Coalfire
Coalfire is one of the largest PCI assessment practices in the world, performing hundreds of PCI DSS assessments a year for merchants and service providers of every size. Its PCI practice covers Level 1 ROC assessments, SAQ validation, penetration testing, and ASV scanning alongside broader advisory services.
At a glance
| Headquarters | Denver, Colorado |
|---|---|
| Founded | 2001 |
| Firm type | Cybersecurity and compliance assessment firm (QSA company) |
| ROC planning range | $25K–$150K (published planning range (Sept 2026)) |
| Typical fieldwork window | 4–12 wk |
| Frameworks (per firm) | PCI DSS, SOC 2, ISO 27001, HITRUST, FedRAMP |
| Official website | coalfire.com |
Best fit
Large merchants and service providers that need a Level 1 ROC from a deeply experienced, high-volume assessor.
Before you engage
A large practice -- confirm your engagement team, fieldwork dates, and fee structure before signing.
Questions about Coalfire
How much does a Coalfire PCI assessment cost?
Coalfire does not publish PCI pricing -- request a scoped quote. Published planning ranges for large-practice ROC engagements run $25K–$150K (September 2026).
Is Coalfire a QSA company that can sign a ROC?
Coalfire is listed here as a cybersecurity and compliance assessment firm operating as a QSA company. Only a PCI SSC-listed QSA company can sign a Report on Compliance -- confirm the current listing before engaging.
Does Coalfire cover frameworks beyond PCI?
Per public materials: PCI DSS, SOC 2, ISO 27001, HITRUST, and FedRAMP -- useful if PCI is one track of a larger assurance program.
Get a scoped quote
Assessment fees depend on your environment, scope, and readiness. Get comparable quotes from Coalfire and similar assessment firms.
Request quotes from Coalfire & peersFree · No obligation · Takes 2 minutes
Alternatives to Coalfire
Comparable firms buyers also evaluate -- same buyer type, different trade-offs:
SecurityMetrics
PCI-focused compliance company · $15K–$75K
LevelBlue (formerly Trustwave)
Managed security services provider with PCI assessment practice · $25K–$150K
ControlCase
Compliance assessment and managed-compliance firm · $15K–$75K
Compare quotes from these firms
One request reaches the firms above -- scoped quotes, free, no obligation.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.