HITRUST External Assessors in the United States

SOC 1SOC 2ISO 27001ISO 27701 +4

St. Petersburg, Florida firm performing SOC examinations, ISO certification, HITRUST, PCI DSS and FedRAMP assessments.

St. Petersburg, Florida

ISO 27001ISO 27701ISO 42001HITRUST +4

Tampa-headquartered cybersecurity compliance firm covering ISO certification, HITRUST, FedRAMP, PCI DSS and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +2

Alpharetta, Georgia assurance and compliance firm offering SOC 1 and SOC 2 reports, PCI DSS, HITRUST and FedRAMP assessments.

Alpharetta, Georgia

PCI DSSHITRUST

Cybersecurity and compliance firm headquartered in East Brunswick, New Jersey with offices in Bengaluru and Pune; listed as a PCI QSA and HITRUST External Assessor.

East Brunswick, New Jersey · Bengaluru, Karnataka · Pune, Maharashtra

PCI DSSHITRUST

Chantilly, Virginia cybersecurity firm listed as a PCI QSA (places of business include USA, UK and India) and HITRUST External Assessor.

Chantilly, Virginia

SOC 2ISO 27001ISO 27701ISO 42001 +5

Atlanta-based CPA and advisory firm listed across SOC, ISO, FedRAMP, HITRUST, PCI DSS and CMMC assessor registries.

Atlanta, Georgia

PCI DSSHITRUSTISO 27001ISO 27701 +1

US accounting and consulting firm (first-listed office San Ramon, CA); listed as a PCI Qualified Security Assessor company and HITRUST External Assessor, with an ANAB-accredited ISO certification body (Armanino Certified, LLC).

San Ramon, California · Chicago, Illinois · New York, New York · +2 more

PCI DSSHITRUSTFedRAMPISO 27001 +3

US advisory and accounting firm; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized assessor, with an ANAB-accredited ISO certification body (Baker Tilly Certifications LLC).

Chicago, Illinois

HITRUSTHIPAA

Dublin, Ohio healthcare security and compliance firm listed as a HITRUST External Assessor; offers HIPAA risk assessments.

Dublin, Ohio

SOC 1SOC 2HITRUSTCMMC

CPA and advisory firm with offices across the US; performs SOC 1 and SOC 2 examinations and is listed as a HITRUST External Assessor and CMMC C3PAO.

Raleigh, North Carolina · Carlsbad, California · Torrance, California · +51 more

HITRUSTHIPAA

Nashville-based healthcare cybersecurity and compliance firm listed as a HITRUST External Assessor; its services include HIPAA risk analysis.

Nashville, Tennessee

PCI DSSHITRUST

US accounting and advisory firm with a Minneapolis office (220 South Sixth Street); listed as a PCI Qualified Security Assessor company and HITRUST External Assessor.

Minneapolis, Minnesota

ISO 27001ISO 27701ISO 42001HITRUST +4

Cybersecurity advisory and assessment firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST assessor, ISO certification body and (via Coalfire Federal) CMMC C3PAO.

Chicago, Illinois · Alpharetta, Georgia · Bellevue, Washington · +2 more

ISO 27001ISO 27701ISO 42001HITRUST +5

Compliance assessment firm based in Fairfax, Virginia with an Indian entity in Mumbai; listed as PCI QSA, FedRAMP 3PAO, HITRUST assessor, C3PAO and CERT-In empanelled auditor. The Indian entity is NABCB-accredited for ISO/IEC 27001.

Fairfax, Virginia · Mumbai, Maharashtra

PCI DSSHITRUSTHIPAA

Reston, Virginia security compliance and assessment firm listed as a PCI Qualified Security Assessor (QSA) company and a HITRUST External Assessor; its site offers HIPAA-based assessments.

Reston, Virginia

PCI DSSHITRUST

US accounting and advisory firm whose Chicago office is its national headquarters; listed as a PCI Qualified Security Assessor company and HITRUST External Assessor.

Chicago, Illinois

SOC 2HITRUSTHIPAA

Encinitas, California compliance firm listed as a HITRUST External Assessor; SOC 2 attestation reports are issued through its licensed CPA firm, CyberCrest Controls RLLP.

Encinitas, California

SOC 1SOC 2HITRUSTHIPAA

San Jose, California CPA firm offering SOC 1 and SOC 2 examinations, listed as a HITRUST External Assessor; offers HIPAA compliance services.

San Jose, California

ISO 27001FedRAMPHITRUST

US member firm of the Deloitte network. ANAB-accredited ISO/IEC 27001 certification body, FedRAMP-recognized third-party assessor and HITRUST External Assessor.

New York, New York · Chicago, Illinois · Arlington, Virginia · +15 more

HITRUSTCMMC

Waukee, Iowa compliance and cybersecurity firm listed as a HITRUST External Assessor and CMMC C3PAO.

Waukee, Iowa

HITRUSTCMMC

Columbia, Maryland firm listed as a HITRUST External Assessor and CMMC C3PAO.

Columbia, Maryland

HITRUST

US accounting and advisory firm with an office in Fargo, North Dakota; listed as a HITRUST External Assessor.

Fargo, North Dakota

PCI DSSHITRUST

US member firm of the EY global network; listed as a PCI DSS Qualified Security Assessor and a HITRUST External Assessor.

New York, New York · Chicago, Illinois · San Francisco, California · +11 more

HITRUSTPCI DSS

Brentwood, Tennessee consulting firm listed as a HITRUST External Assessor and PCI QSA.

Brentwood, Tennessee

HITRUSTPCI DSSCMMC

US accounting and advisory firm with offices in many states; listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Charlotte, North Carolina · Appleton, Wisconsin · Asheville, North Carolina · +72 more

SOC 2HITRUSTPCI DSSHIPAA

Atlanta-based CPA and advisory firm whose cybersecurity practice covers SOC 2, HITRUST, HIPAA and PCI DSS; listed as a PCI QSA and HITRUST External Assessor.

Atlanta, Georgia · Alpharetta, Georgia · Auburn, Alabama · +12 more

PCI DSSHITRUST

Puerto Rico-headquartered cybersecurity firm with a US office in Fort Lauderdale, offering PCI DSS assessments as a QSA company and HIPAA/HITRUST assessment services.

Río Piedras, Puerto Rico · Fort Lauderdale, Florida

ISO 27001HITRUSTCMMC

Compliance audit firm based in Dresher, Pennsylvania with a London office; listed as an ANAB-accredited ISO 27001 certification body, HITRUST External Assessor and CMMC C3PAO.

Dresher, Pennsylvania · London, England

HITRUSTPCI DSSFedRAMPCMMC +1

Tampa-based audit firm listed as a PCI QSA, HITRUST External Assessor, FedRAMP 3PAO and CMMC C3PAO.

Tampa, Florida

HITRUSTPCI DSS

The Woodlands, Texas audit and certification firm listed as a HITRUST External Assessor and a PCI Qualified Security Assessor (QSA) company.

The Woodlands, Texas

HITRUSTHIPAA

Reston, Virginia healthcare cybersecurity firm listed as a HITRUST External Assessor; offers HIPAA security and privacy assessments.

Reston, Virginia

HITRUSTHIPAA

Alameda, California IT and compliance firm listed as a HITRUST External Assessor; also offers HIPAA risk assessments.

Alameda, California

HITRUST

Atlanta-based international law firm listed by HITRUST as an External Assessor.

Atlanta, Georgia

SOC 1SOC 2HITRUSTPCI DSS

Licensed CPA firm with a Nashville corporate office performing SOC, HITRUST and PCI DSS assessments, with locations listed in ten US cities.

Nashville, Tennessee · Atlanta, Georgia · Bethesda, Maryland · +7 more

SOC 1SOC 2ISO 27001ISO 27701 +4

Reston, Virginia attestation firm listed for SOC, ISO certification, FedRAMP, HITRUST and CMMC assessments.

Reston, Virginia

HITRUSTFedRAMPCMMCGovRAMP

Defense and technology company listed (as Kratos / Kratos Technology & Training Solutions) as a FedRAMP 3PAO, HITRUST External Assessor and CMMC C3PAO.

Herndon, Virginia

ISO 27001ISO 27701HITRUSTPCI DSS

Tennessee advisory firm headquartered in Brentwood (Nashville area) offering ISO certification, HITRUST and PCI DSS services.

Brentwood, Tennessee · Chattanooga, Tennessee · Knoxville, Tennessee · +5 more

SOC 1SOC 2ISO 27001ISO 27701 +6

Denver-based CPA firm performing SOC examinations, ISO certification, FedRAMP, HITRUST, PCI DSS and CMMC assessments.

Denver, Colorado

SOC 1SOC 2HITRUST

Ohio CPA and advisory firm offering SOC 1 and SOC 2 reporting and HITRUST assessments, with offices in Ohio and Florida.

Cleveland, Ohio · Columbus, Ohio · Canton, Ohio · +3 more

SOC 1SOC 2HITRUSTCMMC

Pennsylvania CPA firm based in Camp Hill offering SOC 1 and SOC 2 examinations and HITRUST assessments; listed as a CMMC C3PAO.

Camp Hill, Pennsylvania · Lancaster, Pennsylvania · Bloomsburg, Pennsylvania · +1 more

HITRUSTPCI DSS

Atlanta, Georgia healthcare-focused risk and compliance firm listed as a HITRUST External Assessor and PCI QSA.

Atlanta, Georgia

HITRUSTPCI DSSFedRAMPGovRAMP

Scottsdale, Arizona security and compliance firm listed as a PCI QSA, HITRUST External Assessor and FedRAMP 3PAO.

Scottsdale, Arizona

CERT-InPCI DSSHITRUST

Indian cybersecurity firm with offices in Bengaluru and Plano, Texas; listed as a CERT-In empanelled auditor (Mumbai address), PCI QSA and HITRUST External Assessor.

Bengaluru, Karnataka · Mumbai, Maharashtra · Plano, Texas

PCI DSSHITRUST

Leawood, Kansas cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company and a HITRUST External Assessor.

Leawood, Kansas · Newport Beach, California

ISO 42001HITRUST

Princeton, New Jersey cybersecurity firm listed as a HITRUST External Assessor and an ANAB-accredited ISO/IEC 42001 certification body.

Princeton, New Jersey

SOC 1SOC 2HITRUSTPCI DSS

Accounting and advisory firm with offices in Michigan, Illinois, Colorado, Ohio and other states; its cybersecurity practice covers SOC 1 and SOC 2 reporting, PCI DSS and HITRUST.

Southfield, Michigan · Broomfield, Colorado · Denver, Colorado · +17 more

HITRUSTPCI DSSFedRAMPCMMC +1

Nashville-based security assessment firm listed as a FedRAMP 3PAO, HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Nashville, Tennessee

HITRUSTPCI DSS

Menlo Park-based consulting firm offering PCI DSS assessments as a QSA company and HITRUST assessments as an authorized external assessor.

Menlo Park, California

HITRUSTPCI DSS

Roswell, Georgia security and compliance firm listed as a PCI QSA and HITRUST External Assessor.

Roswell, Georgia

HITRUSTPCI DSSCMMC

Southlake, Texas cybersecurity compliance firm listed as a HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Southlake, Texas

PCI DSSHITRUSTFedRAMPGovRAMP

Chicago-headquartered US member of the RSM network; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized third-party assessor.

Chicago, Illinois

ISO 27001ISO 27701ISO 42001HITRUST +5

Tampa-based attestation and certification firm offering ISO certification, FedRAMP, PCI DSS, HITRUST and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +1

Pittsburgh-based CPA and advisory firm with offices in Columbus and McLean; performs SOC examinations and is listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Pittsburgh, Pennsylvania · Columbus, Ohio · McLean, Virginia

ISO 27001ISO 42001HITRUSTPCI DSS +3

Security assessment firm with an Annapolis, Maryland address listed as a FedRAMP 3PAO, PCI QSA and HITRUST External Assessor, with an ANAB-accredited affiliate for ISO 27001 and ISO 42001.

Annapolis, Maryland

PCI DSSHITRUST

Orem, Utah data security and compliance company listed as a PCI QSA and HITRUST External Assessor.

Orem, Utah

SOC 1SOC 2ISO 27001ISO 27701 +3

California accounting and consulting firm whose GRC practice performs SOC, ISO and HITRUST engagements; its Drata directory listing describes its audits as remote-first.

San Jose, California · San Mateo, California · San Ramon, California · +3 more

CERT-InPCI DSSHITRUST

Bengaluru-headquartered information security firm listed as a CERT-In empanelled auditor, PCI QSA and HITRUST External Assessor.

Bengaluru, Karnataka · Irving, Texas

SOC 1SOC 2HITRUST

Salt Lake City-based CPA firm whose IT assurance practice offers SOC 1 and SOC 2 examinations and HITRUST assessments, with offices in Lehi, Utah and Tempe, Arizona.

Salt Lake City, Utah · Lehi, Utah · Tempe, Arizona

HITRUSTPCI DSSFedRAMPCMMC

Irvine, California cybersecurity firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Irvine, California · Fairfax, Virginia · Scottsdale, Arizona

HITRUSTPCI DSS

Chicago-headquartered security firm listed as a HITRUST External Assessor and PCI QSA.

Chicago, Illinois

HITRUST

San Francisco-based law firm offering HITRUST readiness and certification services and privacy compliance work, listed by HITRUST as an External Assessor.

San Francisco, California

PCI DSSHITRUST

US accounting and advisory firm headquartered in Milwaukee, Wisconsin; its Wipfli Advisory LLC entity (formerly CompliancePoint) is a PCI Qualified Security Assessor company and Wipfli LLP is a HITRUST External Assessor.

Milwaukee, Wisconsin

HITRUSTPCI DSS

Boston-based firm offering HITRUST and PCI DSS assessment services.

Boston, Massachusetts · Springfield, Massachusetts · Miami, Florida · +1 more