Buyer protection
Verify a QSA company in five minutes
Before you sign an engagement letter — or pay a deposit — run this check. Accreditation renews annually, so verify at engagement time, not at research time.
- Search the PCI SSC assessor listings. Go to listings.pcisecuritystandards.org and search the firm's legal name. This is the authoritative register: if the firm isn't listed as a currently accredited QSA company, stop. Confirm the listing covers the current year.
- Cross-check Visa's Global Registry of Service Providers. The registry names the assessor on validated entities. A firm claiming QSA status should appear as an assessor on real validations — it's corroboration, not proof, but its absence is a question worth asking.
- Check the firm's own claims carefully. “PCI compliant”, “PCI experts”, and “PCI consultants” are not accreditation. Look for the specific claim: accredited QSA company (QSAC). Vague language where a precise claim should be is a red flag.
- Ask for the named assessment team. Accreditation belongs to the company, but the work is done by individuals. Ask who the QSAs on your engagement are — names, not “to be staffed.”
- Get accreditation in the engagement letter. The letter should state the firm is a currently accredited QSA company and that the assessment will be performed by qualified QSAs in its employ. Verbal assurance is worthless.
Red flags
- Can't be found on the PCI SSC listings. The single disqualifying fact.
- Claims accreditation but won't put it in writing. If it's true, it's one sentence in the letter.
- “Our partner is accredited.” Then your contract should be with the accredited entity, and the accredited entity's QSAs should do the work.
- Guaranteed pass. No honest QSA guarantees an outcome before seeing your environment.
- Pressure to sign before you verify. Verification takes five minutes; urgency that can't survive five minutes isn't real.
Verify the individuals too. Ask whether the QSAs assigned to you are currently qualified — individual QSA qualification also requires ongoing training and re-examination. A great accredited firm with a junior, unsupervised team is not what you're paying for.
Verified firms, competing quotes
Our directory only lists firms we've checked — and you should still verify. Get scoped quotes from matched accredited QSAs, free.
How it works: tell us once (4 questions, 2 min) → we match accredited QSA companies to your size and scope → they send scoped quotes directly. Free, no obligation.