How to Choose the Best PCI QSA Company in the UK (and Verify One)

To choose the best PCI QSA in the UK for your organisation, first confirm the company appears on the PCI Security Standards Council’s list of Qualified Security Assessor companies for your region. Then compare shortlisted firms on relevant experience, who will actually do the work, how they scope and handle evidence, how they keep advice separate from assessment, and whether the proposal states scope, days and deliverables. Predictability matters more than the lowest price.

This guide covers who can assess you, how to verify an assessor, what to compare when you shortlist and the questions to ask before you sign.

Key takeaways

• Only a PCI SSC-listed QSA company (or, in limited cases, your own ISA) can complete a Report on Compliance.
• Verify the company on the PCI SSC website and ask who the named assessors are.
• Not every PCI consultant is a QSA, and “PCI certified” badges mean little on their own.
• Independence rules stop an assessor from assessing work it designed, implemented or sold to you.
• Look for clear scoping and a transparent proposal; treat guaranteed outcomes as a red flag.

Who can carry out your PCI assessment?

Only a QSA company listed by the PCI SSC, through its individually qualified QSAs, can assess any organisation and produce a Report on Compliance (ROC) and Attestation of Compliance (AOC). An Internal Security Assessor (ISA) can assess only the organisation that employs them, and only where the acquirer and card brands allow it. Our PCI QSA page explains the QSA, QSA company and ISA roles in full, and our explainer on the ROC, AOC and SAQ shows how the documents fit together.

QSA, QSA company (QSAC) and ISA are often confused, and several other titles sound similar but do not qualify anyone to assess you:

The practical point: a consultant who is not a QSA can help you prepare, but their interpretation is not the one that counts at assessment. If you use one, involve your QSA early.

Whether you need a QSA at all depends on your merchant or service provider level and on your acquirer. Level 1 merchants and Level 1 service providers generally need an annual ROC, while smaller merchants usually self-assess unless the acquirer requires a QSA, for example after a security incident. Our guides to PCI compliance levels and PCI compliance in the UK explain the thresholds and how UK acquirers apply them.

What to check on the PCI SSC listing before you sign

Before you sign, check four things. For how to find candidates in the first place, see our guide to finding and verifying a PCI QSA.

1. Check the list. Search the PCI SSC Qualified Security Assessor list. Confirm the company name matches the legal entity on your proposal and that it is qualified for the region where you operate.
2. Check the people. Ask for the names of the assessors who will lead and perform the work, and confirm they are current QSAs employed by that company. QSA status is tied to the employing QSA company.
3. Check other programmes if you need them. If you also need PIN security or card production assessments, confirm the company is listed as a Qualified PIN Assessor or Card Production Security Assessor.
4. Be wary of badges. A logo or “PCI certified” claim on a website is not evidence. The PCI SSC listing is.

How do you choose a PCI QSA company?

What questions should you ask a QSA before you sign?

• Which of your assessors will lead our assessment, and are they current QSAs?
• Which organisations like ours have you assessed?
• How will you confirm scope, and will you put it in writing before fieldwork?
• What evidence will you need, and how do we share it securely?
• Will fieldwork be on site, remote or both?
• Will you tell us about potential findings during fieldwork?
• How do you keep consultancy and assessment separate?
• How will penetration testing, segmentation testing and ASV scans be delivered?
• What would change the price or timetable?
• What happens if we are not ready by the planned fieldwork date?

To compare firms side by side, download these questions as a free checklist (.xlsx). It adds the listing checks above and has a column for each of up to three QSA companies, so you can rate every answer.

What independence rules apply to your QSA?

PCI SSC independence rules prevent a QSA company from assessing controls, products or services it designed, implemented or sold to you. Within those limits, the same company can run a gap analysis or readiness review and then carry out your assessment. Ask how the firm separates the two, for example by using different people for advice and assessment. Our PCI DSS consultancy page explains whether the same company can consult and assess, and how we keep the two apart.

Who are the best PCI QSA companies in the UK?

There is no official ranking, and any list that claims to be one is marketing. The PCI SSC’s QSA list is the only authoritative source of who is qualified. Shortlist two or three listed companies with experience of your sector, put the questions above to each, and ask for a reference from a similar organisation.

What will a QSA charge?

Price depends on scope: payment channels, locations, systems, third parties and whether you need a full ROC or support with an SAQ. If you are not sure which applies, our free PCI compliance check suggests your likely SAQ. A good QSA scopes the work before quoting and explains what is and is not included. Our guide to PCI compliance cost explains the drivers.

Working with Sovereign Secure

Sovereign Secure is a PCI SSC-approved QSA company, Qualified PIN Assessor and Card Production Security Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028. Established in 2012 and based in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka, we deliver PCI compliance audits, PCI DSS penetration testing and quarterly PCI ASV scans through our PCI SSC Approved Scanning Vendor partner. If you are comparing assessors, contact us to talk through your scope before you commit, and our guide on how to prepare for a PCI DSS audit covers what happens next.