PCI DSS auditors (QSA companies) in the United States

SOC 1SOC 2ISO 27001ISO 27701 +4

St. Petersburg, Florida firm performing SOC examinations, ISO certification, HITRUST, PCI DSS and FedRAMP assessments.

St. Petersburg, Florida

ISO 27001ISO 27701ISO 42001HITRUST +4

Tampa-headquartered cybersecurity compliance firm covering ISO certification, HITRUST, FedRAMP, PCI DSS and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +2

Alpharetta, Georgia assurance and compliance firm offering SOC 1 and SOC 2 reports, PCI DSS, HITRUST and FedRAMP assessments.

Alpharetta, Georgia

PCI DSS

King of Prussia, Pennsylvania cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company; its site lists PCI ROC/SAQ services.

King of Prussia, Pennsylvania

PCI DSSHITRUST

Cybersecurity and compliance firm headquartered in East Brunswick, New Jersey with offices in Bengaluru and Pune; listed as a PCI QSA and HITRUST External Assessor.

East Brunswick, New Jersey · Bengaluru, Karnataka · Pune, Maharashtra

PCI DSSHITRUST

Chantilly, Virginia cybersecurity firm listed as a PCI QSA (places of business include USA, UK and India) and HITRUST External Assessor.

Chantilly, Virginia

PCI DSSFedRAMPCMMC

Fredericksburg, Virginia assessment firm listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.

Fredericksburg, Virginia

SOC 2ISO 27001ISO 27701ISO 42001 +5

Atlanta-based CPA and advisory firm listed across SOC, ISO, FedRAMP, HITRUST, PCI DSS and CMMC assessor registries.

Atlanta, Georgia

PCI DSSHITRUSTISO 27001ISO 27701 +1

US accounting and consulting firm (first-listed office San Ramon, CA); listed as a PCI Qualified Security Assessor company and HITRUST External Assessor, with an ANAB-accredited ISO certification body (Armanino Certified, LLC).

San Ramon, California · Chicago, Illinois · New York, New York · +2 more

PCI DSSCMMC

Tampa-based compliance assessment firm, described on its site as a division of Carr, Riggs & Ingram Capital, LLC; listed as a PCI QSA and CMMC C3PAO.

Tampa, Florida

PCI DSSHITRUSTFedRAMPISO 27001 +3

US advisory and accounting firm; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized assessor, with an ANAB-accredited ISO certification body (Baker Tilly Certifications LLC).

Chicago, Illinois

PCI DSS

US member of the BDO network with its national headquarters in Chicago; listed as a PCI Qualified Security Assessor company.

Chicago, Illinois

PCI DSS

UK cybersecurity services firm with offices in Reading, London, Cardiff, Manchester and Edinburgh; listed as a PCI QSA.

Reading, England · London, England · Cardiff, Wales · +4 more

PCI DSS

Lincoln, Nebraska security firm listed as a PCI Qualified Security Assessor (QSA) company.

Lincoln, Nebraska

PCI DSSISO 27001ISO 27701

Cleveland-headquartered professional services company; its CBIZ Security & Compliance, LLC unit is a PCI Qualified Security Assessor company and an ANAB-accredited ISO/IEC 27001 and 27701 certification body.

Cleveland, Ohio · Tampa, Florida

PCI DSS

Vernon Hills, Illinois IT solutions provider whose security practice is listed as a PCI Qualified Security Assessor (QSA) company.

Vernon Hills, Illinois

PCI DSSHITRUST

US accounting and advisory firm with a Minneapolis office (220 South Sixth Street); listed as a PCI Qualified Security Assessor company and HITRUST External Assessor.

Minneapolis, Minnesota

ISO 27001ISO 27701ISO 42001HITRUST +4

Cybersecurity advisory and assessment firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST assessor, ISO certification body and (via Coalfire Federal) CMMC C3PAO.

Chicago, Illinois · Alpharetta, Georgia · Bellevue, Washington · +2 more

PCI DSS

North Providence, Rhode Island IT security and compliance firm listed as a PCI QSA.

North Providence, Rhode Island

PCI DSS

Knoxville, Tennessee security firm listed as a PCI Qualified Security Assessor (QSA) company.

Knoxville, Tennessee

ISO 27001ISO 27701ISO 42001HITRUST +5

Compliance assessment firm based in Fairfax, Virginia with an Indian entity in Mumbai; listed as PCI QSA, FedRAMP 3PAO, HITRUST assessor, C3PAO and CERT-In empanelled auditor. The Indian entity is NABCB-accredited for ISO/IEC 27001.

Fairfax, Virginia · Mumbai, Maharashtra

PCI DSSHITRUSTHIPAA

Reston, Virginia security compliance and assessment firm listed as a PCI Qualified Security Assessor (QSA) company and a HITRUST External Assessor; its site offers HIPAA-based assessments.

Reston, Virginia

PCI DSSHITRUST

US accounting and advisory firm whose Chicago office is its national headquarters; listed as a PCI Qualified Security Assessor company and HITRUST External Assessor.

Chicago, Illinois

PCI DSS

Durham, North Carolina security firm listed as a PCI Qualified Security Assessor (QSA) company.

Durham, North Carolina

PCI DSS

New York City advisory and assurance firm listed as a PCI Qualified Security Assessor (QSA) company.

New York, New York

PCI DSSHITRUST

US member firm of the EY global network; listed as a PCI DSS Qualified Security Assessor and a HITRUST External Assessor.

New York, New York · Chicago, Illinois · San Francisco, California · +11 more

HITRUSTPCI DSS

Brentwood, Tennessee consulting firm listed as a HITRUST External Assessor and PCI QSA.

Brentwood, Tennessee

ISO 27001ISO 27701PCI DSSFedRAMP +2

Virginia-based assessment firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO, with an ANAB-accredited ISO certification arm.

Lansdowne, Virginia

HITRUSTPCI DSSCMMC

US accounting and advisory firm with offices in many states; listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Charlotte, North Carolina · Appleton, Wisconsin · Asheville, North Carolina · +72 more

SOC 2HITRUSTPCI DSSHIPAA

Atlanta-based CPA and advisory firm whose cybersecurity practice covers SOC 2, HITRUST, HIPAA and PCI DSS; listed as a PCI QSA and HITRUST External Assessor.

Atlanta, Georgia · Alpharetta, Georgia · Auburn, Alabama · +12 more

PCI DSS

Edina, Minnesota security firm listed as a PCI Qualified Security Assessor (QSA) company.

Edina, Minnesota · Lakewood, Colorado · Bozeman, Montana

PCI DSSHITRUST

Puerto Rico-headquartered cybersecurity firm with a US office in Fort Lauderdale, offering PCI DSS assessments as a QSA company and HIPAA/HITRUST assessment services.

Río Piedras, Puerto Rico · Fort Lauderdale, Florida

PCI DSS

Peabody, Massachusetts IT, security and business consulting firm listed as a PCI Qualified Security Assessor (QSA) company.

Peabody, Massachusetts

PCI DSS

Reston, Virginia cybersecurity services firm listed as a PCI Qualified Security Assessor (QSA) company; its site offers PCI DSS compliance services.

Reston, Virginia

PCI DSS

Schaumburg, Illinois information security firm listed as a PCI QSA.

Schaumburg, Illinois

PCI DSSFedRAMPCMMC

Centerville, Ohio assessment firm; the Ignyte entities are listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.

Centerville, Ohio

HITRUSTPCI DSSFedRAMPCMMC +1

Tampa-based audit firm listed as a PCI QSA, HITRUST External Assessor, FedRAMP 3PAO and CMMC C3PAO.

Tampa, Florida

HITRUSTPCI DSS

The Woodlands, Texas audit and certification firm listed as a HITRUST External Assessor and a PCI Qualified Security Assessor (QSA) company.

The Woodlands, Texas

PCI DSS

Newport Beach, California information security firm listed as a PCI QSA.

Newport Beach, California

PCI DSS

Houston, Texas payment security firm listed as a PCI Qualified Security Assessor (QSA) company.

Houston, Texas

SOC 1SOC 2HITRUSTPCI DSS

Licensed CPA firm with a Nashville corporate office performing SOC, HITRUST and PCI DSS assessments, with locations listed in ten US cities.

Nashville, Tennessee · Atlanta, Georgia · Bethesda, Maryland · +7 more

FedRAMPPCI DSS

US member firm of the KPMG network. FedRAMP-recognized third-party assessor and PCI Qualified Security Assessor company.

New York, New York · Chicago, Illinois · McLean, Virginia · +9 more

PCI DSS

New York risk and investigations firm whose cyber practice is listed as a PCI Qualified Security Assessor (QSA) company.

New York, New York

PCI DSSFedRAMPCMMCGovRAMP

Scottsdale, Arizona cybersecurity audit firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO.

Scottsdale, Arizona

ISO 27001ISO 27701HITRUSTPCI DSS

Tennessee advisory firm headquartered in Brentwood (Nashville area) offering ISO certification, HITRUST and PCI DSS services.

Brentwood, Tennessee · Chattanooga, Tennessee · Knoxville, Tennessee · +5 more

SOC 1SOC 2ISO 27001ISO 27701 +6

Denver-based CPA firm performing SOC examinations, ISO certification, FedRAMP, HITRUST, PCI DSS and CMMC assessments.

Denver, Colorado

HITRUSTPCI DSS

Atlanta, Georgia healthcare-focused risk and compliance firm listed as a HITRUST External Assessor and PCI QSA.

Atlanta, Georgia

HITRUSTPCI DSSFedRAMPGovRAMP

Scottsdale, Arizona security and compliance firm listed as a PCI QSA, HITRUST External Assessor and FedRAMP 3PAO.

Scottsdale, Arizona

CERT-InPCI DSSHITRUST

Indian cybersecurity firm with offices in Bengaluru and Plano, Texas; listed as a CERT-In empanelled auditor (Mumbai address), PCI QSA and HITRUST External Assessor.

Bengaluru, Karnataka · Mumbai, Maharashtra · Plano, Texas

PCI DSS

Charlotte, North Carolina security firm listed as a PCI Qualified Security Assessor (QSA) company.

Charlotte, North Carolina

PCI DSS

Wichita, Kansas cybersecurity services firm with US offices in seven more states, listed as a PCI Qualified Security Assessor (QSA) company.

Wichita, Kansas · Paso Robles, California · Tempe, Arizona · +5 more

PCI DSS

Tokyo-based security services firm listed by the PCI SSC as a QSA company, with offices in Yokohama, Osaka and Irvine, California.

Tokyo, Tokyo · Yokohama, Kanagawa · Osaka, Osaka · +1 more

PCI DSSHITRUST

Leawood, Kansas cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company and a HITRUST External Assessor.

Leawood, Kansas · Newport Beach, California

PCI DSS

Chesterfield, Missouri security firm listed as a PCI Qualified Security Assessor (QSA) company.

Chesterfield, Missouri

PCI DSS

Security testing and consultancy firm based in Buckingham, England with a New York office; listed as a PCI QSA.

Buckingham, England · New York, New York

SOC 1SOC 2HITRUSTPCI DSS

Accounting and advisory firm with offices in Michigan, Illinois, Colorado, Ohio and other states; its cybersecurity practice covers SOC 1 and SOC 2 reporting, PCI DSS and HITRUST.

Southfield, Michigan · Broomfield, Colorado · Denver, Colorado · +17 more

HITRUSTPCI DSSFedRAMPCMMC +1

Nashville-based security assessment firm listed as a FedRAMP 3PAO, HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Nashville, Tennessee

PCI DSS

US member firm of the PwC network; its site gives a registered address at 300 Madison Avenue, New York. Listed by the PCI Security Standards Council as a Qualified Security Assessor company.

New York, New York

HITRUSTPCI DSS

Menlo Park-based consulting firm offering PCI DSS assessments as a QSA company and HITRUST assessments as an authorized external assessor.

Menlo Park, California

CERT-InPCI DSS

Navi Mumbai-based security assurance firm with a US entity in Wilmington, Delaware; listed as a CERT-In empanelled auditor and PCI QSA.

Navi Mumbai, Maharashtra · Wilmington, Delaware

PCI DSS

Montreal-based accounting and advisory firm listed as a PCI Qualified Security Assessor (QSA) company, with offices in Toronto, Calgary and Chicago.

Montreal, Quebec · Toronto, Ontario · Calgary, Alberta · +1 more

HITRUSTPCI DSS

Roswell, Georgia security and compliance firm listed as a PCI QSA and HITRUST External Assessor.

Roswell, Georgia

HITRUSTPCI DSSCMMC

Southlake, Texas cybersecurity compliance firm listed as a HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Southlake, Texas

PCI DSSHITRUSTFedRAMPGovRAMP

Chicago-headquartered US member of the RSM network; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized third-party assessor.

Chicago, Illinois

PCI DSS

US accounting and consulting firm with offices including St. Louis, Denver and Chicago; listed as a PCI Qualified Security Assessor company.

St. Louis, Missouri · Denver, Colorado · Chicago, Illinois

PCI DSS

Boulder, Colorado security firm listed as a PCI Qualified Security Assessor (QSA) company.

Boulder, Colorado

ISO 27001ISO 27701ISO 42001HITRUST +5

Tampa-based attestation and certification firm offering ISO certification, FedRAMP, PCI DSS, HITRUST and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +1

Pittsburgh-based CPA and advisory firm with offices in Columbus and McLean; performs SOC examinations and is listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Pittsburgh, Pennsylvania · Columbus, Ohio · McLean, Virginia

ISO 27001ISO 42001HITRUSTPCI DSS +3

Security assessment firm with an Annapolis, Maryland address listed as a FedRAMP 3PAO, PCI QSA and HITRUST External Assessor, with an ANAB-accredited affiliate for ISO 27001 and ISO 42001.

Annapolis, Maryland

PCI DSSHITRUST

Orem, Utah data security and compliance company listed as a PCI QSA and HITRUST External Assessor.

Orem, Utah

SOC 1SOC 2PCI DSS

Accounting, technology and advisory firm with US offices in the Midwest, Mid-Atlantic and New England and offices in India; its services include SOC reporting and PCI DSS assessments.

Chicago, Illinois · Alexandria, Virginia · Marlborough, Massachusetts · +13 more

CERT-InPCI DSSHITRUST

Bengaluru-headquartered information security firm listed as a CERT-In empanelled auditor, PCI QSA and HITRUST External Assessor.

Bengaluru, Karnataka · Irving, Texas

PCI DSSCMMC

Plano, Texas security firm listed as a PCI Qualified Security Assessor (QSA) company and an authorized CMMC Third-Party Assessment Organization (C3PAO).

Plano, Texas

HITRUSTPCI DSSFedRAMPCMMC

Irvine, California cybersecurity firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Irvine, California · Fairfax, Virginia · Scottsdale, Arizona

PCI DSS

Oakville, Ontario cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company.

Oakville, Ontario · West Palm Beach, Florida

PCI DSS

Charlotte, North Carolina penetration testing and security consulting firm; its QSA listing is under the legal name Strata Information Group, Inc.

Charlotte, North Carolina

PCI DSS

Fairlawn, Ohio-based cybersecurity firm offering penetration testing, incident response and compliance services, including PCI DSS assessments as a QSA company.

Fairlawn, Ohio

PCI DSS

Atlanta, Georgia cybersecurity and compliance firm listed as a PCI QSA.

Atlanta, Georgia

HITRUSTPCI DSS

Chicago-headquartered security firm listed as a HITRUST External Assessor and PCI QSA.

Chicago, Illinois

PCI DSS

Cybersecurity and compliance company with headquarters in Chicago and Dublin, offering PCI DSS assessments as a QSA company alongside penetration testing and vulnerability scanning.

Chicago, Illinois · Dublin, Dublin

PCI DSS

Los Angeles IT consulting and security firm listed as a PCI Qualified Security Assessor (QSA) company.

Los Angeles, California

PCI DSSHITRUST

US accounting and advisory firm headquartered in Milwaukee, Wisconsin; its Wipfli Advisory LLC entity (formerly CompliancePoint) is a PCI Qualified Security Assessor company and Wipfli LLP is a HITRUST External Assessor.

Milwaukee, Wisconsin

HITRUSTPCI DSS

Boston-based firm offering HITRUST and PCI DSS assessment services.

Boston, Massachusetts · Springfield, Massachusetts · Miami, Florida · +1 more