Compliance audit firms

PCI DSS

Cybersecurity consultancy offering PCI DSS QSA assessments, PCI PIN advisory and managed security services (London address from its contact page); listed by the PCI SSC as a Qualified Security Assessor company.

London, England

PCI DSS

London-based cybersecurity consultancy (2-sec Limited) offering penetration testing and PCI DSS services; listed as a PCI QSA.

London, England

SOC 1SOC 2ISO 27001ISO 27701 +4

St. Petersburg, Florida firm performing SOC examinations, ISO certification, HITRUST, PCI DSS and FedRAMP assessments.

St. Petersburg, Florida

ISO 27001

Hillegom-based certification body; RvA-accredited for ISO/IEC 27001 certification.

Hillegom, South Holland

ISO 27001

Management systems certification body in Warrington offering remote and onsite audits; UKAS-accredited for ISO/IEC 27001 certification.

Warrington, England

CERT-In

Navi Mumbai-based cloud security and cybersecurity firm listed as a CERT-In empanelled information security auditor.

Navi Mumbai, Maharashtra

ISO 27001ISO 27701ISO 42001HITRUST +4

Tampa-headquartered cybersecurity compliance firm covering ISO certification, HITRUST, FedRAMP, PCI DSS and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +2

Alpharetta, Georgia assurance and compliance firm offering SOC 1 and SOC 2 reports, PCI DSS, HITRUST and FedRAMP assessments.

Alpharetta, Georgia

ISO 27001

Certification body in Spring, Texas, offering accredited ISO/IEC 27001 certification alongside quality, environmental and asset-management standards.

Spring, Texas

PCI DSS

Barueri-based security firm listed by the PCI SSC as a QSA company, offering PCI DSS audits.

Barueri, São Paulo

PCI DSS

King of Prussia, Pennsylvania cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company; its site lists PCI ROC/SAQ services.

King of Prussia, Pennsylvania

PCI DSSHITRUST

Cybersecurity and compliance firm headquartered in East Brunswick, New Jersey with offices in Bengaluru and Pune; listed as a PCI QSA and HITRUST External Assessor.

East Brunswick, New Jersey · Bengaluru, Karnataka · Pune, Maharashtra

CERT-In

Risk and advisory firm with offices in Noida, Mumbai and Bengaluru; CERT-In empanelled information security auditor.

Noida, Uttar Pradesh · Mumbai, Maharashtra · Bengaluru, Karnataka

ISO 27001

UK certification body of the French AFNOR group (Swindon address on its site and UKAS schedule); UKAS-accredited for ISO/IEC 27001 certification.

Swindon, England

PCI DSS

Singapore-based security audit and assessment firm; listed as a PCI SSC Qualified Security Assessor company.

Singapore

CERT-In

Noida-headquartered cybersecurity audit firm with offices in Delhi and Navi Mumbai; listed as a CERT-In empanelled auditor.

Noida, Uttar Pradesh · New Delhi, Delhi · Navi Mumbai, Maharashtra

PCI DSS

Dubai-headquartered cybersecurity audit firm listed as a PCI Qualified Security Assessor (QSA) company.

Dubai, Dubai

CERT-In

Noida-based consultancy listed as a CERT-In empanelled information-security auditor.

Noida, Uttar Pradesh

ISO 27001

UK management systems certification body (Cannock address from the UKAS schedule); UKAS-accredited for ISO/IEC 27001 certification.

Cannock, England

CERT-In

Chennai-based cyber risk and compliance consultancy listed as a CERT-In empanelled auditor.

Chennai, Tamil Nadu

PCI DSSHITRUST

Chantilly, Virginia cybersecurity firm listed as a PCI QSA (places of business include USA, UK and India) and HITRUST External Assessor.

Chantilly, Virginia

PCI DSS

Cybersecurity firm registered in Whiteley, Hampshire (AMR CyberSecurity Ltd); listed as a PCI QSA.

Whiteley, England

ISO 27001

Irish company of the Amtivo certification group (formerly Certification Europe), accredited by INAB for ISO/IEC 27001 certification, based in Park West, Dublin 12.

Dublin, Dublin

ISO 27001

US certification body of the Amtivo group, based in Arvada, Colorado, offering accredited ISO/IEC 27001 certification among other management-system standards.

Arvada, Colorado

CERT-In

Pune-based cybersecurity and digital forensics firm listed as a CERT-In empanelled auditor.

Pune, Maharashtra

CERT-In

Mumbai-based risk management and advisory firm with a Delhi branch office; listed as a CERT-In empanelled information security auditor.

Mumbai, Maharashtra · New Delhi, Delhi

PCI DSSFedRAMPCMMC

Fredericksburg, Virginia assessment firm listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.

Fredericksburg, Virginia

CERT-In

Navi Mumbai-based cybersecurity firm listed as a CERT-In empanelled auditor.

Navi Mumbai, Maharashtra

ISO 27001ISO 27701

Management systems certification body in Denton, Greater Manchester (UKAS schedule address); UKAS-accredited for ISO/IEC 27001 and ISO/IEC 27701 certification.

Denton, England

SOC 2ISO 27001ISO 27701ISO 42001 +5

Atlanta-based CPA and advisory firm listed across SOC, ISO, FedRAMP, HITRUST, PCI DSS and CMMC assessor registries.

Atlanta, Georgia

CERT-In

Mumbai-based testing and information security services company listed as a CERT-In empanelled auditor.

Mumbai, Maharashtra

CMMC

Aberdeen, Maryland CMMC assessment firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Aberdeen, Maryland

CERT-In

Noida-headquartered cybersecurity and framework audit firm with a Delhi office; listed as a CERT-In empanelled auditor.

Noida, Uttar Pradesh · Delhi, Delhi

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) certification.

Tokyo, Tokyo

PCI DSSHITRUSTISO 27001ISO 27701 +1

US accounting and consulting firm (first-listed office San Ramon, CA); listed as a PCI Qualified Security Assessor company and HITRUST External Assessor, with an ANAB-accredited ISO certification body (Armanino Certified, LLC).

San Ramon, California · Chicago, Illinois · New York, New York · +2 more

CERT-In

Bengaluru-based cybersecurity firm listed as a CERT-In empanelled auditor.

Bengaluru, Karnataka

ISO 27001

Certification body of the Aviation Suppliers Association in Washington, DC, offering accredited ISO/IEC 27001 certification alongside aviation-sector quality standards.

Washington, District of Columbia

CERT-In

IT services and security firm based in Bengaluru; CERT-In empanelled information security auditor.

Bengaluru, Karnataka

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification.

Tokyo, Tokyo

CERT-In

Cybersecurity advisory firm in Mumbai, formerly Fortune4 Advisors; CERT-In empanelled information security auditor.

Mumbai, Maharashtra

PCI DSS

Singapore-based payment security and PCI assessment firm; listed as a PCI SSC Qualified Security Assessor company.

Singapore

ISO 27001

London-based certification body (Atlas Certification Limited); UKAS-accredited for ISO/IEC 27001 certification.

London, England

ISO 27001

Australian certification body (ATLAS Certification Pty Ltd, established 2018) based in Mount Barker, SA, with offices on the Gold Coast, in Darwin and in Melbourne; JAS-ANZ accredited for ISO/IEC 27001 certification.

Mount Barker, South Australia · Burleigh Heads, Queensland · Ludmilla, Northern Territory · +1 more

PCI DSS

São Paulo-based audit and security consultancy listed by the PCI SSC as a QSA company.

São Paulo, São Paulo

PCI DSSCMMC

Tampa-based compliance assessment firm, described on its site as a division of Carr, Riggs & Ingram Capital, LLC; listed as a PCI QSA and CMMC C3PAO.

Tampa, Florida

CMMC

Rockville, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Rockville, Maryland

CERT-In

Navi Mumbai-based technology company listed by CERT-In as an empanelled information security auditing organisation.

Navi Mumbai, Maharashtra

CERT-In

Bengaluru-based cybersecurity strategy, governance and advisory firm listed as a CERT-In empanelled auditor.

Bengaluru, Karnataka

ISO 27001

Management systems certification body (Witham, Essex address from the UKAS schedule); UKAS-accredited for ISO/IEC 27001 certification.

Witham, England

PCI DSSHITRUSTFedRAMPISO 27001 +3

US advisory and accounting firm; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized assessor, with an ANAB-accredited ISO certification body (Baker Tilly Certifications LLC).

Chicago, Illinois

ISMAP

Tokyo-based audit firm (BDO member firm in Japan) registered as an ISMAP audit institution for Japanese government cloud security assessments.

Tokyo, Tokyo

PCI DSS

US member of the BDO network with its national headquarters in Chicago; listed as a PCI Qualified Security Assessor company.

Chicago, Illinois

ISO 27001ISO 27701

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017) and ISO/IEC 27701 certification.

Tokyo, Tokyo

PCI DSS

Cybersecurity and compliance consultancy based in Welwyn Garden City (per its site); listed as a PCI QSA.

Welwyn Garden City, England

CMMC

Sterling, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Sterling, Virginia

HITRUSTHIPAA

Dublin, Ohio healthcare security and compliance firm listed as a HITRUST External Assessor; offers HIPAA risk assessments.

Dublin, Ohio

CMMC

Technology and consulting firm headquartered in McLean, Virginia; authorized CMMC Third-Party Assessment Organization (C3PAO).

McLean, Virginia

CMMC

Oak Ridge, Tennessee government services firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Oak Ridge, Tennessee

SOC 1SOC 2ISO 27001

Minnesota CPA and advisory firm offering SOC 1 and SOC 2 reporting, with an ANAB-accredited affiliate for ISO 27001 certification.

Eden Prairie, Minnesota · Mankato, Minnesota · Minneapolis, Minnesota

ISO 27001ISO 27701

Certification body headquartered in 's-Hertogenbosch (Brand Compliance B.V.); RvA-accredited for ISO/IEC 27001 and ISO/IEC 27701 certification.

's-Hertogenbosch, North Brabant

PCI DSS

UK cybersecurity services firm with offices in Reading, London, Cardiff, Manchester and Edinburgh; listed as a PCI QSA.

Reading, England · London, England · Cardiff, Wales · +4 more

CERT-In

Chennai-headquartered cybersecurity firm listed as a CERT-In empanelled information security auditor.

Chennai, Tamil Nadu

ISO 27001

Kent-based certification body trading as Amtivo; UKAS-accredited for ISO/IEC 27001 certification.

West Malling, England

PCI DSS

Tokyo-based security services firm listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

ISO 27001ISO 27701ISO 42001

UK national standards body and certification body (UKAS schedule address: Milton Keynes); UKAS- and ANAB-accredited for ISO/IEC 27001 and ISO/IEC 42001 certification.

Milton Keynes, England

ISO 27001

Australian certification body of the BSI Group (UK), accredited by JAS-ANZ for ISO/IEC 27001 certification, with its head office in North Sydney.

North Sydney, New South Wales

ISO 27001ISO 27701PCI DSS

Yokohama-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017), ISO/IEC 27701 and ISO 22301 (business continuity) certification, also listed by the PCI SSC as a QSA company.

Yokohama, Kanagawa

ISO 42001

Dutch entity of BSI (UK), accredited by the RvA for ISO/IEC 42001 AI management system certification, based in Amsterdam.

Amsterdam, North Holland

PCI DSS

UK telecommunications and IT services company (London address from business.bt.com); listed by the PCI SSC as a Qualified Security Assessor company.

London, England

ISO 27001

Australian entity of the Bureau Veritas group (France), accredited by JAS-ANZ for ISO/IEC 27001 certification, headquartered in Melbourne.

Melbourne, Victoria · West Perth, Western Australia

ISO 27001

Brazilian certification company of the Bureau Veritas group, based in Barueri, accredited by Inmetro/Cgcre for ISO/IEC 27001 certification.

Barueri, São Paulo

ISO 27001ISO 27701ISO 42001

Mumbai-based Indian entity of the Bureau Veritas group (France); NABCB-accredited for ISO/IEC 27001, 27701 and 42001 certification.

Mumbai, Maharashtra

ISO 27001

Yokohama-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017) and ISO 22301 (business continuity) certification.

Yokohama, Kanagawa

ISO 27001ISO 27701

UK branch of the Bureau Veritas certification business (London); UKAS-accredited for ISO/IEC 27001, ISO/IEC 27701 and ISO 22301 certification.

London, England

CMMC

Oklahoma City, Oklahoma engineering and consulting firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Oklahoma City, Oklahoma

PCI DSS

Lincoln, Nebraska security firm listed as a PCI Qualified Security Assessor (QSA) company.

Lincoln, Nebraska

PCI DSS

UK business of the Capgemini consulting and technology services group (London office from its UK contact page); Capgemini UK Plc is listed by the PCI SSC as a Qualified Security Assessor company.

London, England

ISO 27001

Certification body based in Joinville, Santa Catarina, accredited by Inmetro/Cgcre for ISO/IEC 27001 certification.

Joinville, Santa Catarina

PCI DSSISO 27001ISO 27701

Cleveland-headquartered professional services company; its CBIZ Security & Compliance, LLC unit is a PCI Qualified Security Assessor company and an ANAB-accredited ISO/IEC 27001 and 27701 certification body.

Cleveland, Ohio · Tampa, Florida

PCI DSS

Vernon Hills, Illinois IT solutions provider whose security practice is listed as a PCI Qualified Security Assessor (QSA) company.

Vernon Hills, Illinois

ISO 27001

Kassel-based certification body; DAkkS-accredited for ISO/IEC 27001 and ISO 22301 certification.

Kassel, Hesse

ISO 27001

Manchester-based certification body (Centre for Assessment Limited); UKAS-accredited for ISO/IEC 27001 certification.

Manchester, England

CERT-In

Scientific society of the Ministry of Electronics and Information Technology (Government of India). Its CERT-In empanelled Hyderabad centre offers VA/PT, security testing and audit services to government and private organisations.

Hyderabad, Telangana

ISO 27001

The Hague-based certification body; RvA-accredited for ISO/IEC 27001 certification.

The Hague, South Holland

CERT-InISO 27001

Certification and assurance firm at Infopark Koratty (Thrissur, Kerala); NABCB-accredited ISO 27001 certification body and CERT-In empanelled auditor.

Thrissur, Kerala

CERT-In

Surat-headquartered cybersecurity consultancy with a Mumbai office, listed as a CERT-In empanelled auditor.

Surat, Gujarat · Mumbai, Maharashtra

CERT-In

New Delhi-based cybersecurity consulting firm listed as a CERT-In empanelled auditor.

New Delhi, Delhi

ISO 27001

Hildesheim-based certification and testing company (CERTIAS GmbH); DAkkS-accredited for ISO/IEC 27001 management system certification and also offers energy-sector IT security catalogue certification.

Hildesheim, Lower Saxony

ISO 27001

Brisbane-headquartered (Brendale) certification body with offices in Adelaide, Melbourne, Perth and Sydney; JAS-ANZ accredited for ISO/IEC 27001 certification.

Brisbane, Queensland · Adelaide, South Australia · Melbourne, Victoria · +2 more

ISO 27001

Certification body based in Wietmarschen-Lohne, Lower Saxony (CERTivation GmbH), offering accredited management system certification; DAkkS-accredited for ISO/IEC 27001.

Wietmarschen, Lower Saxony

ISO 27001

Certification and training body established in London in 2015; UKAS-accredited for ISO/IEC 27001 certification.

London, England

SOC 1SOC 2HITRUSTCMMC

CPA and advisory firm with offices across the US; performs SOC 1 and SOC 2 examinations and is listed as a HITRUST External Assessor and CMMC C3PAO.

Raleigh, North Carolina · Carlsbad, California · Torrance, California · +51 more

ISO 27001

Certification body in Hendrik-Ido-Ambacht (CIIO B.V.) serving sectors such as education, healthcare and public administration; RvA-accredited for ISO/IEC 27001, NEN 7510 and ISO 9001 certification.

Hendrik-Ido-Ambacht, South Holland

PCI DSS

Perth-based security advisory firm offering PCI DSS, ISO 27001 advisory and testing services; listed as a PCI SSC Qualified Security Assessor company.

Perth, Western Australia

CMMC

Burlington, Massachusetts firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Burlington, Massachusetts

ISO 27001

Newcastle (NSW) certification body (Citation Certification Pty Ltd, part of Citation Group Australia); JAS-ANZ accredited for ISO/IEC 27001 certification.

Newcastle, New South Wales

PCI DSS

Managed IT and cybersecurity services provider with UK offices in London, Leeds, Gloucester and Warrington; listed as a PCI QSA.

London, England · Leeds, England · Gloucester, England · +2 more

HITRUSTHIPAA

Nashville-based healthcare cybersecurity and compliance firm listed as a HITRUST External Assessor; its services include HIPAA risk analysis.

Nashville, Tennessee

PCI DSSHITRUST

US accounting and advisory firm with a Minneapolis office (220 South Sixth Street); listed as a PCI Qualified Security Assessor company and HITRUST External Assessor.

Minneapolis, Minnesota

FedRAMPGovRAMP

Columbia, Maryland cybersecurity firm listed as a FedRAMP 3PAO, offering FISMA, FedRAMP and NIST SP 800-171 compliance services.

Columbia, Maryland

ISO 27001

Noida-based certification body (Centre of Assessment for Excellence); NABCB-accredited ISO 27001 certification body.

Noida, Uttar Pradesh

ISO 27001ISO 27701ISO 42001HITRUST +4

Cybersecurity advisory and assessment firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST assessor, ISO certification body and (via Coalfire Federal) CMMC C3PAO.

Chicago, Illinois · Alpharetta, Georgia · Bellevue, Washington · +2 more

CERT-In

Pune-based security testing firm listed as a CERT-In empanelled auditor.

Pune, Maharashtra

CERT-In

New Delhi-based security audit and training firm listed as a CERT-In empanelled auditor.

New Delhi, Delhi

CMMC

Accounting and advisory firm whose advisory affiliate is listed as a CMMC C3PAO (Tysons, Virginia).

Tysons, Virginia

ISO 27001ISO 42001

Queensland-based (Tingalpa) certification body with offices in North Ryde, Melbourne and Tonsley; JAS-ANZ accredited for ISO/IEC 27001 and ISO/IEC 42001 certification.

Tingalpa, Queensland · North Ryde, New South Wales · Melbourne, Victoria · +1 more

PCI DSS

North Providence, Rhode Island IT security and compliance firm listed as a PCI QSA.

North Providence, Rhode Island

ISO 27001

Oshawa, Ontario certification body accredited by the Standards Council of Canada for ISO/IEC 27001 and CyberSecure Canada certification.

Oshawa, Ontario

CMMC

Laramie, Wyoming cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Laramie, Wyoming

ISO 27001ISO 27701

Certification body with a North America office in El Dorado Hills, California; ANAB-accredited for ISO 27001 and ISO 27701 certification audits.

El Dorado Hills, California

CERT-In

Cybersecurity and compliance consultancy headquartered in Gurugram; CERT-In empanelled information security auditor.

Gurugram, Haryana

PCI DSS

Knoxville, Tennessee security firm listed as a PCI Qualified Security Assessor (QSA) company.

Knoxville, Tennessee

ISO 27001ISO 27701ISO 42001HITRUST +5

Compliance assessment firm based in Fairfax, Virginia with an Indian entity in Mumbai; listed as PCI QSA, FedRAMP 3PAO, HITRUST assessor, C3PAO and CERT-In empanelled auditor. The Indian entity is NABCB-accredited for ISO/IEC 27001.

Fairfax, Virginia · Mumbai, Maharashtra

PCI DSS

London-based cybersecurity and compliance consultancy (Cortida Limited, registered office Buckhurst Hill, Essex); listed as a PCI QSA.

London, England · Buckhurst Hill, England

PCI DSSHITRUSTHIPAA

Reston, Virginia security compliance and assessment firm listed as a PCI Qualified Security Assessor (QSA) company and a HITRUST External Assessor; its site offers HIPAA-based assessments.

Reston, Virginia

CERT-InPCI DSS

Bengaluru-based cybersecurity firm with a Chennai office; listed as a CERT-In empanelled auditor and PCI QSA.

Bengaluru, Karnataka · Chennai, Tamil Nadu

PCI DSSHITRUST

US accounting and advisory firm whose Chicago office is its national headquarters; listed as a PCI Qualified Security Assessor company and HITRUST External Assessor.

Chicago, Illinois

PCI DSS

Cybersecurity services firm with offices in London and Gloucester (per its site); listed as a PCI QSA.

London, England · Gloucester, England

ISO 27001

Petawawa, Ontario certification body accredited by the Standards Council of Canada for ISO/IEC 27001 and CyberSecure Canada certification.

Petawawa, Ontario

SOC 2HITRUSTHIPAA

Encinitas, California compliance firm listed as a HITRUST External Assessor; SOC 2 attestation reports are issued through its licensed CPA firm, CyberCrest Controls RLLP.

Encinitas, California

CERT-InPCI DSS

Gurugram-based cybersecurity and compliance firm listed as a CERT-In empanelled auditor and PCI QSA.

Gurugram, Haryana

PCI DSS

Melbourne-headquartered cybersecurity services firm with offices across Australia, New Zealand and London; listed as a PCI SSC Qualified Security Assessor company.

Melbourne, Victoria · Sydney, New South Wales · Brisbane, Queensland · +8 more

PCI DSS

Sydney-based cybersecurity and compliance firm; listed as a PCI SSC Qualified Security Assessor company.

Sydney, New South Wales

CERT-In

Thanjavur-based cybersecurity firm listed as a CERT-In empanelled auditor.

Thanjavur, Tamil Nadu

PCI DSS

Brisbane-headquartered cybersecurity and compliance firm with offices in Melbourne, Pymble (NSW) and Wellington; listed as a PCI SSC Qualified Security Assessor company.

Brisbane, Queensland · Melbourne, Victoria · Pymble, New South Wales · +1 more

CERT-In

Mumbai-based cybersecurity and cloud security firm listed as a CERT-In empanelled auditor.

Mumbai, Maharashtra

FedRAMP

Service-disabled veteran-owned security and IT firm based in Severna Park, Maryland; listed on the FedRAMP Marketplace as a recognized third-party assessment organization (3PAO) since February 2026.

Severna Park, Maryland

CMMC

Silver Spring, Maryland cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Silver Spring, Maryland

CMMC

Melbourne, Florida cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Melbourne, Florida

CERT-InPCI DSS

Noida-based cybersecurity consulting firm with delivery centres in Mumbai, Bengaluru and Pune; listed as a CERT-In empanelled auditor and PCI QSA.

Noida, Uttar Pradesh · Mumbai, Maharashtra · Bengaluru, Karnataka · +1 more

CERT-InISO 27001

Gurugram-based information security firm with a Noida office; NABCB-accredited ISO 27001 certification body and CERT-In empanelled auditor.

Gurugram, Haryana · Noida, Uttar Pradesh

CERT-In

Noida-based cybersecurity firm listed as a CERT-In empanelled auditor.

Noida, Uttar Pradesh

CERT-In

Bengaluru-based cybersecurity firm listed as a CERT-In empanelled auditor.

Bengaluru, Karnataka

CERT-In

Bengaluru-based cyber risk advisory firm listed as a CERT-In empanelled information security auditor.

Bengaluru, Karnataka

CERT-In

Mumbai-based cybersecurity firm listed as a CERT-In empanelled auditor.

Mumbai, Maharashtra

PCI DSS

Data protection and cyber security consultancy based in Leeds; listed by the PCI SSC as a Qualified Security Assessor company.

Leeds, England

FedRAMPCMMC

Cary, North Carolina compliance assessment firm listed as a FedRAMP 3PAO and, through Sahaa Solutions, LLC, as a CMMC C3PAO.

Cary, North Carolina

CMMC

Melville, New York firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Melville, New York

ISO 27001ISO 27701

Bremen-based certification body with a second accredited site in Offenbach am Main; DAkkS-accredited for ISO/IEC 27001 certification including ISO/IEC 27701 privacy extension.

Bremen, Bremen · Offenbach am Main, Hesse

SOC 1SOC 2HITRUSTHIPAA

San Jose, California CPA firm offering SOC 1 and SOC 2 examinations, listed as a HITRUST External Assessor; offers HIPAA compliance services.

San Jose, California

ISO 27001ISO 27701

Certification arm of the Stuttgart-based DEKRA group with a Dutch certification entity in Arnhem; accredited by DAkkS for ISO/IEC 27001 and ISO 22301 and by RvA for ISO/IEC 27001 and ISO/IEC 27701.

Stuttgart, Baden-Württemberg · Arnhem, Gelderland

ISO 27001ISO 27701ISO 42001

US management system certification body of the DEKRA group, based in Atlanta, Georgia; ANAB-accredited for ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certification.

Atlanta, Georgia

ISO 27001FedRAMPHITRUST

US member firm of the Deloitte network. ANAB-accredited ISO/IEC 27001 certification body, FedRAMP-recognized third-party assessor and HITRUST External Assessor.

New York, New York · Chicago, Illinois · Arlington, Virginia · +15 more

ISO 27001

Certification body of Deloitte in Germany, based in Düsseldorf; DAkkS-accredited for ISO/IEC 27001 certification.

Düsseldorf, North Rhine-Westphalia

PCI DSS

Tokyo-based cybersecurity firm of the Deloitte Tohmatsu Group listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

HITRUSTCERT-In

Indian member firm of the Deloitte network. CERT-In empanelled information security auditor and HITRUST External Assessor.

Mumbai, Maharashtra · Pune, Maharashtra · Thane, Maharashtra · +14 more

ISMAP

Tokyo-based audit firm of the Deloitte Tohmatsu Group registered as an ISMAP audit institution for Japanese government cloud security assessments.

Tokyo, Tokyo

ISO 27001

Wildau (Brandenburg) certification body; DAkkS-accredited for ISO/IEC 27001 certification.

Wildau, Brandenburg

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) certification.

Tokyo, Tokyo

CERT-In

Bengaluru-based cybersecurity company (India registered office in Bengaluru; its site also lists a US-registered affiliate) listed as a CERT-In empanelled auditor.

Bengaluru, Karnataka

CERT-In

Bengaluru-based firm listed as a CERT-In empanelled information security auditor.

Bengaluru, Karnataka

CMMC

Colorado Springs, Colorado cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Colorado Springs, Colorado

ISO 27001

Eindhoven-based audit and certification body (Digitrust B.V.) focused on information security; RvA-accredited for ISO/IEC 27001, NEN 7510, ISO 9001 and ISO 14001 certification.

Eindhoven, North Brabant

PCI DSS

Cybersecurity firm with offices in Oxford and Glasgow; listed as a PCI QSA.

Oxford, England · Glasgow, Scotland

ISO 27001

Melbourne-based certification body; JAS-ANZ accredited for ISO/IEC 27001 information security management system certification.

Melbourne, Victoria

ISO 27001

Griesheim (Hesse) management system certification body; DAkkS-accredited for ISO/IEC 27001 and ISO 22301 certification.

Griesheim, Hesse

ISO 27001

Australian business assurance entity of the DNV group (Norway), accredited by JAS-ANZ for ISO/IEC 27001 certification, based in North Sydney.

North Sydney, New South Wales

ISO 27001

Kobe-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) certification.

Kobe, Hyogo

ISO 27001ISO 27701ISO 42001

Dutch certification entity of the DNV group (Norway), accredited by the RvA for ISO/IEC 27001, 27701, 42001 and ISO 22301 certification, based in Barendrecht near Rotterdam.

Barendrecht, South Holland

ISO 27001ISO 27701

UK certification entity of DNV (DNV Business Assurance UK Limited, London); UKAS-accredited for ISO/IEC 27001, ISO/IEC 27701 and ISO 22301 certification.

London, England

PCI DSS

Brisbane-based cybersecurity firm offering testing, managed security and compliance services including PCI DSS; listed as a PCI SSC Qualified Security Assessor company.

Brisbane, Queensland

ISO 27001

Frankfurt-headquartered management system certification group; DAkkS-accredited for ISO/IEC 27001 certification.

Frankfurt am Main, Hesse

ISO 27001ISO 42001

US entity of the DQS certification group, based in Schaumburg, Illinois; ANAB-accredited for ISO/IEC 27001 and ISO/IEC 42001 certification.

Schaumburg, Illinois

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) certification.

Tokyo, Tokyo

CERT-In

Jaipur-based cybersecurity services firm listed as a CERT-In empanelled auditor.

Jaipur, Rajasthan

PCI DSS

Durham, North Carolina security firm listed as a PCI Qualified Security Assessor (QSA) company.

Durham, North Carolina

ISO 27001

Utrecht-based certification body (Duijnborgh Certification B.V.); RvA-accredited for ISO/IEC 27001 information security management system certification.

Utrecht, Utrecht

ISO 27001

Dayton, Ohio management system certification body (EAGLE Registrations Inc.) accredited by ANAB for ISO/IEC 27001 certification.

Dayton, Ohio

ISO 27001

Adelaide-headquartered certification body with an office in Singapore; JAS-ANZ accredited for ISO/IEC 27001 certification.

Adelaide, South Australia · Singapore

HITRUSTCMMC

Waukee, Iowa compliance and cybersecurity firm listed as a HITRUST External Assessor and CMMC C3PAO.

Waukee, Iowa

ISO 27001

Testing and certification organisation focused on online gambling products (London address from the UKAS schedule); UKAS-accredited for ISO/IEC 27001 certification.

London, England

PCI DSS

New York City advisory and assurance firm listed as a PCI Qualified Security Assessor (QSA) company.

New York, New York

HITRUSTCMMC

Columbia, Maryland firm listed as a HITRUST External Assessor and CMMC C3PAO.

Columbia, Maryland

HITRUST

US accounting and advisory firm with an office in Fargo, North Dakota; listed as a HITRUST External Assessor.

Fargo, North Dakota

ISO 27001

Rotterdam-based certification body (EIK Certificering B.V.); RvA-accredited for ISO/IEC 27001 information security management system certification.

Rotterdam, South Holland

SOC 1SOC 2

Licensed CPA firm with offices in South Carolina and North Carolina providing SOC 1 and SOC 2 reports.

Greenville, South Carolina · Columbia, South Carolina · Charleston, South Carolina · +2 more

FedRAMPCMMCGovRAMP

North Bethesda, Maryland technology and cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

North Bethesda, Maryland

PCI DSS

Abu Dhabi-headquartered assessment and audit firm listed as a PCI Qualified Security Assessor (QSA) company.

Abu Dhabi, Abu Dhabi

PCI DSS

Technology services and software engineering company (London office from its contact page); its UK entity is listed by the PCI SSC as a Qualified Security Assessor company.

London, England

CERT-In

Hyderabad-based cybersecurity firm listed as a CERT-In empanelled auditor.

Hyderabad, Telangana

HITRUSTCERT-In

Indian member firm of the EY global network; CERT-In empanelled information security auditor and HITRUST External Assessor.

Mumbai, Maharashtra · New Delhi, Delhi · Gurugram, Haryana · +8 more

PCI DSSHITRUST

US member firm of the EY global network; listed as a PCI DSS Qualified Security Assessor and a HITRUST External Assessor.

New York, New York · Chicago, Illinois · San Francisco, California · +11 more

ISMAP

Tokyo-based audit firm of the EY network registered as an ISMAP audit institution for Japanese government cloud security assessments.

Tokyo, Tokyo

CERT-InPCI DSS

Gurugram-based CERT-In empanelled auditor, also listed as a PCI DSS QSA company.

Gurugram, Haryana

CERT-In

Ahmedabad-based security testing firm listed as a CERT-In empanelled auditor.

Ahmedabad, Gujarat

CERT-In

Cybersecurity, compliance and cloud services firm in Goregaon, Mumbai; CERT-In empanelled information security auditor.

Mumbai, Maharashtra

ISO 27001ISO 27701

EY's ISO certification body (Ernst & Young CertifyPoint B.V.), Amsterdam; RvA-accredited for ISO/IEC 27001, ISO/IEC 27701 and ISO 22301 certification.

Amsterdam, North Holland

ISO 27001

Dammam-headquartered testing, inspection and certification company, founded in 1986 by TASNEE and TÜV NORD, accredited by the Saudi Accreditation Center for ISO/IEC 27001 certification, with offices in Riyadh and Jeddah.

Dammam, Eastern Province · Riyadh, Riyadh · Jeddah, Makkah

ISO 27001

Magdeburg-based certification body (FiduCert GmbH) specialised in ISO/IEC 27001 certification; DAkkS-accredited; states it does not provide ISMS consulting.

Magdeburg, Saxony-Anhalt

FedRAMPCMMC

Arlington, Virginia information security and compliance firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Arlington, Virginia · Bellevue, Washington

CERT-InPCI DSS

Gurugram-based cybersecurity firm listed as a CERT-In empanelled auditor and PCI QSA.

Gurugram, Haryana

ISO 27001

Management systems certification body near Birmingham (Bromsgrove address from the UKAS schedule); UKAS-accredited for ISO/IEC 27001 certification.

Bromsgrove, England

PCI DSS

Payment and cybersecurity firm headquartered near Swindon, England; listed as a PCI QSA.

Swindon, England

CERT-In

Cybersecurity and digital forensics firm headquartered in Ahmedabad with a Mumbai branch; CERT-In empanelled information security auditor.

Ahmedabad, Gujarat · Mumbai, Maharashtra

HITRUSTPCI DSS

Brentwood, Tennessee consulting firm listed as a HITRUST External Assessor and PCI QSA.

Brentwood, Tennessee

ISO 27001ISO 27701PCI DSSFedRAMP +2

Virginia-based assessment firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO, with an ANAB-accredited ISO certification arm.

Lansdowne, Virginia

PCI DSS

Amsterdam-based PCI DSS, cyber security and cloud services firm listed as a PCI Qualified Security Assessor company.

Amsterdam, North Holland

HITRUSTPCI DSSCMMC

US accounting and advisory firm with offices in many states; listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Charlotte, North Carolina · Appleton, Wisconsin · Asheville, North Carolina · +72 more

ISO 27001

Dutch ISO/IEC 27001 certification body of the Forvis Mazars network in the Netherlands, accredited by the RvA, based in Rotterdam.

Rotterdam, South Holland

SOC 1SOC 2ISO 27001ISO 27701

Licensed CPA firm with offices in California and Utah performing SOC 1 and SOC 2 examinations, with an affiliated ANAB-accredited entity for ISO/IEC 27001 and ISO/IEC 27701 certification.

Palo Alto, California · Sacramento, California · San Diego, California · +4 more

SOC 2HITRUSTPCI DSSHIPAA

Atlanta-based CPA and advisory firm whose cybersecurity practice covers SOC 2, HITRUST, HIPAA and PCI DSS; listed as a PCI QSA and HITRUST External Assessor.

Atlanta, Georgia · Alpharetta, Georgia · Auburn, Alabama · +12 more

PCI DSS

Edina, Minnesota security firm listed as a PCI Qualified Security Assessor (QSA) company.

Edina, Minnesota · Lakewood, Colorado · Bozeman, Montana

ISO 27001

Private non-profit foundation in São Paulo accredited by Inmetro/Cgcre to certify information security management systems to ISO/IEC 27001.

São Paulo, São Paulo

CERT-In

Chartered accountancy and advisory firm with offices in Mumbai and Pune; CERT-In empanelled information security auditor.

Mumbai, Maharashtra · Pune, Maharashtra

ISO 27001

Dubai-based certification body accredited by EIAC for ISO/IEC 27001 certification, with an Abu Dhabi office.

Dubai, Dubai · Abu Dhabi, Abu Dhabi

SOC 1SOC 2

CPA firm with its principal place of business in Durham, North Carolina, offering SOC 1 and SOC 2 examinations.

Durham, North Carolina

ISO 27001

Dutch entity of Gaming Laboratories International (GLI, US), accredited by the RvA for ISO/IEC 27001 certification, based in Haarlem.

Haarlem, North Holland

ISO 27001ISO 42001

North Sydney-headquartered certification body with a Melbourne office; JAS-ANZ accredited for ISO/IEC 27001 and ISO/IEC 42001 certification.

North Sydney, New South Wales · Melbourne, Victoria

ISO 27001

North Ryde (NSW) certification body covering management system and product certification; JAS-ANZ accredited for ISO/IEC 27001 certification.

North Ryde, New South Wales

CERT-In

Bengaluru-headquartered IT services company listed as a CERT-In empanelled information security auditor.

Bengaluru, Karnataka

CERT-InPCI DSS

Gurugram-based information security firm (GTIS) listed as a CERT-In empanelled auditor and PCI QSA.

Gurugram, Haryana

PCI DSSHITRUST

Puerto Rico-headquartered cybersecurity firm with a US office in Fort Lauderdale, offering PCI DSS assessments as a QSA company and HIPAA/HITRUST assessment services.

Río Piedras, Puerto Rico · Fort Lauderdale, Florida

PCI DSS

Mumbai-based security and compliance firm listed as a PCI DSS Qualified Security Assessor company.

Mumbai, Maharashtra

PCI DSS

Peabody, Massachusetts IT, security and business consulting firm listed as a PCI Qualified Security Assessor (QSA) company.

Peabody, Massachusetts

CMMC

Huntsville, Alabama cybersecurity and IT firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Huntsville, Alabama · Glendale, California

PCI DSS

Tokyo-based governance, risk and security services firm listed by the PCI SSC as a QSA company, with an office in Yokohama.

Tokyo, Tokyo · Yokohama, Kanagawa

ISO 27001

Stuttgart-based certification body of the GTÜ group (GTÜ Certification GmbH); DAkkS-accredited for ISO/IEC 27001 information security management system certification.

Stuttgart, Baden-Württemberg

PCI DSS

Reston, Virginia cybersecurity services firm listed as a PCI Qualified Security Assessor (QSA) company; its site offers PCI DSS compliance services.

Reston, Virginia

ISO 27001

Berlin-based management system certification body; DAkkS-accredited for ISO/IEC 27001 certification.

Berlin, Berlin

CMMC

Huntsville, Alabama cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Huntsville, Alabama

CERT-In

Kochi-based cybersecurity and advisory firm listed as a CERT-In empanelled auditor.

Kochi, Kerala

PCI DSS

Schaumburg, Illinois information security firm listed as a PCI QSA.

Schaumburg, Illinois

CERT-In

Bengaluru-based IT services company listed by CERT-In as an empanelled information security auditing organisation.

Bengaluru, Karnataka

CERT-In

Information security consultancy in Rohini, New Delhi; CERT-In empanelled information security auditor.

New Delhi, Delhi

CMMC

Richmond, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Richmond, Virginia

ISO 27001HITRUSTCMMC

Compliance audit firm based in Dresher, Pennsylvania with a London office; listed as an ANAB-accredited ISO 27001 certification body, HITRUST External Assessor and CMMC C3PAO.

Dresher, Pennsylvania · London, England

ISO 27001

Management-system certification body of IAPMO R&T with its US office in Ontario, California, offering accredited ISO/IEC 27001 certification.

Ontario, California

CMMC

Silver Spring, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Silver Spring, Maryland

ISO 27001PCI DSS

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification, also listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

PCI DSS

Tokyo-based information security services firm listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

CERT-In

Kolkata-based cybersecurity company (IEMLabs brand of IEMA Research & Development Pvt Ltd) with a Bengaluru office; listed as a CERT-In empanelled auditor.

Kolkata, West Bengal · Bengaluru, Karnataka

ISO 27001

Hanover-based certification and environmental verification body; DAkkS-accredited for ISO/IEC 27001 certification.

Hanover, Lower Saxony

PCI DSSFedRAMPCMMC

Centerville, Ohio assessment firm; the Ignyte entities are listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.

Centerville, Ohio

ISO 27001ISO 27701

Yokohama-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017) and ISO/IEC 27701 certification.

Yokohama, Kanagawa

CERT-In

Thane-based information security, privacy and risk consulting firm listed as a CERT-In empanelled auditor.

Thane, Maharashtra

CERT-In

Vadodara-headquartered application security company with offices in Bengaluru, Navi Mumbai and Dallas; listed as a CERT-In empanelled auditor.

Vadodara, Gujarat · Bengaluru, Karnataka · Navi Mumbai, Maharashtra · +1 more

ISO 27001

Neuss-based certification body (infaz Institut für Auditierung und Zertifizierung GmbH) for quality, environmental and information security management systems; DAkkS-accredited for ISO/IEC 27001 and the energy-sector IT security catalogue.

Neuss, North Rhine-Westphalia

CERT-In

Ahmedabad-based cybersecurity firm listed as a CERT-In empanelled auditor.

Ahmedabad, Gujarat

CERT-In

Lucknow-based cybersecurity and IT services firm listed as a CERT-In empanelled auditor.

Lucknow, Uttar Pradesh

ISO 27001

Pune-based certification body (IQCPL); NABCB-accredited ISO 27001 certification body.

Pune, Maharashtra

CERT-In

Kollam-based deeptech and cybersecurity company listed as a CERT-In empanelled information security auditor.

Kollam, Kerala

HITRUSTPCI DSSFedRAMPCMMC +1

Tampa-based audit firm listed as a PCI QSA, HITRUST External Assessor, FedRAMP 3PAO and CMMC C3PAO.

Tampa, Florida

CERT-In

Mumbai-based cybersecurity services company listed by CERT-In as an empanelled information security auditing organisation.

Mumbai, Maharashtra

PCI DSS

Dublin-headquartered cybersecurity services firm listed as a PCI Qualified Security Assessor (QSA) company, with a London office.

Dublin, Dublin · London, England

ISO 27001

Berlin certification, inspection and training company; DAkkS-accredited for ISO/IEC 27001 certification.

Berlin, Berlin

CERT-In

Bengaluru-based cybersecurity services firm listed as a CERT-In empanelled auditor.

Bengaluru, Karnataka

HITRUSTPCI DSS

The Woodlands, Texas audit and certification firm listed as a HITRUST External Assessor and a PCI Qualified Security Assessor (QSA) company.

The Woodlands, Texas

PCI DSS

Newport Beach, California information security firm listed as a PCI QSA.

Newport Beach, California

ISO 27001

Assurance, testing and certification group; its UK certification entity (Intertek Certification Ltd, Derby) is UKAS-accredited for ISO/IEC 27001.

Derby, England

ISO 27001ISO 42001

Australian certification entity of the Intertek group (UK), operating as Intertek SAI Global, accredited by JAS-ANZ for ISO/IEC 27001 and ISO/IEC 42001 certification, with offices in Sydney and Port Melbourne.

Sydney, New South Wales · Port Melbourne, Victoria

ISO 27001

US business assurance entity of Intertek (UK), with offices in Kentwood, Michigan and Boxborough, Massachusetts; ANAB-accredited for ISO/IEC 27001 certification.

Kentwood, Michigan · Boxborough, Massachusetts

HITRUSTHIPAA

Reston, Virginia healthcare cybersecurity firm listed as a HITRUST External Assessor; offers HIPAA security and privacy assessments.

Reston, Virginia

ISO 27001ISO 27701

Mumbai-based certification body (a division of ISSPL Limited, formerly IRCLASS Systems and Solutions); NABCB-accredited for ISO 27001 and ISO 27701 certification.

Mumbai, Maharashtra

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification.

Tokyo, Tokyo

ISO 27001

Nagoya-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification.

Nagoya, Aichi

CERT-In

Bengaluru-based cybersecurity consulting firm with offices in Kolkata and Mumbai; listed as a CERT-In empanelled information security auditor.

Bengaluru, Karnataka · Kolkata, West Bengal · Mumbai, Maharashtra

ISO 27001ISO 42001

UK certification body with a Cardiff head office (per its site); UKAS-accredited for ISO/IEC 27001 and ISO/IEC 42001 certification.

Cardiff, Wales · Manchester, England

ISO 27001

Certification body in Bonita Springs, Florida, offering accredited ISO/IEC 27001 certification alongside quality, environmental and aerospace standards.

Bonita Springs, Florida

CERT-In

Kolkata-based cybersecurity services firm listed as a CERT-In empanelled auditor.

Kolkata, West Bengal

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) certification.

Tokyo, Tokyo

ISO 27001ISO 27701

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017), ISO/IEC 27701 and ISO 22301 (business continuity) certification.

Tokyo, Tokyo

HITRUSTHIPAA

Alameda, California IT and compliance firm listed as a HITRUST External Assessor; also offers HIPAA risk assessments.

Alameda, California

ISMAP

Tokyo-based general incorporated association registered as an ISMAP audit institution, offering ISMAP information security audits.

Tokyo, Tokyo

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification.

Tokyo, Tokyo

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) certification.

Tokyo, Tokyo

ISO 27001

Tokyo-based testing and certification foundation whose ISO Registration Center is accredited by ISMS-AC for ISO/IEC 27001 (ISMS) certification.

Tokyo, Tokyo

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification.

Tokyo, Tokyo

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification.

Tokyo, Tokyo

ISO 27001ISO 27701

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017), ISO/IEC 27701 and ISO 22301 (business continuity) certification.

Tokyo, Tokyo

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification.

Tokyo, Tokyo

ISO 27001ISO 27701

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017) and ISO/IEC 27701 certification.

Tokyo, Tokyo

PCI DSS

Houston, Texas payment security firm listed as a PCI Qualified Security Assessor (QSA) company.

Houston, Texas

CERT-In

Nagpur-headquartered cybersecurity and digital forensics firm listed as a CERT-In empanelled auditor.

Nagpur, Maharashtra

CMMC

Woodbine, Maryland cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Woodbine, Maryland

CMMC

Cybersecurity and managed security firm in Akron, Ohio; authorized CMMC Third-Party Assessment Organization (C3PAO).

Akron, Ohio

HITRUST

Atlanta-based international law firm listed by HITRUST as an External Assessor.

Atlanta, Georgia

SOC 1SOC 2HITRUSTPCI DSS

Licensed CPA firm with a Nashville corporate office performing SOC, HITRUST and PCI DSS assessments, with locations listed in ten US cities.

Nashville, Tennessee · Atlanta, Georgia · Bethesda, Maryland · +7 more

CERT-In

Chartered accountancy and advisory firm headquartered in Pune with offices across India; CERT-In empanelled information security auditor.

Pune, Maharashtra · Mumbai, Maharashtra · Nashik, Maharashtra · +4 more

ISO 27001

Testing, inspection and certification group headquartered in Rijswijk, Netherlands, with a German certification entity in Hamburg; accredited by RvA and DAkkS for ISO/IEC 27001 certification.

Rijswijk, South Holland · Hamburg, Hamburg

CMMC

Framingham, Massachusetts firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Framingham, Massachusetts

CMMC

Carlsbad, California cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Carlsbad, California

SOC 1SOC 2ISO 27001ISO 27701 +4

Reston, Virginia attestation firm listed for SOC, ISO certification, FedRAMP, HITRUST and CMMC assessments.

Reston, Virginia

HITRUSTCERT-In

Indian member firm of the KPMG network. CERT-In empanelled information security auditor and HITRUST External Assessor.

Gurugram, Haryana · New Delhi, Delhi · Noida, Uttar Pradesh · +14 more

ISMAP

Tokyo-based audit firm of the KPMG network registered as an ISMAP audit institution for Japanese government cloud security assessments.

Tokyo, Tokyo

ISO 27001

Certification body of KPMG in Germany, based in Cologne; DAkkS-accredited for ISO/IEC 27001 and ISO 22301 certification.

Cologne, North Rhine-Westphalia

FedRAMPPCI DSS

US member firm of the KPMG network. FedRAMP-recognized third-party assessor and PCI Qualified Security Assessor company.

New York, New York · Chicago, Illinois · McLean, Virginia · +9 more

CERT-In

Noida-headquartered cybersecurity company with a Cupertino, California office; listed as a CERT-In empanelled information security auditor.

Noida, Uttar Pradesh · Cupertino, California

HITRUSTFedRAMPCMMCGovRAMP

Defense and technology company listed (as Kratos / Kratos Technology & Training Solutions) as a FedRAMP 3PAO, HITRUST External Assessor and CMMC C3PAO.

Herndon, Virginia

PCI DSS

New York risk and investigations firm whose cyber practice is listed as a PCI Qualified Security Assessor (QSA) company.

New York, New York

CMMC

Frederick, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Frederick, Maryland

ISO 27001

Osaka-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification.

Osaka, Osaka

PCI DSSFedRAMPCMMCGovRAMP

Scottsdale, Arizona cybersecurity audit firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO.

Scottsdale, Arizona

ISO 27001ISO 27701HITRUSTPCI DSS

Tennessee advisory firm headquartered in Brentwood (Nashville area) offering ISO certification, HITRUST and PCI DSS services.

Brentwood, Tennessee · Chattanooga, Tennessee · Knoxville, Tennessee · +5 more

PCI DSS

Tokyo-based security firm listed by the PCI SSC as a QSA company, with offices in Osaka, Fukuoka and Takaoka.

Tokyo, Tokyo · Osaka, Osaka · Fukuoka, Fukuoka · +1 more

CERT-In

Faridabad-based security testing and compliance firm listed as a CERT-In empanelled auditor.

Faridabad, Haryana

CMMC

Charleston, South Carolina engineering and consulting firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Charleston, South Carolina

SOC 1SOC 2ISO 27001ISO 27701 +6

Denver-based CPA firm performing SOC examinations, ISO certification, FedRAMP, HITRUST, PCI DSS and CMMC assessments.

Denver, Colorado

ISO 27001ISO 42001

Birmingham-based assurance and certification body; UKAS-accredited for ISO/IEC 27001 and ISO/IEC 42001 management system certification.

Birmingham, England

FedRAMPCMMCGovRAMP

Ashburn, Virginia cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Ashburn, Virginia

CERT-In

Mumbai-headquartered cybersecurity firm listed as a CERT-In empanelled auditor.

Mumbai, Maharashtra

CMMC

Huntsville, Alabama firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Huntsville, Alabama

SOC 1SOC 2HITRUST

Ohio CPA and advisory firm offering SOC 1 and SOC 2 reporting and HITRUST assessments, with offices in Ohio and Florida.

Cleveland, Ohio · Columbus, Ohio · Canton, Ohio · +3 more

CMMC

Arlington, Virginia CMMC assessment firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Arlington, Virginia

CERT-In

Hyderabad-based cybersecurity firm with a Bengaluru office; listed as a CERT-In empanelled information security auditor.

Hyderabad, Telangana · Bengaluru, Karnataka

CERT-In

Mumbai-headquartered company listed as a CERT-In empanelled information security auditor.

Mumbai, Maharashtra

SOC 1SOC 2HITRUSTCMMC

Pennsylvania CPA firm based in Camp Hill offering SOC 1 and SOC 2 examinations and HITRUST assessments; listed as a CMMC C3PAO.

Camp Hill, Pennsylvania · Lancaster, Pennsylvania · Bloomsburg, Pennsylvania · +1 more

HITRUSTPCI DSS

Atlanta, Georgia healthcare-focused risk and compliance firm listed as a HITRUST External Assessor and PCI QSA.

Atlanta, Georgia

CMMC

McLean, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

McLean, Virginia

HITRUSTPCI DSSFedRAMPGovRAMP

Scottsdale, Arizona security and compliance firm listed as a PCI QSA, HITRUST External Assessor and FedRAMP 3PAO.

Scottsdale, Arizona

ISO 27001

Jeddah-based certification body accredited by the Saudi Accreditation Center for ISO/IEC 27001 and ISO 22301 certification.

Jeddah, Makkah

SOC 1SOC 2ISO 27001ISO 27701 +1

Calgary, Alberta CPA practice offering SOC 1 and SOC 2 reports through MHM Professional Corporation and ISO/IEC 27001, 27701 and 42001 certification through SCC-accredited MHM Advisory Ltd.

Calgary, Alberta

CERT-In

Thiruvananthapuram-based cybersecurity firm at Technopark, listed as a CERT-In empanelled auditor.

Thiruvananthapuram, Kerala

CERT-In

Risk consulting and security advisory firm headquartered in Mumbai with an office in Gurugram; CERT-In empanelled information security auditor.

Mumbai, Maharashtra · Gurugram, Haryana

PCI DSS

Canadian accounting and consulting firm whose cyber security team is listed by the PCI Security Standards Council as a Qualified Security Assessor company; PCI team works from the Montreal office.

Montreal, Quebec

CMMC

Belcamp, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Belcamp, Maryland

PCI DSS

Markham, Ontario IT security consulting firm listed as a PCI Qualified Security Assessor (QSA) company.

Markham, Ontario

CMMC

Portland, Maine information security firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Portland, Maine

PCI DSS

Sydney-based cybersecurity firm offering PCI DSS compliance services; listed as a PCI SSC Qualified Security Assessor company.

Sydney, New South Wales

ISO 27001ISO 27701

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017) and ISO/IEC 27701 certification.

Tokyo, Tokyo

ISO 27001ISO 27701

US entity of the NQA certification group with its North American headquarters in Acton, Massachusetts, offering accredited ISO/IEC 27001 and ISO/IEC 27701 certification.

Acton, Massachusetts

PCI DSSHITRUSTFedRAMPGovRAMP

Manchester-headquartered cybersecurity company listed as a PCI QSA, HITRUST External Assessor and (via its US entity) FedRAMP-recognized assessor.

Manchester, England

PCI DSS

Tokyo-based security services company of the NEC group listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

CERT-In

Chennai-based IT services company listed by CERT-In as an empanelled information security auditing organisation.

Chennai, Tamil Nadu

PCI DSS

Tokyo-based network and IT systems integrator listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

CERT-In

Ahmedabad-based security testing firm with a Mumbai office; listed as a CERT-In empanelled auditor.

Ahmedabad, Gujarat · Mumbai, Maharashtra

CERT-In

Gurugram-based risk and security consulting firm listed as a CERT-In empanelled information security auditor.

Gurugram, Haryana

CERT-InPCI DSSHITRUST

Indian cybersecurity firm with offices in Bengaluru and Plano, Texas; listed as a CERT-In empanelled auditor (Mumbai address), PCI QSA and HITRUST External Assessor.

Bengaluru, Karnataka · Mumbai, Maharashtra · Plano, Texas

CERT-In

Surat-based firm listed as a CERT-In empanelled information security auditor.

Surat, Gujarat

PCI DSS

Charlotte, North Carolina security firm listed as a PCI Qualified Security Assessor (QSA) company.

Charlotte, North Carolina

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) certification, with a Kansai branch in Osaka.

Tokyo, Tokyo · Osaka, Osaka

ISO 27001PCI DSS

Dutch IT audit and certification firm in Hazerswoude-Rijndijk; RvA-accredited for ISO/IEC 27001 certification and listed as a PCI Qualified Security Assessor company.

Hazerswoude-Rijndijk, South Holland

ISO 27001

Certification body based in Brasília accredited by Inmetro/Cgcre for ISO/IEC 27001 certification.

Brasília, Distrito Federal

ISO 27001

Geldermalsen-based certification body of the Normec group (Normec Certification B.V.) covering several management system schemes; RvA-accredited for ISO/IEC 27001 certification.

Geldermalsen, Gelderland

PCI DSS

Wichita, Kansas cybersecurity services firm with US offices in seven more states, listed as a PCI Qualified Security Assessor (QSA) company.

Wichita, Kansas · Paso Robles, California · Tempe, Arizona · +5 more

ISO 27001ISO 42001

Certification body based in Dunstable, England; UKAS-accredited for ISO/IEC 27001 and ISO/IEC 42001 certification.

Dunstable, England

PCI DSS

Tokyo-based security services firm listed by the PCI SSC as a QSA company, with offices in Yokohama, Osaka and Irvine, California.

Tokyo, Tokyo · Yokohama, Kanagawa · Osaka, Osaka · +1 more

ISO 27001

Ireland's official standards body (statutory body under the NSAI Act 1996), based in Santry, Dublin; its certification service is INAB-accredited for ISO/IEC 27001 and offers certification to outside organisations.

Dublin, Dublin

ISO 27001

US certification entity of Ireland’s National Standards Authority, headquartered in Nashua, New Hampshire; ANAB-accredited for ISO/IEC 27001 certification.

Nashua, New Hampshire

ISO 27001

Management systems certification body of the NSF group, based in Ann Arbor, Michigan, accredited by ANAB to certify information security management systems to ISO/IEC 27001.

Ann Arbor, Michigan

PCI DSS

Tokyo-based IT and security services company listed by the PCI SSC as a QSA company, with an office in Osaka.

Tokyo, Tokyo · Osaka, Osaka

ISO 27001

Sydney-headquartered certification body with offices in Melbourne and Spring Hill (Brisbane); JAS-ANZ accredited for ISO/IEC 27001 certification.

Sydney, New South Wales · Melbourne, Victoria · Spring Hill, Queensland

ISO 27001

Magdeburg-based certification body (ÖHMI EuroCert GmbH) covering quality, environmental, energy and information security management systems; DAkkS-accredited for ISO/IEC 27001 and the energy-sector IT security catalogue.

Magdeburg, Saxony-Anhalt

PCI DSS

UK payment security and compliance firm with a registered address in Warrington; listed as a PCI QSA.

Warrington, England

PCI DSSHITRUST

Leawood, Kansas cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company and a HITRUST External Assessor.

Leawood, Kansas · Newport Beach, California

PCI DSS

UK arm of Orange Cyberdefense (Orange group) with offices in London, Maidstone and Manchester (per its site); listed as a PCI QSA.

London, England · Maidstone, England · Manchester, England

CMMC

Atlanta, Georgia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Atlanta, Georgia

ISO 42001HITRUST

Princeton, New Jersey cybersecurity firm listed as a HITRUST External Assessor and an ANAB-accredited ISO/IEC 42001 certification body.

Princeton, New Jersey

CERT-InPCI DSS

New Delhi-based information security audit firm listed as a CERT-In empanelled auditor and PCI QSA.

New Delhi, Delhi

CMMC

Tampa, Florida firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Tampa, Florida

CERT-In

Secunderabad-based information security firm listed as a CERT-In empanelled auditor.

Secunderabad, Telangana

PCI DSS

Chesterfield, Missouri security firm listed as a PCI Qualified Security Assessor (QSA) company.

Chesterfield, Missouri

CERT-In

Pune-based security consulting firm listed as a CERT-In empanelled information security auditor.

Pune, Maharashtra

PCI DSS

Melbourne-headquartered PCI DSS consulting and assessment firm with offices in Sydney and Brisbane; listed as a PCI SSC Qualified Security Assessor company.

Melbourne, Victoria · Sydney, New South Wales · Brisbane, Queensland

CMMC

Tampa, Florida cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Tampa, Florida

SOC 1SOC 2

Licensed CPA firm headquartered in Cleveland, Ohio, performing SOC 1 and SOC 2 examinations, with offices in Ohio and New Jersey.

Cleveland, Ohio · Akron, Ohio · Lakewood, New Jersey

ISO 27001

Certification body with its UK head office in Aldridge, Walsall (per its site); UKAS-accredited for ISO/IEC 27001 certification.

Aldridge, England

PCI DSS

Security testing and consultancy firm based in Buckingham, England with a New York office; listed as a PCI QSA.

Buckingham, England · New York, New York

CMMC

Hanover, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Hanover, Maryland

ISO 27001

Tokyo-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS) and ISMS cloud security (ISO/IEC 27017) certification.

Tokyo, Tokyo

ISO 42001

Certification body headquartered in Troy, Michigan, offering accredited ISO/IEC 42001 AI management system certification among other standards.

Troy, Michigan

ISO 27001

Testing and research institute in Pirmasens (Prüf- und Forschungsinstitut Pirmasens e.V.) whose certification body covers management systems; DAkkS-accredited for ISO/IEC 27001 certification.

Pirmasens, Rhineland-Palatinate

PCI DSS

Digital risk and cybersecurity firm with offices in London and Bristol (per its site); listed as a PCI QSA.

London, England · Bristol, England

CERT-In

Gandhinagar-based cybersecurity firm listed as a CERT-In empanelled information security auditor.

Gandhinagar, Gujarat

SOC 1SOC 2HITRUSTPCI DSS

Accounting and advisory firm with offices in Michigan, Illinois, Colorado, Ohio and other states; its cybersecurity practice covers SOC 1 and SOC 2 reporting, PCI DSS and HITRUST.

Southfield, Michigan · Broomfield, Colorado · Denver, Colorado · +17 more

HITRUSTPCI DSSFedRAMPCMMC +1

Nashville-based security assessment firm listed as a FedRAMP 3PAO, HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Nashville, Tennessee

ISO 27001

Certification program of the Performance Review Institute, headquartered in Warrendale, Pennsylvania, offering accredited ISO/IEC 27001 certification alongside aerospace and quality standards.

Warrendale, Pennsylvania

PCI DSS

UK member firm of the PwC network with a London office at Embankment Place; listed by the PCI Security Standards Council as a Qualified Security Assessor company.

London, England

PCI DSS

US member firm of the PwC network; its site gives a registered address at 300 Madison Avenue, New York. Listed by the PCI Security Standards Council as a Qualified Security Assessor company.

New York, New York

CERT-InHITRUST

Indian member firm of the PwC network, with a Gurgaon office on CERT-In’s empanelled-auditor list; also listed by HITRUST as an External Assessor.

Gurugram, Haryana

CERT-In

Cybersecurity firm headquartered in Chennai; CERT-In empanelled information security auditor.

Chennai, Tamil Nadu

PCI DSS

Cybersecurity consultancy (Prism Infosec Ltd, registered office Cheltenham per Companies House); listed as a PCI QSA.

Cheltenham, England

ISO 27001

Apeldoorn-based certification body (ProCertify B.V.); RvA-accredited for ISO/IEC 27001 certification.

Apeldoorn, Gelderland

PCI DSS

Portsmouth-based information security firm (ProCheckUp Limited); listed as a PCI QSA.

Portsmouth, England

ISO 27001

Düsseldorf-based certification body (Proks Certification GmbH); DAkkS-accredited for ISO/IEC 27001 and ISO 9001 management system certification.

Düsseldorf, North Rhine-Westphalia

HITRUSTPCI DSS

Menlo Park-based consulting firm offering PCI DSS assessments as a QSA company and HITRUST assessments as an authorized external assessor.

Menlo Park, California

CERT-In

Ahmedabad-based security consulting firm listed as a CERT-In empanelled auditor.

Ahmedabad, Gujarat

ISO 27001

Gäufelden-based testing and certification company (PÜG Prüf- und Überwachungsgesellschaft mbH) certifying several management system standards; DAkkS-accredited for ISO/IEC 27001 certification, including the energy-sector IT security catalogue.

Gäufelden, Baden-Württemberg

ISO 27001

Frankfurt-based certification body of the PwC network in Germany (PwC Certification Services GmbH); DAkkS-accredited for ISO/IEC 27001 ISMS certification.

Frankfurt am Main, Hesse

ISMAP

Tokyo-based audit firm of the PwC network registered as an ISMAP audit institution for Japanese government cloud security assessments, with offices in Nagoya, Kyoto, Osaka and Fukuoka.

Tokyo, Tokyo · Nagoya, Aichi · Kyoto, Kyoto · +2 more

CERT-In

Chennai-based IT audit and assurance firm with branches in Hyderabad and Kochi; listed as a CERT-In empanelled auditor.

Chennai, Tamil Nadu · Hyderabad, Telangana · Kochi, Kerala

CERT-In

Bengaluru-based security solutions and services company listed as a CERT-In empanelled information security auditor.

Bengaluru, Karnataka

CERT-InPCI DSS

Navi Mumbai-based security assurance firm with a US entity in Wilmington, Delaware; listed as a CERT-In empanelled auditor and PCI QSA.

Navi Mumbai, Maharashtra · Wilmington, Delaware

CERT-In

Navi Mumbai-based cybersecurity firm with a Bengaluru office, listed as a CERT-In empanelled auditor.

Navi Mumbai, Maharashtra · Bengaluru, Karnataka

ISO 27001ISO 27701

Delhi-headquartered certification body with offices in Mumbai, Panchkula and Chennai; NABCB-accredited for ISO 27001 and ISO 27701 certification.

Delhi, Delhi · Mumbai, Maharashtra · Panchkula, Haryana · +1 more

ISO 27001

London-based certification body; UKAS-accredited for ISO/IEC 27001 certification.

London, England

CERT-In

IT infrastructure and security solutions company with offices in New Delhi, Gurugram and other Indian cities; CERT-In empanelled information security auditor.

New Delhi, Delhi · Gurugram, Haryana · Mumbai, Maharashtra · +3 more

PCI DSS

Cybersecurity consultancy based in Tunbridge Wells, Kent; listed as a PCI QSA.

Tunbridge Wells, England

PCI DSS

London-based cybersecurity consultancy offering penetration testing and PCI DSS assessment; listed by the PCI SSC as a Qualified Security Assessor company.

London, England

CMMC

Honolulu, Hawaii technology firm (CMMC services under its eResilience division) listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Honolulu, Hawaii

CMMC

Government technology services firm headquartered in Sterling, Virginia; authorized CMMC Third-Party Assessment Organization (C3PAO).

Sterling, Virginia

CMMC

Springfield, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Springfield, Virginia

PCI DSS

Montreal-based accounting and advisory firm listed as a PCI Qualified Security Assessor (QSA) company, with offices in Toronto, Calgary and Chicago.

Montreal, Quebec · Toronto, Ontario · Calgary, Alberta · +1 more

CERT-In

Navi Mumbai-based cybersecurity, risk and compliance consultancy (RQ Solutions; described on its site as a Cygeniq company) listed as a CERT-In empanelled auditor.

Navi Mumbai, Maharashtra

HITRUSTPCI DSS

Roswell, Georgia security and compliance firm listed as a PCI QSA and HITRUST External Assessor.

Roswell, Georgia

CERT-In

Gurugram-based cybersecurity consultancy listed as a CERT-In empanelled auditor.

Gurugram, Haryana

PCI DSS

Mumbai-based risk management consultancy listed as a PCI DSS Qualified Security Assessor company.

Mumbai, Maharashtra

PCI DSS

Singapore-based firm (Rock Pte Ltd) providing PCI DSS, PIN, 3DS and card production audits, consulting and training; listed as a PCI SSC Qualified Security Assessor company.

Singapore

ISO 27001ISO 27701

Caesarea-based certification body accredited by ANAB for ISO/IEC 27001 and ISO/IEC 27701 certification.

Caesarea, Haifa District

CERT-In

Kolkata-headquartered cybersecurity firm with branches in New Delhi and Bengaluru; listed as a CERT-In empanelled auditor.

Kolkata, West Bengal · New Delhi, Delhi · Bengaluru, Karnataka

SOC 1SOC 2

CPA firm headquartered in Southlake, Texas, offering SOC 1, SOC 2 and SOC 3 attestations.

Southlake, Texas

HITRUSTPCI DSSCMMC

Southlake, Texas cybersecurity compliance firm listed as a HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Southlake, Texas

ISO 27001

Düsseldorf-based certification body in the RSM network; DAkkS-accredited for ISO/IEC 27001 certification.

Düsseldorf, North Rhine-Westphalia

PCI DSSHITRUSTFedRAMPGovRAMP

Chicago-headquartered US member of the RSM network; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized third-party assessor.

Chicago, Illinois

PCI DSS

US accounting and consulting firm with offices including St. Louis, Denver and Chicago; listed as a PCI Qualified Security Assessor company.

St. Louis, Missouri · Denver, Colorado · Chicago, Illinois

PCI DSS

Boulder, Colorado security firm listed as a PCI Qualified Security Assessor (QSA) company.

Boulder, Colorado

CERT-In

Chennai-based threat monitoring and cybersecurity company listed as a CERT-In empanelled information security auditor.

Chennai, Tamil Nadu

ISO 27001

Certification body based in Nova Lima, Minas Gerais, accredited by Inmetro/Cgcre for ISO/IEC 27001 certification.

Nova Lima, Minas Gerais

ISO 27001

Toronto (North York), Ontario certification body accredited by the Standards Council of Canada for ISO/IEC 27001 and CyberSecure Canada certification.

Toronto, Ontario

SOC 2ISO 27001

Maryland audit and advisory firm headquartered in Hunt Valley offering SOC examinations and ISO 27001 certification.

Hunt Valley, Maryland

ISO 27001ISO 27701ISO 42001HITRUST +5

Tampa-based attestation and certification firm offering ISO certification, FedRAMP, PCI DSS, HITRUST and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +1

Pittsburgh-based CPA and advisory firm with offices in Columbus and McLean; performs SOC examinations and is listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Pittsburgh, Pennsylvania · Columbus, Ohio · McLean, Virginia

CERT-In

Cybersecurity consultancy based in Pune; CERT-In empanelled information security auditor.

Pune, Maharashtra

PCI DSS

Singapore-headquartered PCI and payment security firm with offices in Bengaluru and Kuala Lumpur; listed as a PCI SSC Qualified Security Assessor company.

Singapore · Bengaluru, Karnataka · Kuala Lumpur

PCI DSS

Tokyo-based payment security firm listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

PCI DSS

Calgary, Alberta security consultancy listed as a PCI Qualified Security Assessor (QSA) company, with offices in Toronto and Dublin.

Calgary, Alberta · Toronto, Ontario

CERT-In

Bengaluru-based cybersecurity firm (formerly Bizcarta Technologies, per its site) listed as a CERT-In empanelled information security auditor.

Bengaluru, Karnataka

FedRAMPGovRAMP

Reston, Virginia-based cybersecurity advisory and assessment firm; listed on the FedRAMP Marketplace as a recognized independent assessor (3PAO) since October 2013.

Reston, Virginia

CERT-In

Bengaluru-based cybersecurity and IT compliance consulting firm listed as a CERT-In empanelled information security auditor.

Bengaluru, Karnataka

CMMC

Greenbelt, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Greenbelt, Maryland · Baltimore, Maryland

CMMC

Lancaster, Pennsylvania cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Lancaster, Pennsylvania

PCI DSS

Exeter-based information security consultancy; listed as a PCI QSA.

Exeter, England

ISO 27001ISO 42001HITRUSTPCI DSS +3

Security assessment firm with an Annapolis, Maryland address listed as a FedRAMP 3PAO, PCI QSA and HITRUST External Assessor, with an ANAB-accredited affiliate for ISO 27001 and ISO 42001.

Annapolis, Maryland

CERT-In

Mumbai-based offensive security and audit firm listed as a CERT-In empanelled information security auditor.

Mumbai, Maharashtra

PCI DSS

Sydney-based cybersecurity consulting firm offering compliance services including PCI DSS and ISO 27001 advisory; listed as a PCI SSC Qualified Security Assessor company.

Sydney, New South Wales

CERT-In

Pune-based cybersecurity firm listed as a CERT-In empanelled auditor.

Pune, Maharashtra

PCI DSSHITRUST

Orem, Utah data security and compliance company listed as a PCI QSA and HITRUST External Assessor.

Orem, Utah

CERT-In

Noida-based security company listed as a CERT-In empanelled auditor.

Noida, Uttar Pradesh

PCI DSS

Thane-based information-security firm listed as a PCI DSS Qualified Security Assessor company.

Thane, Maharashtra

PCI DSS

Australian cybersecurity services firm with offices in Sydney, Melbourne, Brisbane and Perth; listed as a PCI SSC Qualified Security Assessor company.

Sydney, New South Wales · Melbourne, Victoria · Brisbane, Queensland · +1 more

SOC 1SOC 2ISO 27001ISO 27701 +3

California accounting and consulting firm whose GRC practice performs SOC, ISO and HITRUST engagements; its Drata directory listing describes its audits as remote-first.

San Jose, California · San Mateo, California · San Ramon, California · +3 more

FedRAMPCMMCGovRAMP

Huntsville, Alabama cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Huntsville, Alabama · North Charleston, South Carolina · Columbia, Maryland · +2 more

CMMC

Warrenton, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Warrenton, Virginia

FedRAMPCMMCGovRAMP

Cybersecurity assessment firm with offices listed in Plano, Norfolk and Washington, DC; listed as a FedRAMP 3PAO and CMMC C3PAO.

Plano, Texas · Norfolk, Virginia · Washington, District of Columbia

ISO 27001

Australian entity of the SGS group (Switzerland), accredited by JAS-ANZ for ISO/IEC 27001 certification, with its accredited location in Clayton, Victoria.

Clayton, Victoria

ISO 27001ISO 42001

Yokohama-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017), ISO/IEC 42001 (AI management) and ISO 22301 (business continuity) certification.

Yokohama, Kanagawa

ISO 27001ISO 27701ISO 42001

US entity of the SGS group (Switzerland), accredited by ANAB for ISO/IEC 27001, 27701 and 42001 certification, with its local head office in Bloomfield, New Jersey.

Bloomfield, New Jersey

ISO 27001ISO 27701

UK entity of the SGS testing, inspection and certification group (SGS United Kingdom Limited, Ellesmere Port); UKAS-accredited for ISO/IEC 27001, ISO/IEC 27701 and ISO 22301 certification.

Ellesmere Port, England

CMMC

Greenvale, New York firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Greenvale, New York

CERT-In

Mumbai-headquartered cybersecurity firm listed as a CERT-In empanelled auditor.

Mumbai, Maharashtra

CERT-In

Hyderabad-based cybersecurity services firm listed as a CERT-In empanelled auditor.

Hyderabad, Telangana

SOC 1SOC 2PCI DSS

Accounting, technology and advisory firm with US offices in the Midwest, Mid-Atlantic and New England and offices in India; its services include SOC reporting and PCI DSS assessments.

Chicago, Illinois · Alexandria, Virginia · Marlborough, Massachusetts · +13 more

CERT-InPCI DSSHITRUST

Bengaluru-headquartered information security firm listed as a CERT-In empanelled auditor, PCI QSA and HITRUST External Assessor.

Bengaluru, Karnataka · Irving, Texas

SOC 1SOC 2ISO 27001

Licensed CPA firm with offices in Georgia, North Carolina, South Carolina and Tennessee providing SOC 1 and SOC 2 reporting and accredited ISO/IEC 27001 certification.

Atlanta, Georgia · Cary, North Carolina · Charlotte, North Carolina · +4 more

ISO 27001CMMC

Fairlawn, Ohio certification body accredited by ANAB for ISO/IEC 27001 certification and listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Fairlawn, Ohio

ISO 27001

German certification entity of the SOCOTEC group (France), based in Halblech, Bavaria; DAkkS-accredited for ISO/IEC 27001 certification.

Halblech, Bavaria

ISO 27001

Bicester-based certification body (Socotec Certification United Kingdom Limited); UKAS-accredited for ISO/IEC 27001 certification.

Bicester, England

ISO 27001

Gold Coast (Burleigh Heads) certification body with a Perth office; JAS-ANZ accredited for ISO/IEC 27001 certification.

Burleigh Heads, Queensland · Perth, Western Australia

PCI DSS

Security and compliance firm established in 2012 offering PCI DSS assessment, security testing and ISO 27001 services; UK office in Accrington per its contact page; listed by the PCI SSC as a Qualified Security Assessor company.

Accrington, England

PCI DSS

Tokyo-based firm providing PCI DSS assessments, listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

PCI DSSCMMC

Plano, Texas security firm listed as a PCI Qualified Security Assessor (QSA) company and an authorized CMMC Third-Party Assessment Organization (C3PAO).

Plano, Texas

CERT-In

Cybersecurity firm with Indian offices in Chennai and Bengaluru and affiliates in the US and UK; CERT-In empanelled information security auditor.

Chennai, Tamil Nadu · Bengaluru, Karnataka

PCI DSS

Bonn-based IT security consultancy listed by the PCI Security Standards Council as a Qualified Security Assessor company.

Bonn, North Rhine-Westphalia

ISO 27001

Israel's national standards institution; its Tel Aviv-based Quality and Certification Division offers ISO/IEC 27001 certification to organisations and is accredited by ANAB.

Tel Aviv, Tel Aviv District

FedRAMP

Baltimore, Maryland-based cybersecurity assessment firm; listed on the FedRAMP Marketplace as a recognized third-party assessment organization (3PAO) since June 2025.

Baltimore, Maryland

ISO 27001

Certification service of the STQC Directorate, Ministry of Electronics and Information Technology (Government of India), New Delhi; NABCB-accredited ISO 27001 certification body.

New Delhi, Delhi

PCI DSS

Melbourne-area (Abbotsford) advisory practice focused on PCI DSS compliance; listed as a PCI SSC Qualified Security Assessor company.

Abbotsford, Victoria

CERT-In

Pune-based IT services company listed as a CERT-In empanelled information security auditor.

Pune, Maharashtra

ISO 27001ISO 42001

Melbourne-based certification body; JAS-ANZ accredited for ISO/IEC 27001 and ISO/IEC 42001 certification.

Melbourne, Victoria

CERT-In

Gurugram-based cybersecurity firm listed as a CERT-In empanelled auditor.

Gurugram, Haryana

CERT-In

New Delhi-based cybersecurity firm listed by CERT-In as an empanelled information security auditing organisation.

New Delhi, Delhi

CERT-In

Cybersecurity firm based in Thane, Maharashtra; CERT-In empanelled information security auditor.

Thane, Maharashtra

CMMC

St. Louis, Missouri IT services firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

St. Louis, Missouri

CERT-In

Mohali-based vulnerability management and security audit company (TAC InfoSec Limited) with offices in Mumbai, New Delhi and Pune; listed as a CERT-In empanelled auditor.

Mohali, Punjab · Mumbai, Maharashtra · New Delhi, Delhi · +1 more

CERT-In

Mumbai-based IT and network security services firm with a Dombivli office; listed as a CERT-In empanelled auditor.

Mumbai, Maharashtra · Dombivli, Maharashtra

SOC 1SOC 2HITRUST

Salt Lake City-based CPA firm whose IT assurance practice offers SOC 1 and SOC 2 examinations and HITRUST assessments, with offices in Lehi, Utah and Tempe, Arizona.

Salt Lake City, Utah · Lehi, Utah · Tempe, Arizona

PCI DSS

Management systems and information security consultancy with offices in Reading and Leeds (per its site); listed as a PCI QSA.

Reading, England · Leeds, England

CERT-In

Ahmedabad-based cybersecurity company (formerly Techdefence Labs) listed as a CERT-In empanelled auditor.

Ahmedabad, Gujarat

ISO 27001

Audit body focused on ISO 27001 certification for technology companies (Bristol address from the UKAS schedule); UKAS-accredited for ISO/IEC 27001 certification.

Bristol, England

CERT-In

Ahmednagar, Maharashtra cybersecurity firm listed by CERT-In as an empanelled information security auditing organisation.

Ahmednagar, Maharashtra

CMMC

McLean, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

McLean, Virginia

HITRUSTPCI DSSFedRAMPCMMC

Irvine, California cybersecurity firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Irvine, California · Fairfax, Virginia · Scottsdale, Arizona

ISO 27001

Certification body in Herten, Limburg (The Certification Leaders B.V.); RvA-accredited for ISO/IEC 27001 and ISO 9001 certification.

Herten, Limburg

CERT-In

Offensive security and compliance audit firm (Hion Security Pvt Ltd) with a registered office in New Delhi and a corporate office in Noida; listed as a CERT-In empanelled auditor.

New Delhi, Delhi · Noida, Uttar Pradesh

PCI DSS

Oakville, Ontario cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company.

Oakville, Ontario · West Palm Beach, Florida

PCI DSS

Mexico City-based cybersecurity firm listed by the PCI SSC as a QSA company, with an operations center in Naucalpan.

Mexico City, Mexico City · Naucalpan de Juárez, State of Mexico

PCI DSS

Tokyo-based IT services company (TISI Inc., formed by the July 2026 merger of TIS and INTEC) listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

PCI DSS

Charlotte, North Carolina penetration testing and security consulting firm; its QSA listing is under the legal name Strata Information Group, Inc.

Charlotte, North Carolina

CERT-In

Ahmedabad-based cybersecurity services firm listed as a CERT-In empanelled auditor.

Ahmedabad, Gujarat

PCI DSS

Australian cybersecurity firm with offices in Melbourne, Sydney, Perth and Canberra; listed as a PCI SSC Qualified Security Assessor company and offers PCI DSS assessments.

Melbourne, Victoria · Sydney, New South Wales · Perth, Western Australia · +1 more

PCI DSS

Fairlawn, Ohio-based cybersecurity firm offering penetration testing, incident response and compliance services, including PCI DSS assessments as a QSA company.

Fairlawn, Ohio

PCI DSS

Atlanta, Georgia cybersecurity and compliance firm listed as a PCI QSA.

Atlanta, Georgia

ISO 27001

Darmstadt-based technical inspection and certification organisation; DAkkS-accredited for ISO/IEC 27001 certification.

Darmstadt, Hesse

ISO 27001ISO 27701ISO 42001

Mumbai-based inspection, certification and testing company of the TÜV NORD group; NABCB-accredited for ISO 27001, 27701, 42001 and 22301 certification.

Mumbai, Maharashtra

ISO 27001

Brazilian company of the TÜV NORD Group, based in Alphaville, Barueri, accredited by Inmetro/Cgcre for ISO/IEC 27001 certification.

Barueri, São Paulo

ISO 27001

Essen-based certification company of the TÜV NORD group; DAkkS-accredited for ISO/IEC 27001 and ISO 22301 certification.

Essen, North Rhine-Westphalia

ISO 27001ISO 27701ISO 42001

Dutch certification and inspection company of the TÜV NORD group (Germany), accredited by the RvA for ISO/IEC 27001, 27701, 42001 and ISO 22301 certification, based in Son en Breugel.

Son en Breugel, North Brabant

ISO 27001

Cologne-headquartered testing and certification group; its certification entity TÜV Rheinland Cert GmbH is DAkkS-accredited for ISO/IEC 27001 and ISO 22301.

Cologne, North Rhine-Westphalia

ISO 27001ISO 42001

Yokohama-based certification body accredited by ISMS-AC for ISO/IEC 27001 (ISMS), ISMS cloud security (ISO/IEC 27017) and ISO/IEC 42001 (AI management) certification.

Yokohama, Kanagawa

ISO 27001ISO 27701ISO 42001

North American entity of the TÜV Rheinland group, based in Boxborough, Massachusetts; ANAB-accredited for ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certification.

Boxborough, Massachusetts

ISO 27001

Sulzbach/Saar certification body of the TÜV Saarland group; DAkkS-accredited for ISO/IEC 27001 certification.

Sulzbach, Saarland

ISO 27001

US subsidiary of the TÜV SÜD group (Germany), accredited by ANAB for ISO/IEC 27001 certification, headquartered in Wakefield, Massachusetts.

Wakefield, Massachusetts

ISO 27001

Munich-based management system certification company of the TÜV SÜD group; DAkkS-accredited for ISO/IEC 27001 certification.

Munich, Bavaria

ISO 27001ISO 27701ISO 42001PCI DSS +1

Indian testing, inspection and certification company of the TÜV SÜD group; NABCB-accredited for ISO 27001, 27701, 42001 and 22301 certification, PCI QSA and CERT-In empanelled auditor.

Mumbai, Maharashtra · Pune, Maharashtra

ISO 27001

Certification body of TÜV Thüringen e.V. based in Jena, certifying management systems including information security and IT service management; DAkkS-accredited for ISO/IEC 27001.

Jena, Thuringia

ISO 27001ISO 42001

UK certification body of the TÜV NORD group (Croydon address on its site); UKAS-accredited for ISO/IEC 27001 and ISO/IEC 42001 certification.

Croydon, England

PCI DSS

Tokyo-based security assessment firm listed by the PCI SSC as a QSA company.

Tokyo, Tokyo

ISO 27001

Bournemouth-based certification body (United Registrar of Systems Ltd); UKAS-accredited for ISO/IEC 27001 and ISO 22301 certification.

Bournemouth, England

HITRUSTPCI DSS

Chicago-headquartered security firm listed as a HITRUST External Assessor and PCI QSA.

Chicago, Illinois

PCI DSS

Reading-based governance, risk and compliance consultancy (URM Consulting Services Ltd); listed as a PCI QSA.

Reading, England

CERT-In

Bengaluru-based industrial automation and engineering company listed by CERT-In as an empanelled information security auditing organisation.

Bengaluru, Karnataka

FedRAMPCMMCGovRAMP

Northern Virginia cybersecurity assessment firm listed as a FedRAMP 3PAO and CMMC C3PAO.

McLean, Virginia

PCI DSS

Adelaide-headquartered cybersecurity firm with offices in Sydney, Melbourne, West Perth and Singapore; listed as a PCI SSC Qualified Security Assessor company.

Adelaide, South Australia · Sydney, New South Wales · Melbourne, Victoria · +2 more

ISO 27001

Dubai-based certification body accredited by EIAC for ISO/IEC 27001 certification.

Dubai, Dubai

HITRUST

San Francisco-based law firm offering HITRUST readiness and certification services and privacy compliance work, listed by HITRUST as an External Assessor.

San Francisco, California

PCI DSS

Cybersecurity and compliance company with headquarters in Chicago and Dublin, offering PCI DSS assessments as a QSA company alongside penetration testing and vulnerability scanning.

Chicago, Illinois · Dublin, Dublin

PCI DSSCERT-In

CERT-In empanelled information-security auditor listed with a Mumbai address, also listed as a PCI DSS QSA company.

Mumbai, Maharashtra

CERT-In

Hyderabad-based offensive security firm (Tek Cube Pvt. Ltd.) listed as a CERT-In empanelled auditor.

Hyderabad, Telangana

ISO 27001

Loughrea, County Galway certification body accredited by INAB for ISO/IEC 27001 certification.

Loughrea, Galway

PCI DSS

Los Angeles IT consulting and security firm listed as a PCI Qualified Security Assessor (QSA) company.

Los Angeles, California

CERT-In

Bengaluru-based information security, data privacy and security testing firm listed as a CERT-In empanelled auditor.

Bengaluru, Karnataka

PCI DSSHITRUST

US accounting and advisory firm headquartered in Milwaukee, Wisconsin; its Wipfli Advisory LLC entity (formerly CompliancePoint) is a PCI Qualified Security Assessor company and Wipfli LLP is a HITRUST External Assessor.

Milwaukee, Wisconsin

CMMC

Norfolk, Virginia cybersecurity and training firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Norfolk, Virginia

HITRUSTPCI DSS

Boston-based firm offering HITRUST and PCI DSS assessment services.

Boston, Massachusetts · Springfield, Massachusetts · Miami, Florida · +1 more

ISO 27001

Management systems certification body with its head office in Liverpool; UKAS-accredited for ISO/IEC 27001 certification.

Liverpool, England

PCI DSS

London-based consultancy (consulting arm of Brookcourt Solutions Limited per its site); listed as a PCI QSA.

London, England

ISO 27001

Cologne-based certification body; DAkkS-accredited for ISO/IEC 27001 certification.

Cologne, North Rhine-Westphalia

FedRAMP

Accenture Federal Services appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Chantilly, Virginia

ISMAP

Ark LLC (アーク有限責任監査法人) appears on the ISMAP audit institution list as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Tokyo, Tokyo

FedRAMPGovRAMP

DataLock Consulting Group appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Fairfax, Virginia

FedRAMPGovRAMP

Earthling Security appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Potomac Falls, Virginia

FedRAMP

Excentium appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Reston, Virginia

FedRAMP

GMS Registrar appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Highland Heights, Ohio

ISMAP

Grant Thornton Taiyo LLC (太陽有限責任監査法人) appears on the ISMAP audit institution list as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Tokyo, Tokyo

FedRAMPGovRAMP

Information Technology Company appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Falls Church, Virginia

FedRAMP

MindPoint Group appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

McLean, Virginia

FedRAMPGovRAMP

RISC Point appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Cleveland, Ohio

FedRAMP

TalaTek appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Scottsdale, Arizona