GovRAMP 3PAOs (accredited assessors) in the United States

SOC 1SOC 2ISO 27001ISO 27701 +4

St. Petersburg, Florida firm performing SOC examinations, ISO certification, HITRUST, PCI DSS and FedRAMP assessments.

St. Petersburg, Florida

ISO 27001ISO 27701ISO 42001HITRUST +4

Tampa-headquartered cybersecurity compliance firm covering ISO certification, HITRUST, FedRAMP, PCI DSS and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +2

Alpharetta, Georgia assurance and compliance firm offering SOC 1 and SOC 2 reports, PCI DSS, HITRUST and FedRAMP assessments.

Alpharetta, Georgia

SOC 2ISO 27001ISO 27701ISO 42001 +5

Atlanta-based CPA and advisory firm listed across SOC, ISO, FedRAMP, HITRUST, PCI DSS and CMMC assessor registries.

Atlanta, Georgia

PCI DSSHITRUSTFedRAMPISO 27001 +3

US advisory and accounting firm; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized assessor, with an ANAB-accredited ISO certification body (Baker Tilly Certifications LLC).

Chicago, Illinois

FedRAMPGovRAMP

Columbia, Maryland cybersecurity firm listed as a FedRAMP 3PAO, offering FISMA, FedRAMP and NIST SP 800-171 compliance services.

Columbia, Maryland

ISO 27001ISO 27701ISO 42001HITRUST +4

Cybersecurity advisory and assessment firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST assessor, ISO certification body and (via Coalfire Federal) CMMC C3PAO.

Chicago, Illinois · Alpharetta, Georgia · Bellevue, Washington · +2 more

ISO 27001ISO 27701ISO 42001HITRUST +5

Compliance assessment firm based in Fairfax, Virginia with an Indian entity in Mumbai; listed as PCI QSA, FedRAMP 3PAO, HITRUST assessor, C3PAO and CERT-In empanelled auditor. The Indian entity is NABCB-accredited for ISO/IEC 27001.

Fairfax, Virginia · Mumbai, Maharashtra

FedRAMPCMMCGovRAMP

North Bethesda, Maryland technology and cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

North Bethesda, Maryland

ISO 27001ISO 27701PCI DSSFedRAMP +2

Virginia-based assessment firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO, with an ANAB-accredited ISO certification arm.

Lansdowne, Virginia

HITRUSTPCI DSSFedRAMPCMMC +1

Tampa-based audit firm listed as a PCI QSA, HITRUST External Assessor, FedRAMP 3PAO and CMMC C3PAO.

Tampa, Florida

SOC 1SOC 2ISO 27001ISO 27701 +4

Reston, Virginia attestation firm listed for SOC, ISO certification, FedRAMP, HITRUST and CMMC assessments.

Reston, Virginia

HITRUSTFedRAMPCMMCGovRAMP

Defense and technology company listed (as Kratos / Kratos Technology & Training Solutions) as a FedRAMP 3PAO, HITRUST External Assessor and CMMC C3PAO.

Herndon, Virginia

PCI DSSFedRAMPCMMCGovRAMP

Scottsdale, Arizona cybersecurity audit firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO.

Scottsdale, Arizona

SOC 1SOC 2ISO 27001ISO 27701 +6

Denver-based CPA firm performing SOC examinations, ISO certification, FedRAMP, HITRUST, PCI DSS and CMMC assessments.

Denver, Colorado

FedRAMPCMMCGovRAMP

Ashburn, Virginia cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Ashburn, Virginia

HITRUSTPCI DSSFedRAMPGovRAMP

Scottsdale, Arizona security and compliance firm listed as a PCI QSA, HITRUST External Assessor and FedRAMP 3PAO.

Scottsdale, Arizona

HITRUSTPCI DSSFedRAMPCMMC +1

Nashville-based security assessment firm listed as a FedRAMP 3PAO, HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Nashville, Tennessee

PCI DSSHITRUSTFedRAMPGovRAMP

Chicago-headquartered US member of the RSM network; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized third-party assessor.

Chicago, Illinois

ISO 27001ISO 27701ISO 42001HITRUST +5

Tampa-based attestation and certification firm offering ISO certification, FedRAMP, PCI DSS, HITRUST and CMMC assessments.

Tampa, Florida

FedRAMPGovRAMP

Reston, Virginia-based cybersecurity advisory and assessment firm; listed on the FedRAMP Marketplace as a recognized independent assessor (3PAO) since October 2013.

Reston, Virginia

ISO 27001ISO 42001HITRUSTPCI DSS +3

Security assessment firm with an Annapolis, Maryland address listed as a FedRAMP 3PAO, PCI QSA and HITRUST External Assessor, with an ANAB-accredited affiliate for ISO 27001 and ISO 42001.

Annapolis, Maryland

FedRAMPCMMCGovRAMP

Huntsville, Alabama cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Huntsville, Alabama · North Charleston, South Carolina · Columbia, Maryland · +2 more

FedRAMPCMMCGovRAMP

Cybersecurity assessment firm with offices listed in Plano, Norfolk and Washington, DC; listed as a FedRAMP 3PAO and CMMC C3PAO.

Plano, Texas · Norfolk, Virginia · Washington, District of Columbia

FedRAMPCMMCGovRAMP

Northern Virginia cybersecurity assessment firm listed as a FedRAMP 3PAO and CMMC C3PAO.

McLean, Virginia

FedRAMPGovRAMP

DataLock Consulting Group appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Fairfax, Virginia

FedRAMPGovRAMP

Earthling Security appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Potomac Falls, Virginia

FedRAMPGovRAMP

Information Technology Company appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Falls Church, Virginia

FedRAMPGovRAMP

RISC Point appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Cleveland, Ohio