Contact Us

Services

Suite of Services

Schellman began as a SOC audit firm 20+ years ago. While we still issue more than 2,000 SOC reports each year, our clients’ trust has propelled our expansion. Today, we offer nearly 60 types of audits and assessments.

Download a PDF of All Services

Learning Center

Our Technology

About Us

About Us

Schellman is the only Top 50 CPA firm focused exclusively on IT Compliance and Cybersecurity, and we’re the #1 service provider for FedRAMP Assessments.Our industry-leading NPS scores, client retention, and employee retention (low-to-no team churn = less audit fatigue) mean our clients experience greater continuity and quality.We also understand how distracting unplanned work can be, so we focus on client-centric KPIs to help keep your business moving uninterrupted.

ISO Certificate Directory

Services

Services

View All Services

SOC & Attestations

SOC & Attestations

SOC 1 / SSAE 18 Examination

SOC 2 Examination

SOC 3 Examination

SOC for Supply Chain

SOC for Cybersecurity

SOC Essentials for Early-Stage Companies

C5 Attestation

CSA STAR Programs

Payment Card Assessments

Payment Card Assessments

PCI DSS Validation

PCI SSF

PCI P2PE Validation

PCI PIN Assessments

PCI 3DS Compliance

ISO Certifications

ISO Certifications

ISO 27001

ISO 42001

ISO 27701

ISO 9001

ISO 22301

ISO-20000-1

Privacy Assessments

Privacy Assessments

APEC Certification

GDPR Assessment

International Privacy Assessments

US State Privacy Assessments

Microsoft SSPA/DPR Assessment

Privacy Program Assessment

FERPA Assessment

EU Cloud Code of Conduct

Federal Assessments

Federal Assessments

FedRAMP®

CMMC / NIST SP 800-171

FISMA/NIST

ITAR

CJIS

IRAP

FTC Consent Decrees

DoD IL6

Healthcare Assessments

Healthcare Assessments

HITRUST Certification

HIPAA Compliance

HIPAA Express

EPCS-DEA Audits

Health Data Host (HDS) Certification

Penetration Testing

Penetration Testing

Application

Network

Mobile

Red Teaming

Social Engineering

Cloud

Physical

Hardware and IoT

Advanced Series

Cybersecurity Assessments

Cybersecurity Assessments

Cloud Configuration Assessments

Ransomware Assessments

NIST Cybersecurity Framework Assessments

Schellman Software Security Assessment (S³A)

TISAX®

SWIFT Customer Security Programme

Internal Audit Co-Sourcing

Crypto and Digital Trust

Crypto and Digital Trust

Schellman Training

Schellman Training

Sustainability Services

Sustainability Services

AI Services

Learning Center

Our Technology

About Us

About Us

Leadership Team

Leadership Team

Corporate Social Responsibility

Corporate Social Responsibility

Careers

Strategic Partnerships

Strategic Partnerships

ISO Certificate Directory

Blog

Video

Stay up to date and discover new insights into compliance through our team’s thought leadership.

Matt Crane

Matt Crane is a Director at Schellman, where he excels in project management and client relations while overseeing assessments against various PCI Standards. With a primary focus on PCI DSS Compliance for organizations spanning diverse industries, Matt leverages a decade of expertise in information security services. Prior to joining Schellman in July 2017, Matt held key positions in both the private and public sectors, specializing in PCI and NIST assessments, as well as intelligence analysis. His extensive background includes leading PCI engagements, performing risk assessments, and general consulting services for merchants and service providers across multiple industry verticals. With an exceptional track record and a profound understanding of the industry, Matt Crane is a valuable asset to Schellman, ensuring clients receive unparalleled guidance in achieving their compliance goals. Matt holds a BBA in Information Security and Assurance as well as several industry certifications including CISSP, CISA, CRISC, QSA,

Blog Feature

SAQ A Updates: Ensuring Your E-Commerce Site is Safe from Script Attacks

By: Matt Crane
March 17th, 2025

If you're an e-commerce merchant using an iframe or redirect for payment processing, recent updates to the PCI DSS SAQ A may impact how you maintain compliance. While these changes simplify requirements, a new eligibility rule has been introduced that could affect your compliance status. Here’s what you need to know.

Blog Feature

Understanding SAQ A Eligibility for E-Commerce PCI Compliance

By: Matt Crane
March 17th, 2025

For e-commerce merchants, navigating PCI compliance can be complex, especially when it comes to determining eligibility for Self-Assessment Questionnaire A (SAQ A). If you're unsure whether your business qualifies or what completing the SAQ entails, this guide will help clarify key requirements, recent updates, and potential consequences of non-compliance.

Blog Feature

New Access Controls in PCI DSS v4

By: Matt Crane
May 3rd, 2024

We've received a lot of questions recently about the new access control requirements and PCI DSS version 4. Today, we're going to review those and hopefully we can answer your questions.

Blog Feature

Payment Card Assessments

The New Report Dates in PCI DSS v4.0 Explained

By: Matt Crane
October 26th, 2023

To address some of the past confusion regarding the dating of PCI reports, the PCI Security Standards Council (SSC) has altered the report date methodology for PCI DSS v4.0 to provide more clarity and consistency to this process.

Blog Feature

Payment Card Assessments

What is a PCI DSS Readiness Assessment?

By: Matt Crane
May 25th, 2022

Blog Feature

Payment Card Assessments

What Are The Top 5 New Requirements in PCI DSS V4?

By: Matt Crane
April 5th, 2022

Haga clic aquí para ver este video en español

Blog Feature

Payment Card Assessments

What to Expect with the PCI DSS V4.0 Release

By: Matt Crane
March 31st, 2022

So you've probably heard about PCI DSS v.4 and you're asking yourself, "When can I expect the new release and what about the new requirements?" Schellman's Matt Crane provides an overview in this quick 2-minute video.

{