describe hospitality-specific PCI assessment work, security-awareness training, and v4 transition support for hotels and hospitality groups.
Wolf & Company
Wolf & Company is a regional CPA and advisory firm operating a PCI QSA practice alongside its SOC and HITRUST assurance work. Its published materials emphasize relationship-driven engagements for mid-market financial institutions and technology companies in the Northeast and beyond.
Startups & first-timers
First PCI assessment, small cardholder data environment, price-sensitive buyers. Boutique QSAs with the lowest planning ranges and fastest fieldwork windows.
| QSA company | Type | ROC planning range | Fieldwork window |
|---|---|---|---|
| SecurityMetrics | QSA company (QSAC) | $15K–$45K (planning estimate (Sept 2026)) | 4–8 wk |
| KirkpatrickPrice | QSA company (QSAC) | $15K–$40K (planning estimate (Sept 2026)) | 2–6 wk |
| Prescient Assurance | QSA company (QSAC) | $15K–$35K (planning estimate (Sept 2026)) | 2–6 wk |
| Truvantis | QSA company (QSAC) | $15K–$40K (planning estimate (Sept 2026)) | 2–6 wk |
| RSI Security | QSA company (QSAC) | $15K–$40K (planning estimate (Sept 2026)) | 2–6 wk |
Planning ranges are not quotes. See our methodology for how prices are labeled and verified.
Growth-stage teams
Scaling transaction volume and multi-framework needs. Credible ROCs for larger customers, acquirers, and partners.
| QSA company | Type | ROC planning range | Fieldwork window |
|---|---|---|---|
| Schellman | QSA company (QSAC) | $50K–$120K (planning estimate (Sept 2026)) | 6–12 wk |
| A-LIGN | QSA company (QSAC) | $40K–$100K (planning estimate (Sept 2026)) | 4–8 wk |
| VikingCloud | QSA company (QSAC) | $50K–$120K (planning estimate (Sept 2026)) | 6–12 wk |
| SecurityMetrics | QSA company (QSAC) | $15K–$45K (planning estimate (Sept 2026)) | 4–8 wk |
| ControlCase | QSA company (QSAC) | $25K–$70K (planning estimate (Sept 2026)) | 4–8 wk |
| KirkpatrickPrice | QSA company (QSAC) | $15K–$40K (planning estimate (Sept 2026)) | 2–6 wk |
| BARR Advisory | QSA company (QSAC) | $25K–$60K (planning estimate (Sept 2026)) | 4–8 wk |
| Sensiba | QSA company (QSAC) | $25K–$60K (planning estimate (Sept 2026)) | 4–8 wk |
| 360 Advanced | QSA company (QSAC) | $20K–$50K (planning estimate (Sept 2026)) | 4–8 wk |
| Truvantis | QSA company (QSAC) | $15K–$40K (planning estimate (Sept 2026)) | 2–6 wk |
| RSI Security | QSA company (QSAC) | $15K–$40K (planning estimate (Sept 2026)) | 2–6 wk |
| Foregenix | QSA company (QSAC) | $30K–$80K (planning estimate (Sept 2026)) | 4–8 wk |
| VENZA | QSA company (QSAC) | $20K–$50K (planning estimate (Sept 2026)) | 4–8 wk |
| Wolf & Company | QSA company (QSAC) | $25K–$60K (planning estimate (Sept 2026)) | 4–8 wk |
Planning ranges are not quotes. See our methodology for how prices are labeled and verified.
Enterprise buyers
Complex, multi-entity, or multi-region scope — or an acquirer or partner that expects a globally recognized QSA name on the ROC.
| QSA company | Type | ROC planning range | Fieldwork window |
|---|---|---|---|
| Coalfire Systems | QSA company (QSAC) | $60K–$150K+ (planning estimate (Sept 2026)) | 6–12 wk |
| Schellman | QSA company (QSAC) | $50K–$120K (planning estimate (Sept 2026)) | 6–12 wk |
| A-LIGN | QSA company (QSAC) | $40K–$100K (planning estimate (Sept 2026)) | 4–8 wk |
| VikingCloud | QSA company (QSAC) | $50K–$120K (planning estimate (Sept 2026)) | 6–12 wk |
| NCC Group | QSA company (QSAC) | $60K–$150K+ (planning estimate (Sept 2026)) | 6–12 wk |
| Foregenix | QSA company (QSAC) | $30K–$80K (planning estimate (Sept 2026)) | 4–8 wk |
Planning ranges are not quotes. See our methodology for how prices are labeled and verified.
Shortlist these firms, get competing quotes
One request reaches the QSA companies that fit your scope. Scoped quotes, free, no obligation.
How it works: tell us once (4 questions, 2 min) → we match accredited QSA companies to your size and scope → they send scoped quotes directly. Free, no obligation.