7 PCI DSS Service Providers: QSA Firms Compared (2026)

PCI DSS service providers cover several different jobs. The term can refer to a third-party provider that stores, processes, or transmits cardholder data, a provider that can affect the Cardholder Data Environment (CDE), or a PCI assessor that validates controls. The PCI Security Standards Council (PCI SSC) says PCI DSS applies to entities that handle cardholder data or could affect the CDE; its qualified-assessor programs validate specific parts of that work.

This shortlist focuses on firms that sell PCI DSS assessment, scanning, technical testing, or managed-compliance services to organizations that also need SOC 2. It does not replace the PCI SSC program listings or tell you which payment processor, cloud provider, or general managed service belongs in your CDE inventory.

Review note. This is our shortlist, not an official PCI SSC ranking or directory. Provider qualifications, service boundaries, pricing, and scheduling change. Verify the current QSA, ASV, PFI, P2PE, or other qualification in the PCI SSC listings before signing.

What kind of PCI DSS provider does a SOC 2 company need?

The right PCI DSS provider depends on the deliverable: a QSA validates PCI DSS, an ASV performs qualified external vulnerability scans, and a third-party service provider supports the CDE. A SOC 2 report remains a separate CPA attestation against selected AICPA Trust Services Criteria.

Buyer need	Provider role	Typical output	Boundary to confirm
Full PCI DSS assessment or Report on Compliance	Qualified Security Assessor (QSA)	ROC, AOC support, or assessment documentation	Exact CDE boundary, applicable requirements, assigned QSA, and report issuer
External vulnerability scanning	Approved Scanning Vendor (ASV)	ASV scan results and remediation or rescan records	Internet-facing assets, scan cadence, exclusions, and whether the scan covers the required scope
Payment, hosting, identity, or managed service that touches the CDE	Third-party service provider (TPSP)	Service description, contract controls, and often an AOC or other assurance artifact	Services in scope, responsibility split, subservice organizations, and customer responsibilities
SOC 2 attestation	Independent licensed CPA firm	SOC 2 Type 1 or Type 2 report	Legal CPA entity, selected Trust Services Criteria, covered date or period, and independence

PCI SSC describes QSAs as independent organizations qualified to perform PCI DSS assessments and ASVs as qualified providers of external vulnerability scanning. Use the official program listings to verify those roles. The AICPA’s Trust Services Criteria govern the separate SOC 2 examination.

Which PCI DSS version should a 2026 provider quote cover?

PCI DSS v4.0.1 is the active version. PCI SSC retired PCI DSS v4.0 on December 31, 2024, and the future-dated v4.x requirements became effective on March 31, 2025. Ask every provider to scope the quote against v4.0.1, not an undated “PCI audit.”

The version change affects the questions you ask, even when it does not change the shortlist:

1. Ask which v4.0.1 requirements apply to your CDE, payment pages, connected systems, and service-provider relationships.
2. Ask how the provider documents targeted risk analyses where the standard allows a flexible implementation.
3. Ask which evidence is required from you, which evidence comes from a TPSP, and which testing the provider performs itself.
4. Ask whether the engagement includes remediation support, a retest, an ROC or SAQ path, and the final AOC workflow.

PCI SSC describes v4.0.1 as a limited revision with no new or deleted requirements. It did not change the March 31, 2025 effective date for future-dated requirements. Read the Council’s v4.0.1 publication notice alongside the current standard documents.

How did we choose these seven PCI DSS service providers?

The seven names below are our shortlist for common SOC 2 and PCI buying situations. The order follows use case, not a universal score. We favored providers with a public PCI assessment, scanning, technical-testing, or managed-compliance angle and removed claims that could not be compared across different CDE scopes.

The shortlist uses five checks:

1. The PCI role. Can the provider state whether it is acting as QSA, ASV, PFI, P2PE assessor, technical tester, managed service provider, or another role?
2. The deliverable. Will you receive a ROC, AOC, SAQ support, ASV scan, penetration-test report, managed evidence, or a combination?
3. The system boundary. Does the provider understand your payment flow, tokenization, segmentation, cloud architecture, subservice organizations, and customer responsibilities?
4. The SOC 2 handoff. Can it explain what a separate CPA auditor may review without promising that PCI work automatically satisfies a SOC 2 criterion?
5. The commercial boundary. Are readiness, remediation, testing, platform access, retests, report revisions, and scope changes priced separately?

Public pricing and availability are not consistent enough to rank these firms honestly. Send each candidate the same CDE diagram, data-flow description, required report, covered period, customer deadline, and list of known third parties.

Which PCI DSS service provider fits your scope?

Use this table to choose the first calls. The role column is a verification prompt, not a claim that every firm currently holds every qualification. Confirm the current company listing, employee qualification, and service scope in PCI SSC’s directory.

Provider	Shortlist angle	PCI role to verify	SOC 2 question to ask
Coalfire	Complex cloud, fintech, and multi-team assessment programs	QSA, ASV, and technical-testing coverage	Can one engagement coordinate CDE scoping, testing, and a separate SOC 2 evidence plan?
Schellman	Independent, audit-led work across multiple frameworks	QSA and any specialist assessor programs in scope	Which entity issues each report, and where does readiness or remediation stop?
A-LIGN	Integrated PCI DSS, SOC 2, and broader framework programs	QSA, ASV, and the legal issuer for each deliverable	Is the assigned team experienced with the same SaaS or payment architecture?
NCC Group	Technically deep testing for complex payment flows and networks	QSA, ASV, P2PE or 3DS, and testing scope	Does the quote include a PCI assessment, technical testing, or both?
SecurityMetrics	QSA work combined with ASV scanning or recurring services	QSA, ASV, and PFI coverage	Does the package include a ROC/AOC path, scans, SAQ support, or separate add-ons?
ControlCase	Platform-led, repeatable compliance for portfolios or multiple entities	QSA, ASV, and managed-platform responsibilities	Who owns evidence quality, platform configuration, and source records during the SOC 2 audit?
VikingCloud	Acquirer, processor-linked, and distributed merchant programs	QSA, ASV, PFI, and direct-versus-partner delivery	Are you buying a direct assessment, a bank-sponsored program, ASV scans, or a managed bundle?

The provider links below are starting points for company research. They are not substitutes for checking the current PCI SSC listing or asking for the legal entity on the engagement letter.

1. Is Coalfire a fit for complex cloud or fintech scopes?

Coalfire is a reasonable first call for a cloud-native or payment architecture that needs a large PCI assessment program plus technical testing. Confirm the assigned QSA, exact PCI SSC qualifications, ASV arrangement, and how any SOC 2 coordination is scoped.

Use Coalfire when the CDE spans several cloud accounts, products, regions, or engineering teams and you need one provider to coordinate assessment work. Ask for a written separation between readiness, remediation advice, technical testing, and the independent validation deliverable.

Visit Coalfire

2. Is Schellman a fit when independent assessment matters most?

Schellman fits organizations that prioritize independent assessment and multi-framework coordination over a bundled remediation platform. Its audit-led model can suit a company planning PCI DSS and SOC 2 together, but confirm the legal entity, report issuer, and readiness boundary before relying on a bundle.

Ask how the firm handles shared interviews and evidence without blurring the difference between a PCI validation and a CPA attestation. Get the covered period, selected criteria, CDE description, exception process, and report delivery date in the proposal.

Visit Schellman

3. Is A-LIGN a fit for a SaaS or fintech team running multiple frameworks?

A-LIGN suits SaaS and fintech teams that want one program across PCI DSS, SOC 2, and possibly ISO 27001 or HITRUST. Ask which entity signs each deliverable, whether QSA and ASV work are performed by the same team, and how scope changes affect the quote.

The useful comparison point is coordination, not a promise of a faster audit. Ask the assigned team to map each product, payment flow, and subservice organization to the proposed PCI and SOC 2 boundaries before fieldwork begins.

Visit A-LIGN

4. Is NCC Group a fit for technically complex payment flows?

NCC Group is a fit for technically deep testing across hybrid, cloud, or multi-region payment environments. Ask whether the engagement includes a QSA assessment, ASV scanning, penetration testing, or only advisory work; those outputs are separate and have different acceptance requirements.

This distinction matters for SOC 2 planning. A penetration-test report may support a security-testing discussion, but the CPA auditor still evaluates scope, methodology, remediation, and the covered period against the SOC 2 engagement.

Visit NCC Group

5. Is SecurityMetrics a fit for bundled scanning and assessment services?

SecurityMetrics suits merchants and service providers looking for QSA work alongside ASV scans or recurring monitoring. A bundle may reduce vendor handoffs, but confirm whether the quote covers a ROC/AOC assessment, SAQ support, external scans, or separate services.

Ask for the scan scope, cadence, remediation workflow, rescan policy, and evidence export format. If the same reports will support a SOC 2 program, give the CPA firm the proposed scope before assuming the reports will be accepted.

Visit SecurityMetrics

6. Is ControlCase a fit for platform-led continuous compliance?

ControlCase suits organizations that want a platform-led, repeatable compliance program across entities or merchant portfolios. Ask who owns configuration and evidence quality, who signs the PCI deliverable, what managed compliance includes, and how the SOC 2 auditor can access source records.

The platform is useful only when the underlying populations and timestamps remain complete and reviewable. Put data retention, export format, control ownership, change management, retests, and platform access into the statement of work.

Visit ControlCase

7. Is VikingCloud a fit for acquirer or distributed merchant programs?

VikingCloud is a fit for distributed merchant, acquirer, or processor-linked programs where portfolio-scale tracking matters. Buyers who arrive through a bank or processor should confirm whether they are buying direct QSA services, a managed program, ASV scans, or a bundled enrollment.

Ask how responsibilities are split between the provider, acquirer, merchant, and any payment processor. That responsibility matrix is useful for both PCI DSS scoping and SOC 2 vendor-risk documentation.

Visit VikingCloud

How can PCI evidence support a SOC 2 audit?

PCI evidence can reduce duplicate collection when the system boundary, control owner, population, test method, and covered period match both engagements. A ROC, AOC, ASV scan, or penetration-test report does not automatically satisfy a SOC 2 criterion; the CPA auditor decides what is sufficient.

PCI artifact	Possible SOC 2 use	Conditions to check	What it does not prove by itself
ROC or AOC from a third-party provider	Vendor-risk, subservice-organization, or CDE responsibility review	Current version, covered services, period, CUECs, exceptions, and contract responsibilities	That your own SOC 2 controls operated effectively
ASV scan	External vulnerability-management evidence	Same internet-facing assets, required cadence, findings, remediation, and rescan records	That internal controls, access, change management, or incident response passed
Penetration-test report	Security-testing and risk-response evidence	Scope, methodology, independence, findings, remediation, retest, and report period	That the PCI and SOC 2 boundaries are identical
Access review or identity evidence	Logical-access control evidence	Same systems, population, approver, frequency, and retention period	That the review covered every SOC 2 system or user population
Logging, monitoring, or incident records	System-operations and response evidence	Source systems, alert rules, ownership, sampling, and covered period	That the evidence meets the CPA auditor’s testing procedure without review

The AICPA describes SOC 2 through the Trust Services Criteria, while PCI DSS provides a baseline of technical and operational requirements for payment account data. Treat the table as a planning crosswalk, not a formal AICPA-to-PCI mapping.

For a broader explanation of the framework boundary, read the SOC 2 vs. PCI DSS guide for SaaS. For the larger credential-based shortlist, use the PCI DSS QSA firms directory.

What should you ask a PCI DSS provider before signing?

Send every candidate the same written brief. A comparable quote should name the PCI role, validation artifact, CDE boundary, v4.0.1 requirements, assigned people, evidence expectations, retest rules, and every fee that changes when scope changes.

1. Which PCI role are you performing? Ask whether the provider is acting as QSA, ASV, PFI, P2PE assessor, technical tester, readiness adviser, managed service provider, or another role.
2. What will we receive? Name the ROC, AOC, SAQ support, ASV scan, penetration-test report, managed evidence export, or other deliverable.
3. What is the exact CDE boundary? Include payment pages, tokenization, cloud accounts, connected systems, people, locations, data flows, and subservice organizations.
4. Which v4.0.1 requirements apply? Ask how the provider handles flexible requirements, targeted risk analyses, payment-page controls, third-party responsibilities, and any requirement your acquirer or customer adds.
5. Which evidence can support SOC 2? Ask for conditions, not a guarantee: matching scope, population, owner, method, and period.
6. Who issues each report? Record the legal entity, engagement partner, QSA or ASV team, and any subcontractor or referral relationship.
7. Where does readiness or remediation stop? Ask which decisions remain with management and how the provider protects the independence of the validation or attestation work.
8. What happens when a test fails? Price remediation guidance, retesting, report revisions, exceptions, and a change in scope separately.
9. What is the calendar? State the evidence start date, assessment window, customer deadline, report delivery date, and renewal assumptions.
10. What is excluded from the quote? Include platform access, travel, scans, penetration testing, SAQ support, report distribution, and additional products or entities.

If a provider cannot answer those questions in writing, the quote is not comparable yet. Start with the PCI SSC qualified-professional listings and confirm the current program status before you compare price.