Our methodology

Exactly how we choose firms, what we verify, how we label prices -- and what we refuse to do.

Which firms get listed

A firm appears in our directory only if, as of our last check, it meets all three:

• It operates an active public website offering PCI DSS assessment services -- verified by direct load check, not a database scrape.
• It positions itself as a PCI assessment / QSA practice in its own public materials.
• Its PCI service is real and current -- service pages, not just a keyword on a services list.

What we verify -- and what we don't claim

For each firm we record headquarters, firm type, and the frameworks its own public materials say it supports. Directory facts were last verified in September 2026; we aim to re-check quarterly.

How we label every price

Assessment fees are scoped per engagement, so most firms publish no prices at all. Where we show a planning range, it always carries one of three labels:

None of these are quotes. Your fee depends on merchant level, CDE scope, locations, and readiness. Treat every band as a planning figure and get scope and fee in writing.

Timelines

Where shown, the "fieldwork window" is the active assessment phase once evidence is ready -- not the full engagement. A Level 1 ROC also needs scoping, remediation, and reporting time around it. Vendor marketing timelines don't count.

What we will never do

• No star ratings or review scores. We have not hired these firms and won't compress fit into a number.
• No testimonials. Every quote-like line on this site would be fabricated -- so there are none.
• No pay-for-rank. Ever. Firms cannot pay to be listed, ranked higher, recommended, or have a profile softened. Some directories sell "featured" placement; we don't sell placement at all.
• No invented statistics. Every number on this site has a clickable source.

How we make money

When you request quotes, matched assessment firms may pay us a lead or referral fee. That payment cannot change which firms we list, what our guides say, or which firms we recommend -- the firewall is absolute, and firms can't buy their way around it.

Corrections

Wrong price, stale fact, firm missing? Tell us. We check corrections against the firm's own public materials and note material fixes on the affected page with a date.

Verification log

Row-level verification of every firm website in the directory, checked 2026-09-24 with a browser User-Agent. One firm (CompliancePoint) was unreachable from our network and was excluded rather than listed unverified. Trustwave now redirects to LevelBlue (rebrand) and is listed under its current name.