FedRAMP 3PAOs (recognized assessors) in the United States

SOC 1SOC 2ISO 27001ISO 27701 +4

St. Petersburg, Florida firm performing SOC examinations, ISO certification, HITRUST, PCI DSS and FedRAMP assessments.

St. Petersburg, Florida

ISO 27001ISO 27701ISO 42001HITRUST +4

Tampa-headquartered cybersecurity compliance firm covering ISO certification, HITRUST, FedRAMP, PCI DSS and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +2

Alpharetta, Georgia assurance and compliance firm offering SOC 1 and SOC 2 reports, PCI DSS, HITRUST and FedRAMP assessments.

Alpharetta, Georgia

PCI DSSFedRAMPCMMC

Fredericksburg, Virginia assessment firm listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.

Fredericksburg, Virginia

SOC 2ISO 27001ISO 27701ISO 42001 +5

Atlanta-based CPA and advisory firm listed across SOC, ISO, FedRAMP, HITRUST, PCI DSS and CMMC assessor registries.

Atlanta, Georgia

PCI DSSHITRUSTFedRAMPISO 27001 +3

US advisory and accounting firm; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized assessor, with an ANAB-accredited ISO certification body (Baker Tilly Certifications LLC).

Chicago, Illinois

FedRAMPGovRAMP

Columbia, Maryland cybersecurity firm listed as a FedRAMP 3PAO, offering FISMA, FedRAMP and NIST SP 800-171 compliance services.

Columbia, Maryland

ISO 27001ISO 27701ISO 42001HITRUST +4

Cybersecurity advisory and assessment firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST assessor, ISO certification body and (via Coalfire Federal) CMMC C3PAO.

Chicago, Illinois · Alpharetta, Georgia · Bellevue, Washington · +2 more

ISO 27001ISO 27701ISO 42001HITRUST +5

Compliance assessment firm based in Fairfax, Virginia with an Indian entity in Mumbai; listed as PCI QSA, FedRAMP 3PAO, HITRUST assessor, C3PAO and CERT-In empanelled auditor. The Indian entity is NABCB-accredited for ISO/IEC 27001.

Fairfax, Virginia · Mumbai, Maharashtra

FedRAMP

Service-disabled veteran-owned security and IT firm based in Severna Park, Maryland; listed on the FedRAMP Marketplace as a recognized third-party assessment organization (3PAO) since February 2026.

Severna Park, Maryland

FedRAMPCMMC

Cary, North Carolina compliance assessment firm listed as a FedRAMP 3PAO and, through Sahaa Solutions, LLC, as a CMMC C3PAO.

Cary, North Carolina

ISO 27001FedRAMPHITRUST

US member firm of the Deloitte network. ANAB-accredited ISO/IEC 27001 certification body, FedRAMP-recognized third-party assessor and HITRUST External Assessor.

New York, New York · Chicago, Illinois · Arlington, Virginia · +15 more

FedRAMPCMMCGovRAMP

North Bethesda, Maryland technology and cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

North Bethesda, Maryland

FedRAMPCMMC

Arlington, Virginia information security and compliance firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Arlington, Virginia · Bellevue, Washington

ISO 27001ISO 27701PCI DSSFedRAMP +2

Virginia-based assessment firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO, with an ANAB-accredited ISO certification arm.

Lansdowne, Virginia

PCI DSSFedRAMPCMMC

Centerville, Ohio assessment firm; the Ignyte entities are listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.

Centerville, Ohio

HITRUSTPCI DSSFedRAMPCMMC +1

Tampa-based audit firm listed as a PCI QSA, HITRUST External Assessor, FedRAMP 3PAO and CMMC C3PAO.

Tampa, Florida

SOC 1SOC 2ISO 27001ISO 27701 +4

Reston, Virginia attestation firm listed for SOC, ISO certification, FedRAMP, HITRUST and CMMC assessments.

Reston, Virginia

FedRAMPPCI DSS

US member firm of the KPMG network. FedRAMP-recognized third-party assessor and PCI Qualified Security Assessor company.

New York, New York · Chicago, Illinois · McLean, Virginia · +9 more

HITRUSTFedRAMPCMMCGovRAMP

Defense and technology company listed (as Kratos / Kratos Technology & Training Solutions) as a FedRAMP 3PAO, HITRUST External Assessor and CMMC C3PAO.

Herndon, Virginia

PCI DSSFedRAMPCMMCGovRAMP

Scottsdale, Arizona cybersecurity audit firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO.

Scottsdale, Arizona

SOC 1SOC 2ISO 27001ISO 27701 +6

Denver-based CPA firm performing SOC examinations, ISO certification, FedRAMP, HITRUST, PCI DSS and CMMC assessments.

Denver, Colorado

FedRAMPCMMCGovRAMP

Ashburn, Virginia cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Ashburn, Virginia

HITRUSTPCI DSSFedRAMPGovRAMP

Scottsdale, Arizona security and compliance firm listed as a PCI QSA, HITRUST External Assessor and FedRAMP 3PAO.

Scottsdale, Arizona

HITRUSTPCI DSSFedRAMPCMMC +1

Nashville-based security assessment firm listed as a FedRAMP 3PAO, HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Nashville, Tennessee

PCI DSSHITRUSTFedRAMPGovRAMP

Chicago-headquartered US member of the RSM network; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized third-party assessor.

Chicago, Illinois

ISO 27001ISO 27701ISO 42001HITRUST +5

Tampa-based attestation and certification firm offering ISO certification, FedRAMP, PCI DSS, HITRUST and CMMC assessments.

Tampa, Florida

FedRAMPGovRAMP

Reston, Virginia-based cybersecurity advisory and assessment firm; listed on the FedRAMP Marketplace as a recognized independent assessor (3PAO) since October 2013.

Reston, Virginia

ISO 27001ISO 42001HITRUSTPCI DSS +3

Security assessment firm with an Annapolis, Maryland address listed as a FedRAMP 3PAO, PCI QSA and HITRUST External Assessor, with an ANAB-accredited affiliate for ISO 27001 and ISO 42001.

Annapolis, Maryland

FedRAMPCMMCGovRAMP

Huntsville, Alabama cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Huntsville, Alabama · North Charleston, South Carolina · Columbia, Maryland · +2 more

FedRAMPCMMCGovRAMP

Cybersecurity assessment firm with offices listed in Plano, Norfolk and Washington, DC; listed as a FedRAMP 3PAO and CMMC C3PAO.

Plano, Texas · Norfolk, Virginia · Washington, District of Columbia

FedRAMP

Baltimore, Maryland-based cybersecurity assessment firm; listed on the FedRAMP Marketplace as a recognized third-party assessment organization (3PAO) since June 2025.

Baltimore, Maryland

HITRUSTPCI DSSFedRAMPCMMC

Irvine, California cybersecurity firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Irvine, California · Fairfax, Virginia · Scottsdale, Arizona

FedRAMPCMMCGovRAMP

Northern Virginia cybersecurity assessment firm listed as a FedRAMP 3PAO and CMMC C3PAO.

McLean, Virginia

FedRAMP

Accenture Federal Services appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Chantilly, Virginia

FedRAMPGovRAMP

DataLock Consulting Group appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Fairfax, Virginia

FedRAMPGovRAMP

Earthling Security appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Potomac Falls, Virginia

FedRAMP

Excentium appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Reston, Virginia

FedRAMP

GMS Registrar appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Highland Heights, Ohio

FedRAMPGovRAMP

Information Technology Company appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Falls Church, Virginia

FedRAMP

MindPoint Group appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

McLean, Virginia

FedRAMPGovRAMP

RISC Point appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Cleveland, Ohio

FedRAMP

TalaTek appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Scottsdale, Arizona