PCI Compliance Consultants, QSA Firms and Software Compared
Published
Anyone can call themselves a PCI compliance consultant. Only a company on the Council's list is a QSA: “QSA companies are qualified by PCI SSC to validate an entity's adherence to PCI DSS requirements.” That line decides what you are buying. Depending on the card brands' programs, an entity either has a detailed assessment documented in a Report on Compliance or self-assesses with an SAQ. A small merchant on an SAQ can do it alone, with a consultant, with software or with a QSA's help; a merchant asked for a ROC needs an assessor. This page compares 5 firms and tools on those jobs, read on 2026-10-22.
Verdict
- Best overall for a small merchantVikingCloud
- Best for a first Report on ComplianceSecurityMetrics
- Best for PCI beside SOC 2 or ISO 27001Thoropass
Vendors compared5
The comparison table
The QSA and ASV rows come from the Council's own lists; the rest from each firm's PCI page. A QSA company and an Approved Scanning Vendor are separate listings, and one firm can hold both.
Swipe sideways for more vendors
| What you are buying | Our pickVikingCloud | SecurityMetrics | Thoropass | A-LIGN | Vanta |
|---|---|---|---|---|---|
| Is a QSA company on the Council's listQSA list | Yes | Yes | Yes | Yes | No |
| Runs the quarterly external scan as a listed ASVReq. 11.3.2 | Yes | Yes | Yes | No | No |
| Helps you complete your SAQSAQ | Yes | Ask the vendor | Yes | Yes | Yes |
| Prepares you before the assessmentReadiness | Ask the vendor | Yes | Yes | Yes | Yes |
| Writes your Report on Compliance as the assessorROC | Ask the vendor | Yes | Yes | Yes | No |
| Offers penetration testingReq. 11.4 | Yes | Yes | Yes | Yes | Ask the vendor |
Of these, VikingCloud, SecurityMetrics, Thoropass, and A-LIGN are QSA companies, and VikingCloud, SecurityMetrics, and Thoropass can also run the quarterly external scan as listed ASVs. Anyone else sends you to a listed ASV for the scan; our directory of Approved Scanning Vendors has the full list.
Firm by firm
VikingCloud
A QSA company and listed ASV with a subscription built for small merchants.
FitsShops on a short SAQ that want the scan in the same place
QSA companyYes
Listed ASVYes
SAQ helpYes
Writes a ROCAsk the vendor
Not stated on their site when read on 2026-10-22.
Its small-business page offers a “Guided self-assessment” and an “Approved Scanning Vendor (ASV) certified” scanner. Its home page says “100+ QSAs in 16 countries.” The ROC line is open only because the pages we read do not describe a merchant ROC service; ask before you sign.
VerdictA small shop's SAQ and scans
SecurityMetrics
A QSA company and listed ASV that runs full PCI DSS assessments.
FitsA merchant told to produce its first ROC
QSA companyYes
Listed ASVYes
Readiness workYes
Writes a ROCYes
Its audit page offers “a pre-onsite gap analysis, onsite assessment, remediation assistance, to a delivered PCI Report on Compliance” and says it will submit the AOC and ROC “to any required parties, such as the card brand or merchant bank.” Its audit page does not name an SAQ service, so ask about that.
VerdictA first Report on Compliance
Thoropass
A compliance platform that is also a QSA company and a listed ASV.
FitsTeams that already audit SOC 2 or ISO 27001
QSA companyYes
Listed ASVYes
SAQ helpYes
Writes a ROCYes
It says it “offers a third-party Report on Compliance (RoC), Attestation of Compliance (AoC), and Self Assessment Questionnaire (SAQ) in PCI” and runs “multi-framework compliance audits–like SOC 2, ISO 27001, and HITRUST”. Software and assessor in one firm is convenient; read the independence rules below before the same firm fixes and judges your controls.
VerdictPCI beside other audits, one firm
A-LIGN
A QSA company that runs readiness work, on-site assessments and facilitated SAQs.
FitsMerchants who want an assessor's eye on their SAQ
QSA companyYes
Listed ASVNo
SAQ helpYes
Writes a ROCYes
Its PCI page lists a “PCI DSS readiness assessment”, an on-site assessment that “results in a ROC and AOC”, and a “Facilitated Self-Assessment Questionnaire (SAQ)”. It is not on the Council's ASV list, so the quarterly external scan comes from a separate listed vendor.
VerdictA facilitated SAQ from an assessor
Vanta
Compliance software. Not a QSA company and not a listed ASV.
FitsA merchant with someone in-house to run the work
QSA companyNo
Listed ASVNo
SAQ helpYes
Writes a ROCNo
Its PCI page offers “Guided SAQ and AOC completion” and answers its own question plainly: “Vanta does not replace a Qualified Security Assessor. For organizations that require a formal ROC, you’ll still need a QSA.”
VerdictOrganising evidence, not signing
Who may do which job
Some PCI jobs are fenced by the Council's rules: an Attestation of Compliance is signed by the entity and by the QSA company if one was involved; the quarterly external scan must come from a listed ASV; and a penetration test needs a qualified, independent tester, not required to be a QSA or ASV. The guide to the Attestation of Compliance walks through the form, and what a PCI penetration test involves covers the tester.
Swipe sideways for more columns
| Job | You, the merchant | A non-QSA consultant | A QSA company | Compliance software |
|---|---|---|---|---|
| Fill in your SAQSAQ | Yes | Can help | Can help | Can help |
| Sign the Attestation of ComplianceAOC | Yes | No | Yes | No |
| Write a Report on Compliance as the assessorROC | Ask your acquirer | No | Yes | No |
| Run the quarterly external scanReq. 11.3.2 | No | Only if a listed ASV | Only if a listed ASV | Only if a listed ASV |
| Penetration testReq. 11.4 | If qualified and independent | If qualified and independent | If qualified and independent | No |
| Write your security policyReq. 12.1.1 | Yes | Can help | Can help | Can help |
| Document and confirm your scopeReq. 12.5.2 | Yes | Can help | Can help | Can help |
Who do you need this year?
Start from what your acquirer asked for, not from a sales call. If you do not know your SAQ yet, the SAQ type finder names it from how you take cards, and PCI SAQ types explained covers every SAQ type.
Who do you need this year?
Pick what fits your shop. Nothing you pick leaves this page.
- Your processor's PCI programStart here
- Approved Scanning VendorNeeded
- QSA companyOptional, for help
- Non-QSA consultantOptional
- Compliance softwareOptional
SAQ A for v4.x includes Requirements 11.3.2 and 11.3.2.1 (external vulnerability scans) for merchants whose pages redirect to, or embed, a processor's payment page.
Signs the AOCYou, plus a QSA company only if one was involved
How to check a firm on the Council's list
The Council listed 418 QSA companies on 22 October 2026. It also says it “does not endorse these security solution providers or their business processes or practices,” so the list proves qualification, not fit. Run these checks before you sign anything.
01Find the company on the Council's QSA list
Search by company name. The listed name is the legal one, so a firm you know as A-LIGN appears as “A-LIGN Compliance and Security, Inc., dba A-LIGN”.
02Check that it serves your region
Each entry lists the regions it serves (USA, Canada, Europe, LAC, CEMEA, Asia Pacific). If yours is missing, ask the firm in writing whether it can assess you there.
03Look for an “In Remediation” mark
The Council uses it when, “after Quality Assurance review,” it finds a QSA company “has violated applicable QSA Validation Requirements.” Ask the firm about it before you sign.
04Verify the person, not only the firm
The Council's Verify a Professional search takes a “Last Name, First Initial or Certificate Number” and shows the certification status of the assessor who will work on your account.
05Check again at every engagement
The Council re-qualifies QSAs each year and says that “each time a client engages a QSA, they are advised to check this list.”
The Council's QSA list
QSA companies listed418
Listing USA among their regions203
Read on2026-10-22
Steps to check a firm5
Source: PCI SSC Qualified Security Assessors list and its export and Verify a Professional
Red flags the Council's own rules name
The Council's own guide says “Many QSAs can also provide additional security-related services such as ongoing vulnerability assessment and remediation.” It allows that and fences it: its qualification rules for QSA companies, version 4.3 of September 2026, set out what an assessor may not do while selling to you. Any of these in a proposal is a reason to ask questions.
Red flag
A fix list that only names the assessor's own products
“When recommending remediation actions that include one of its own solutions or products, the QSA Company must also recommend other market options that exist.”
Red flag
“PCI requires our tool”
The QSA company must not “state or imply that PCI DSS or any other PCI SSC Standard requires usage of the QSA Company's products or services.”
Red flag
An upsell sold on the QSA badge
The QSA company “will not use its status as a ‘listed QSA’ to market services unnecessary to bring QSA Company clients into compliance.”
Red flag
No disclosure when it assesses what it runs for you
The QSA company “must fully disclose in the Report on Compliance if it assesses any customer that uses any security-related device or security-related application” it built, owns, configured or manages.
What “service provider” means in PCI
The phrase “PCI compliance service provider” gets used for consultants. In PCI DSS it means something narrower: a third-party service provider is one “with which account data is shared or that could affect the security of account data.” Your processor, gateway or web host is one; a consultant is not, unless it can see or affect your account data. Requirement 12.8.1 has you keep a list of every one, with a description of the service. For the order the yearly work runs in, see how to become PCI compliant, and for a charge from your processor, PCI compliance fees.
Questions
Does a small merchant need a QSA?
Only if your acquirer or a card brand asks for a Report on Compliance. Each card brand runs its own compliance program, which decides whether an entity “is eligible to complete a Self-Assessment Questionnaire (SAQ) or must complete a Report on Compliance (ROC).” Ask your acquirer which form it wants. The merchant level calculator explains how your level is set.
A QSA can still help with an SAQ. The Council's SAQ instructions say: “If you would like to engage a security professional for help with your self-assessment, we encourage you to consider contacting a Qualified Security Assessor (QSA).”
What is the difference between a PCI consultant and a QSA?
“QSA companies are qualified by PCI SSC to validate an entity's adherence to PCI DSS requirements.” The Council keeps a public list of them. “PCI consultant” is not a Council title, so there is no list of consultants to check.
Individual consultants may hold a Council qualification such as PCI Professional (PCIP) or Internal Security Assessor (ISA). Ask for the certificate number and check it in the Council's Verify a Professional search.
Can the firm that fixed my systems also assess them?
The Council's QSA rules require separation of duties so assessors are “independent and not subject to any conflict of interest,” and the firm must disclose in the Report on Compliance any security device or application it built, configured or manages for you. Ask a firm, before it starts, which of its people will consult and which will assess.
Can my consultant run the quarterly scan?
Only if the consultant's firm is a listed Approved Scanning Vendor. Merchants “must use only ASVs to perform external vulnerability scans at least once every three months as required by PCI DSS Requirement 11.3.2.” Our ASV scanning vendors compared covers the listed firms that sell to small merchants.
Does compliance software replace a QSA?
No. Vanta answers this on its own PCI page: “Vanta does not replace a Qualified Security Assessor. For organizations that require a formal ROC, you’ll still need a QSA.” Software organises evidence and guides an SAQ; it does not sign as an assessor.
Sources
- PCI SSC: Qualified Security Assessors list (page and CSV export) (pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Verify a Professional (pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Qualification Requirements for Qualified Security Assessors v4.3 (September 2026), section 2.2 (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: PCI DSS v4.x Quick Reference Guide, pp. 11–13 (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: SAQ Instructions and Guidelines, PCI DSS v4.0.1 r1 (Professional Assistance and Training) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Prioritized Approach Tool for PCI DSS v4.0.1 (Requirements 11.3.2, 11.4, 12.1.1, 12.5.2, 12.8.1) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: ASV Program Guide v4.0 r2, section 5.2 (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Approved Scanning Vendors list (export) (pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Glossary (pcisecuritystandards.org), read on 2026-10-22
- VikingCloud: PCI compliance for small businesses (vikingcloud.com), read on 2026-10-22
- VikingCloud: home page (vikingcloud.com), read on 2026-10-22
- SecurityMetrics: PCI audit (securitymetrics.com), read on 2026-10-22
- Thoropass: Thoropass becomes a QSAC for PCI payments (thoropass.com), read on 2026-10-22
- A-LIGN: PCI DSS (a-lign.com), read on 2026-10-22
- Vanta: PCI DSS compliance software (vanta.com), read on 2026-10-22