PCI QSA accreditation, explained.
Anyone can claim to do PCI assessments. Only firms accredited by the PCI Security Standards Council can sign your ROC — and accreditation expires every year. We explain how firms earn it, how they keep it, how to verify it in five minutes, and profile 17 accredited QSA companies. Free. Independent. No bought rankings.
Free · Independent · No bought rankings
How quote matching works
- Tell us once — 4 questions, 2 minutes, free.
- We match you — accredited QSA companies filtered to your size, scope, and timeline.
- QSAs quote you — they send scoped quotes directly; you pick.
We are a quote-matching service, not an assessment firm, and listings are not endorsements. How we vet firms and label prices →
How QSA accreditation works
Accreditation isn't a one-time badge — it's a lifecycle of earning, annual requalification, and the possibility of losing it. Understand the lifecycle and you understand what you're actually buying.
What QSAC means
The PCI Security Standards Council accredits companies — not just individuals — to perform assessments.
How firms earn it
Company requirements, qualified people, training and exams: what accreditation actually demands.
How firms keep it
Annual requalification, ongoing training, and quality review — accreditation expires every year.
How you verify it
The five-minute check every buyer should run before signing an engagement letter.
Verify before you sign
Five minutes on the PCI SSC listings and Visa registry beats any sales deck. Accreditation is annual — the firm that was accredited when you started researching may not be when you sign.
1. Check the PCI SSC listings
The Council's assessor listings are the authoritative register of accredited QSA companies.
2. Cross-check the Visa registry
Visa's Global Registry of Service Providers names the assessor on validated entities.
3. Get it in the engagement letter
Verbal assurance is worthless — the firm's accredited status belongs in writing.
Accreditation, explained honestly
How QSA Accreditation Works
Earning it, keeping it, losing it — the full accreditation lifecycle.
Verify a QSA Company
The five-minute buyer check: listings, registries, and engagement-letter proof.
What Is a QSA Company?
QSAC vs QSA vs ISA: who can sign your ROC and why the distinction matters.
How to Verify QSA Status
A walkthrough of the PCI SSC listings and Visa registry checks.
When Accreditation Lapses
What happens when a firm loses QSA status — and what it means for clients.
PCI DSS Cost Guide
What accredited assessments cost, what drives the fee, and an interactive estimator.
2026 Pricing Report
Every cost figure we publish, with its source and date. No invented averages.
RFP & Quote Comparison
Put accreditation proof in your brief: template, worksheet, and red flags.
Our Methodology
How we vet QSA companies, label every price, and keep rankings unbought.
The accredited firms
Every firm below is a real, operating QSA company with a website we load-verified in September 2026. We are an independent directory — listings are not endorsements, and accreditation status changes annually, so verify each firm on the PCI SSC listings before engaging.
Coalfire Systems
Coalfire is one of the largest QSA companies operating in North America. It is the named assessor on Amazon and AWS PCI DSS validations in Visa's Glob…
SecurityMetrics
SecurityMetrics is a PCI-focused QSA company whose published materials emphasize practical, deadline-driven assessments with strong communication. Its…
KirkpatrickPrice
KirkpatrickPrice is an assurance firm with PCI DSS, SOC, ISO, HIPAA, and HITRUST practices. Its published materials emphasize a concierge-style client…
BARR Advisory
BARR Advisory announced its accreditation as a PCI QSA company by the PCI Security Standards Council in January 2024 (Business Wire), adding PCI DSS t…
Accreditation basics
What is a PCI QSA company?
A QSA company (formally, a Qualified Security Assessor Company, or QSAC) is a firm accredited by the PCI Security Standards Council to perform on-site PCI DSS assessments. Only QSAs — individuals qualified by the Council and employed by an accredited QSA company — can sign a Report on Compliance (ROC).
How do I verify a firm's QSA accreditation?
Check the PCI SSC's assessor listings (listings.pcisecuritystandards.org) — the authoritative register — and cross-check Visa's Global Registry of Service Providers, which names the assessor on validated entities. Then get the accreditation stated in the engagement letter. Our verification guide walks through it in five minutes.
Does accreditation expire?
Yes — QSA company accreditation renews annually, and individual QSAs must requalify too. Last year's status proves nothing about this year, which is why you verify at engagement time, not at research time.
Does accreditation guarantee a good assessment?
No. Accreditation is a license to assess, not a quality rating — assessment quality varies enormously between accredited firms. It guarantees the ROC will be accepted; it doesn't guarantee the experience. That's why you still compare teams, references, and engagement letters.
Get quotes from accredited QSA companies
Tell us about your environment once. We’ll match you with accredited QSA companies that fit — no obligation, no spam.
How it works: tell us once (4 questions, 2 min) → we match accredited QSA companies to your size and scope → they send scoped quotes directly. Free, no obligation.