Anthony Timbers
HQ: United StatesVerified
Fredericksburg, Virginia assessment firm listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.
CMMC C3PAOs (authorized assessors) in Virginia
25 Verified · CMMC · office in Virginia · Verified first · All CMMC firms · All firms in Virginia
These firms have a current official-registry listing for CMMC (Cyber AB Marketplace C3PAO) and a published office in Virginia. Listings are checked facts, not endorsements or rankings.
Blue Mantle Technology
HQ: United StatesVerified
Sterling, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).
Booz Allen Hamilton
HQ: United StatesVerified
Technology and consulting firm headquartered in McLean, Virginia; authorized CMMC Third-Party Assessment Organization (C3PAO).
Cherry Bekaert
HQ: United StatesVerified
CPA and advisory firm with offices across the US; performs SOC 1 and SOC 2 examinations and is listed as a HITRUST External Assessor and CMMC C3PAO.
Raleigh, North Carolina · Carlsbad, California · Torrance, California · +51 more
Coalfire
HQ: United StatesVerified
Cybersecurity advisory and assessment firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST assessor, ISO certification body and (via Coalfire Federal) CMMC C3PAO.
Chicago, Illinois · Alpharetta, Georgia · Bellevue, Washington · +2 more
CohnReznick
HQ: United StatesVerified
Accounting and advisory firm whose advisory affiliate is listed as a CMMC C3PAO (Tysons, Virginia).
ControlCase
HQ: United StatesVerified
Compliance assessment firm based in Fairfax, Virginia with an Indian entity in Mumbai; listed as PCI QSA, FedRAMP 3PAO, HITRUST assessor, C3PAO and CERT-In empanelled auditor. The Indian entity is NABCB-accredited for ISO/IEC 27001.
First Information Technology Services (FITS)
HQ: United StatesVerified
Arlington, Virginia information security and compliance firm listed as a FedRAMP 3PAO and CMMC C3PAO.
Fortreum
HQ: United StatesVerified
Virginia-based assessment firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO, with an ANAB-accredited ISO certification arm.
Forvis Mazars
HQ: United StatesVerified
US accounting and advisory firm with offices in many states; listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.
Charlotte, North Carolina · Appleton, Wisconsin · Asheville, North Carolina · +72 more
Hive Systems Defense Solutions
HQ: United StatesVerified
Richmond, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).
Kompleye
HQ: United StatesVerified
Reston, Virginia attestation firm listed for SOC, ISO certification, FedRAMP, HITRUST and CMMC assessments.
Kratos
HQ: United StatesVerified
Defense and technology company listed (as Kratos / Kratos Technology & Training Solutions) as a FedRAMP 3PAO, HITRUST External Assessor and CMMC C3PAO.
Lunarline
HQ: United StatesVerified
Ashburn, Virginia cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.
ManageIT Security
HQ: United StatesVerified
Arlington, Virginia CMMC assessment firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).
Meerkat Cyber
HQ: United StatesVerified
McLean, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).
REI Systems
HQ: United StatesVerified
Government technology services firm headquartered in Sterling, Virginia; authorized CMMC Third-Party Assessment Organization (C3PAO).
Resilient IT
HQ: United StatesVerified
Springfield, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).
Schneider Downs
HQ: United StatesVerified
Pittsburgh-based CPA and advisory firm with offices in Columbus and McLean; performs SOC examinations and is listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.
Pittsburgh, Pennsylvania · Columbus, Ohio · McLean, Virginia
Sentinel Blue
HQ: United StatesVerified
Warrenton, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).
Sera Brynn
HQ: United StatesVerified
Cybersecurity assessment firm with offices listed in Plano, Norfolk and Washington, DC; listed as a FedRAMP 3PAO and CMMC C3PAO.
Plano, Texas · Norfolk, Virginia · Washington, District of Columbia
TES Consultants
HQ: United StatesVerified
McLean, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).
Tevora
HQ: United StatesVerified
Irvine, California cybersecurity firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST External Assessor and CMMC C3PAO.
Irvine, California · Fairfax, Virginia · Scottsdale, Arizona
Vaultes
HQ: United StatesVerified
Northern Virginia cybersecurity assessment firm listed as a FedRAMP 3PAO and CMMC C3PAO.
Wise Technical Innovations
HQ: United StatesVerified
Norfolk, Virginia cybersecurity and training firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).
Other frameworks in Virginia: FedRAMP (20) · HITRUST (13) · PCI DSS (13) · GovRAMP (12) · ISO 27001 (5) · ISO 27701 (4) · SOC 1 (4) · SOC 2 (4)
Other CMMC locations: the United States · Maryland · Florida · Tampa · California · Ohio · Pennsylvania · Texas · Alabama · Georgia
FAQ
How many CMMC firms are listed in Virginia?
25 Verified firms are listed for CMMC with an office in Virginia. This is not a ranking.
Which registry do you check for CMMC?
We check Cyber AB Marketplace C3PAO. A framework tag appears only when that registry listed the firm at last check.
Which cities have the most listed firms?
McLean (5), Arlington (3), Chicago (3), Greenville (3), Norfolk (3), Pittsburgh (3).
How do I get matched with a listed firm?
Use Get matched or the auditor-match form on this page. A listing is a set of checked facts, not an endorsement. Get matched.
See the listing method. Pages exist only where at least 3 Verified firms match both the framework and the location.
Related guides: How to verify a C3PAO
Saved
Reference:
We'll email you when a matching listing is added; no other automatic emails. Nothing is sent automatically now.
Request received
Reference:
We'll review your request; no automatic emails. Introductions start later. Nothing was sent to any firm.