Agent Index by Heritage Services
Submit / Claim
AI
Agent Index by Heritage Services
theagentindex.io/guides/pci-dss-qsa-companies/ · Last reviewed 23 Oct 2026

Agent Index by Heritage Services · theagentindex.io/guides/pci-dss-qsa-companies/ · Not legal or audit advice · CC BY 4.0
Home / Guides / PCI DSS QSA companies

Free guide · PCI DSS · QSA · 23 Oct 2026

PCI DSS QSA companies: how to check the PCI SSC list and shortlist an assessor

The PCI Security Standards Council publishes the official QSA list. This page quotes how that list works, how to check a name on it, and how the 164 PCI DSS firms in this directory break down by headquarters country. Not a ranking.

Last reviewed 23 Oct 2026Auditors dataset v0.1.32
General information, not legal advice. Confirm scope with your counsel or auditor. A directory listing is a set of checked facts, not an endorsement. Confirm current QSA status on the PCI SSC list before engaging a firm.

The official list

“Qualified Security Assessor (QSA) companies are independent security organizations that have been qualified by the PCI Security Standards Council to validate an entity's adherence to PCI DSS.” [1]

QSAs are “re-qualified as QSAs each year”. “The PCI Security Standards Council does not endorse these security solution providers”. [1]

The Council “cannot guarantee that the list is up-to-date at all times”, so “each time a client engages a QSA, they are advised to check this list”. [1]

“'In Remediation' status indicates a determination by the Council, after Quality Assurance review, that a QSA organization has violated applicable QSA Validation Requirements.” [1]

Open the official list: PCI SSC Qualified Security Assessors.

What this directory lists

Agent Index lists 164 organisations whose frameworks field contains “PCI DSS”. Counts below are computed at build from that field. [3]

13 of the 164 also carry a CERT-In tag, 43 also carry HITRUST, and 21 also carry FedRAMP. Those overlaps are derived from stored framework tags. [3]

Related: auditors directory · HITRUST External Assessors · CERT-In empanelled auditors · Get matched.

Countries

Headquarters counts below are computed at build from PCI DSS-tagged listings. A country page exists only where at least three Verified firms match both the framework and an office in that country. Not a ranking.

QSA vs ISA vs ASV

QSA. “Qualified Security Assessor (QSA) companies are independent security organizations that have been qualified by the PCI Security Standards Council to validate an entity's adherence to PCI DSS.” [1]

ISA and ASV. This page does not add definitions beyond the QSA quotes above. See PCI SSC’s Assessors and Solutions page. [2]

Get matched

If you want a shortlist of listed firms for PCI DSS or another published framework, use Get matched or the form below. We store the request for review; we do not email firms automatically.

Get matched

Get matched with verified auditors

We'll review your request; no automatic emails. Introductions start later. This does not send a message to any firm and does not include prices. Not a ranking.

Framework(s) (select all that apply)

FAQ

Where is the official list of PCI QSA companies?

The PCI Security Standards Council publishes the Qualified Security Assessors list. https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors/

What does 'In Remediation' mean?

'In Remediation' status indicates a determination by the Council, after Quality Assurance review, that a QSA organization has violated applicable QSA Validation Requirements.

How often are QSAs re-qualified?

QSAs are “re-qualified as QSAs each year”. The Council “cannot guarantee that the list is up-to-date at all times”, so “each time a client engages a QSA, they are advised to check this list”.

Which countries have the most QSA firms in this directory?

Headquarters counts in this directory (not a ranking): United States 75, United Kingdom 29, India 15, Japan 15, Australia 12, Canada 5, Singapore 4, Brazil 2, Netherlands 2, United Arab Emirates 2, Germany 1, Ireland 1, Mexico 1.

How do I get matched with a QSA?

Use Get matched or the form on this page. We store the request for review; we do not email firms automatically. Get matched.

Get updates by email

Subscribe to the Brief

Weekly, free, unsubscribe anytime.

We use your email only to send the newsletter. See our privacy policy.

Sources

  1. PCI SSC, Qualified Security Assessors list, checked 23 Oct 2026. https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors/
  2. PCI SSC, Assessors and Solutions. https://www.pcisecuritystandards.org/assessors_and_solutions/
  3. Agent Index auditors dataset v0.1.32, generated 2026-10-27. https://theagentindex.io/auditors.json

Prepared by Agent Index (Heritage Services). Last reviewed 23 Oct 2026. General information, not legal advice. Confirm scope with your counsel or auditor. Licensed CC BY 4.0.