Head-to-head
A-LIGN vs Schellman: PCI DSS assessment compared
Both are large, credible QSA companies — the choice is volume and process (A-LIGN) versus seniority and independence (Schellman).
| A-LIGN | Schellman | |
|---|---|---|
| Headquarters | Tampa, Florida | Tampa, Florida |
| Firm type | QSA company (QSAC) | QSA company (QSAC) |
| ROC planning range | $40K–$100K (planning estimate (Sept 2026)) | $50K–$120K (planning estimate (Sept 2026)) |
| Fieldwork window | 4–8 wk | 6–12 wk |
| Frameworks | PCI DSS, SOC 1, SOC 2, ISO 27001, HITRUST, pen testing | PCI DSS, SOC 1, SOC 2, ISO 27001, HITRUST, FedRAMP |
Planning ranges are estimates (September 2026), not quotes. Firm facts from public materials, verified September 2026.
Choose A-LIGN if you want a high-volume, technology-enabled QSA with broad multi-framework coverage at a mid-market planning range.
Choose Schellman if you want senior-led engagement teams and an independence-focused premium practice for regulated buyers.
The honest take. Both firms can produce a perfectly valid ROC — the difference is fit, not legitimacy. Get scoped quotes from both and compare the engagement letter line by line: named team, fee-breaker clauses, remediation support, and what's excluded.
Get quotes from A-LIGN and Schellman
One request, both firms, side-by-side scoped quotes. Free, no obligation.
How it works: tell us once (4 questions, 2 min) → we match accredited QSA companies to your size and scope → they send scoped quotes directly. Free, no obligation.