PCI QSA Companies in Australia: the Council's List, Explained

Where the list comes from

There is exactly one authoritative list of Qualified Security Assessor (QSA) companies: the one the PCI Security Standards Council publishes and updates as companies qualify, requalify or drop off. Everything below comes from that list, retrieved on 7 September 2026. For the current version, filterable by country, see the QSA and ASV directory on this site, which is refreshed from the Council's list on every deployment and labels its paid placements, or go to the Council's own lookup.

Two things to know before reading it. The Council records each company's places of business, not its headquarters, so the Australian list mixes firms headquartered here with global firms that have an Australian office. And every company below is flagged by the Council as able to assess against PCI DSS v4; the Council's "In Remediation" status, which it applies when a quality assurance review finds a company has breached the QSA validation requirements, applied to none of them on that date.

The 47 QSA companies with a place of business in Australia

Company	Website	Formerly
1 CYBER VALLEY LIMITED	www.onecybervalley.com
1stSecureIT LLC (dba GM SECTEC)	www.1stsecureIT.com	1st Secure IT, LLC
AMPCUS CYBER INC.	www.ampcuscyber.com
CIANAA TECHNOLOGIES LIMITED	cianaatech.com/services/achieve-pci-dss-compliance	Ather Technology Limited, dba Cianaa Technology
CIPHERSHIELD PTY LTD	cyberproof.au	dba CYBERPROOF
CLOUDTRACE PTY LTD	www.cloudtrace.com.au
Compliance Wing Pty Ltd	www.compliancewing.com
Crossbow Labs LLP	www.crossbowlabs.com
CYBERCUBE SERVICES PVT. LTD.	www.cybercube.co.in
CyberCX Pty Ltd.	www.cybercx.com.au	Shearwater Solutions Pty Ltd
CYBERNETIC GLOBAL INTELLIGENCE	www.cyberneticgi.com
CYPHERLEAP PTY LTD	cypherleap.com
Dataprotect	www.dataprotect.ma
DotSec Pty Ltd	www.dotsec.com
EIC Limited	www.eic.com.bd	Enterprise Infosec Consultants
FIVE TATTVA CYBERHUB SECURITY LLP	www.5tattva.com
Foregenix Ltd.	www.foregenix.com
Globaltech & Infosec Private Limited	www.gtisec.com
GRC 360 Pvt. Ltd.	www.GRC360.net
IGRC Square	igrcsquare.com
Information Systems Services Pty. Ltd. t/a CyberZone Global	www.cyberzoneglobal.com
International Business Machines Corporation	www.ibm.com/security
MCI Communications, Inc. dba Verizon Business Services	enterprise.verizon.com/products/security/security-advisory-services	Verizon/CyberTrust
NCC GROUP PTY LIMITED	www.nccgroup.com/au
NCC Group Security Services Limited	nccgroup.com	NCC Services Ltd
Network Intelligence Pvt. Ltd.	www.networkintelligence.ai	Network Intelligence India Pvt. Ltd.
Panacea Infosec (P) Ltd.	www.panaceainfosec.com
PCI Consulting Australia PTY, LTD	www.pciconsultingaustralia.com.au
Protiviti	www.protiviti.com
REDSECLABS LIMITED	redseclabs.com
Risk Associates Europe Ltd.	www.risk-associates.com
Secure Logic Pte. Ltd.	www.securelogicgroup.com	Secure Logic Pty Ltd
SecuriCentrix	securicentrix.com
Security Centric Pty Ltd	www.securitycentric.com.au
SecurWires Technologies and Services LLP	www.securwires.com
Sekuro Pty. Ltd.	www.sekuro.io	Privasec Pty. Ltd
SISA	www.sisainfosec.com
Sovereign Secure Ltd.	sovereignsecure.co.uk
Stickman Consulting	www.stickmancyber.com (listed as www.stickman.com.au)
Stratica Australia Pty Ltd DBA Stratica	www.stratica.com.au	Stratica International PTY LTD
Thales Cyber Services Australia Pty Ltd	www.tesserent.com	Tesserent Cyber Services Pty Limited, Loop Secure Pty Limited
Triskele Labs	www.triskelelabs.com
TUV Rheinland Indonesia, PT	www.tuv.com	TUV Rheinland Secure iT-GmbH
TUV SUD South Asia Pvt. Ltd.	www.tuev-sued.de	TUV SUD Sec-IT GmbH/Acertigo, TUV SUD Management Service GmbH
Vectra Corporation Ltd.	www.vectra-corp.com
VikingCloud, Inc.	www.vikingcloud.com	NuArx, Inc.
VISTA InfoSec Private Limited	www.vistainfosec.com

How to verify a QSA company yourself

The list changes, so check it at the time you engage, not the last time you looked.

1. Open the Council's Qualified Security Assessors page.
2. Filter by country (Australia) or search for the company by name.
3. Confirm the company is listed, that it is not marked In Remediation, that it is qualified for PCI DSS v4, and that its servicing markets include Asia Pacific (AP).
4. Ask the company which named QSA will lead your assessment, and confirm that person's status; individual QSAs are qualified separately from their company, and the Council's page links a way to verify a professional.

What a QSA company does

A QSA company employs assessors qualified by the Council to validate an organisation's compliance with PCI DSS. In practice that means scoping the cardholder data environment, examining evidence against each requirement, testing controls, writing the Report on Compliance (ROC) and signing the Attestation of Compliance (AOC). Many also offer gap assessments and remediation advice ahead of a formal assessment.

Who needs one

Not everyone. The payment brands' compliance programmes put the largest merchants and service providers, by transaction volume, at Level 1, and those validate with an annual Report on Compliance, completed by a QSA or, where the brand allows, by a qualified Internal Security Assessor (ISA). The thresholds are set by each brand. Smaller merchants usually self-assess with the applicable SAQ, and may still engage a QSA for help with scoping or where their acquirer asks for an assessor's involvement. Your acquirer's requirements decide; ask them first. Find my SAQ works out which questionnaire applies.

Choosing between them

The Council's list tells you who is qualified, not who is right for you. What separates QSA companies is experience with your kind of environment (retail terminals, e-commerce, a service provider platform), the regions and languages they cover, how they run an assessment, and what they charge. For a checklist of questions to ask, see How to select a Qualified Security Assessor, and if you are not yet sure an assessment is required at all, Do You Need a PCI DSS Audit?.

Frequently asked questions

What is the difference between a QSA and a QSA company?

A QSA is an individual assessor qualified by the Council. A QSA company is the firm that employs them and holds the company-level qualification. Both are listed by the Council, and both must requalify.

What does "In Remediation" mean?

The Council applies it when its quality assurance review finds that a QSA company has breached the QSA validation requirements. The Council's page points to its QSA remediation statement for more, and suggests contacting the company about its particular status.

Can a QSA company in another country assess an Australian business?

Yes. The Council lists the servicing markets for each company, and many of the firms above serve Australia from offices elsewhere. Check the markets on the Council's entry and ask where the assessors will actually be based.