Compliance audit firms in the United States: SOC 1, SOC 2, ISO 27001, ISO 27701

SOC 1SOC 2ISO 27001ISO 27701 +4

St. Petersburg, Florida firm performing SOC examinations, ISO certification, HITRUST, PCI DSS and FedRAMP assessments.

St. Petersburg, Florida

ISO 27001ISO 27701ISO 42001HITRUST +4

Tampa-headquartered cybersecurity compliance firm covering ISO certification, HITRUST, FedRAMP, PCI DSS and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +2

Alpharetta, Georgia assurance and compliance firm offering SOC 1 and SOC 2 reports, PCI DSS, HITRUST and FedRAMP assessments.

Alpharetta, Georgia

ISO 27001

Certification body in Spring, Texas, offering accredited ISO/IEC 27001 certification alongside quality, environmental and asset-management standards.

Spring, Texas

PCI DSS

King of Prussia, Pennsylvania cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company; its site lists PCI ROC/SAQ services.

King of Prussia, Pennsylvania

PCI DSSHITRUST

Cybersecurity and compliance firm headquartered in East Brunswick, New Jersey with offices in Bengaluru and Pune; listed as a PCI QSA and HITRUST External Assessor.

East Brunswick, New Jersey · Bengaluru, Karnataka · Pune, Maharashtra

PCI DSSHITRUST

Chantilly, Virginia cybersecurity firm listed as a PCI QSA (places of business include USA, UK and India) and HITRUST External Assessor.

Chantilly, Virginia

ISO 27001

US certification body of the Amtivo group, based in Arvada, Colorado, offering accredited ISO/IEC 27001 certification among other management-system standards.

Arvada, Colorado

PCI DSSFedRAMPCMMC

Fredericksburg, Virginia assessment firm listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.

Fredericksburg, Virginia

SOC 2ISO 27001ISO 27701ISO 42001 +5

Atlanta-based CPA and advisory firm listed across SOC, ISO, FedRAMP, HITRUST, PCI DSS and CMMC assessor registries.

Atlanta, Georgia

CMMC

Aberdeen, Maryland CMMC assessment firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Aberdeen, Maryland

PCI DSSHITRUSTISO 27001ISO 27701 +1

US accounting and consulting firm (first-listed office San Ramon, CA); listed as a PCI Qualified Security Assessor company and HITRUST External Assessor, with an ANAB-accredited ISO certification body (Armanino Certified, LLC).

San Ramon, California · Chicago, Illinois · New York, New York · +2 more

ISO 27001

Certification body of the Aviation Suppliers Association in Washington, DC, offering accredited ISO/IEC 27001 certification alongside aviation-sector quality standards.

Washington, District of Columbia

PCI DSSCMMC

Tampa-based compliance assessment firm, described on its site as a division of Carr, Riggs & Ingram Capital, LLC; listed as a PCI QSA and CMMC C3PAO.

Tampa, Florida

CMMC

Rockville, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Rockville, Maryland

PCI DSSHITRUSTFedRAMPISO 27001 +3

US advisory and accounting firm; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized assessor, with an ANAB-accredited ISO certification body (Baker Tilly Certifications LLC).

Chicago, Illinois

PCI DSS

US member of the BDO network with its national headquarters in Chicago; listed as a PCI Qualified Security Assessor company.

Chicago, Illinois

CMMC

Sterling, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Sterling, Virginia

HITRUSTHIPAA

Dublin, Ohio healthcare security and compliance firm listed as a HITRUST External Assessor; offers HIPAA risk assessments.

Dublin, Ohio

CMMC

Technology and consulting firm headquartered in McLean, Virginia; authorized CMMC Third-Party Assessment Organization (C3PAO).

McLean, Virginia

CMMC

Oak Ridge, Tennessee government services firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Oak Ridge, Tennessee

SOC 1SOC 2ISO 27001

Minnesota CPA and advisory firm offering SOC 1 and SOC 2 reporting, with an ANAB-accredited affiliate for ISO 27001 certification.

Eden Prairie, Minnesota · Mankato, Minnesota · Minneapolis, Minnesota

PCI DSS

UK cybersecurity services firm with offices in Reading, London, Cardiff, Manchester and Edinburgh; listed as a PCI QSA.

Reading, England · London, England · Cardiff, Wales · +4 more

CMMC

Oklahoma City, Oklahoma engineering and consulting firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Oklahoma City, Oklahoma

PCI DSS

Lincoln, Nebraska security firm listed as a PCI Qualified Security Assessor (QSA) company.

Lincoln, Nebraska

PCI DSSISO 27001ISO 27701

Cleveland-headquartered professional services company; its CBIZ Security & Compliance, LLC unit is a PCI Qualified Security Assessor company and an ANAB-accredited ISO/IEC 27001 and 27701 certification body.

Cleveland, Ohio · Tampa, Florida

PCI DSS

Vernon Hills, Illinois IT solutions provider whose security practice is listed as a PCI Qualified Security Assessor (QSA) company.

Vernon Hills, Illinois

SOC 1SOC 2HITRUSTCMMC

CPA and advisory firm with offices across the US; performs SOC 1 and SOC 2 examinations and is listed as a HITRUST External Assessor and CMMC C3PAO.

Raleigh, North Carolina · Carlsbad, California · Torrance, California · +51 more

CMMC

Burlington, Massachusetts firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Burlington, Massachusetts

HITRUSTHIPAA

Nashville-based healthcare cybersecurity and compliance firm listed as a HITRUST External Assessor; its services include HIPAA risk analysis.

Nashville, Tennessee

PCI DSSHITRUST

US accounting and advisory firm with a Minneapolis office (220 South Sixth Street); listed as a PCI Qualified Security Assessor company and HITRUST External Assessor.

Minneapolis, Minnesota

FedRAMPGovRAMP

Columbia, Maryland cybersecurity firm listed as a FedRAMP 3PAO, offering FISMA, FedRAMP and NIST SP 800-171 compliance services.

Columbia, Maryland

ISO 27001ISO 27701ISO 42001HITRUST +4

Cybersecurity advisory and assessment firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST assessor, ISO certification body and (via Coalfire Federal) CMMC C3PAO.

Chicago, Illinois · Alpharetta, Georgia · Bellevue, Washington · +2 more

CMMC

Accounting and advisory firm whose advisory affiliate is listed as a CMMC C3PAO (Tysons, Virginia).

Tysons, Virginia

PCI DSS

North Providence, Rhode Island IT security and compliance firm listed as a PCI QSA.

North Providence, Rhode Island

CMMC

Laramie, Wyoming cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Laramie, Wyoming

ISO 27001ISO 27701

Certification body with a North America office in El Dorado Hills, California; ANAB-accredited for ISO 27001 and ISO 27701 certification audits.

El Dorado Hills, California

PCI DSS

Knoxville, Tennessee security firm listed as a PCI Qualified Security Assessor (QSA) company.

Knoxville, Tennessee

ISO 27001ISO 27701ISO 42001HITRUST +5

Compliance assessment firm based in Fairfax, Virginia with an Indian entity in Mumbai; listed as PCI QSA, FedRAMP 3PAO, HITRUST assessor, C3PAO and CERT-In empanelled auditor. The Indian entity is NABCB-accredited for ISO/IEC 27001.

Fairfax, Virginia · Mumbai, Maharashtra

PCI DSSHITRUSTHIPAA

Reston, Virginia security compliance and assessment firm listed as a PCI Qualified Security Assessor (QSA) company and a HITRUST External Assessor; its site offers HIPAA-based assessments.

Reston, Virginia

PCI DSSHITRUST

US accounting and advisory firm whose Chicago office is its national headquarters; listed as a PCI Qualified Security Assessor company and HITRUST External Assessor.

Chicago, Illinois

SOC 2HITRUSTHIPAA

Encinitas, California compliance firm listed as a HITRUST External Assessor; SOC 2 attestation reports are issued through its licensed CPA firm, CyberCrest Controls RLLP.

Encinitas, California

FedRAMP

Service-disabled veteran-owned security and IT firm based in Severna Park, Maryland; listed on the FedRAMP Marketplace as a recognized third-party assessment organization (3PAO) since February 2026.

Severna Park, Maryland

CMMC

Silver Spring, Maryland cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Silver Spring, Maryland

CMMC

Melbourne, Florida cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Melbourne, Florida

FedRAMPCMMC

Cary, North Carolina compliance assessment firm listed as a FedRAMP 3PAO and, through Sahaa Solutions, LLC, as a CMMC C3PAO.

Cary, North Carolina

CMMC

Melville, New York firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Melville, New York

SOC 1SOC 2HITRUSTHIPAA

San Jose, California CPA firm offering SOC 1 and SOC 2 examinations, listed as a HITRUST External Assessor; offers HIPAA compliance services.

San Jose, California

ISO 27001ISO 27701ISO 42001

US management system certification body of the DEKRA group, based in Atlanta, Georgia; ANAB-accredited for ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certification.

Atlanta, Georgia

ISO 27001FedRAMPHITRUST

US member firm of the Deloitte network. ANAB-accredited ISO/IEC 27001 certification body, FedRAMP-recognized third-party assessor and HITRUST External Assessor.

New York, New York · Chicago, Illinois · Arlington, Virginia · +15 more

CMMC

Colorado Springs, Colorado cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Colorado Springs, Colorado

ISO 27001ISO 42001

US entity of the DQS certification group, based in Schaumburg, Illinois; ANAB-accredited for ISO/IEC 27001 and ISO/IEC 42001 certification.

Schaumburg, Illinois

PCI DSS

Durham, North Carolina security firm listed as a PCI Qualified Security Assessor (QSA) company.

Durham, North Carolina

ISO 27001

Dayton, Ohio management system certification body (EAGLE Registrations Inc.) accredited by ANAB for ISO/IEC 27001 certification.

Dayton, Ohio

HITRUSTCMMC

Waukee, Iowa compliance and cybersecurity firm listed as a HITRUST External Assessor and CMMC C3PAO.

Waukee, Iowa

PCI DSS

New York City advisory and assurance firm listed as a PCI Qualified Security Assessor (QSA) company.

New York, New York

HITRUSTCMMC

Columbia, Maryland firm listed as a HITRUST External Assessor and CMMC C3PAO.

Columbia, Maryland

HITRUST

US accounting and advisory firm with an office in Fargo, North Dakota; listed as a HITRUST External Assessor.

Fargo, North Dakota

SOC 1SOC 2

Licensed CPA firm with offices in South Carolina and North Carolina providing SOC 1 and SOC 2 reports.

Greenville, South Carolina · Columbia, South Carolina · Charleston, South Carolina · +2 more

FedRAMPCMMCGovRAMP

North Bethesda, Maryland technology and cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

North Bethesda, Maryland

PCI DSSHITRUST

US member firm of the EY global network; listed as a PCI DSS Qualified Security Assessor and a HITRUST External Assessor.

New York, New York · Chicago, Illinois · San Francisco, California · +11 more

FedRAMPCMMC

Arlington, Virginia information security and compliance firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Arlington, Virginia · Bellevue, Washington

HITRUSTPCI DSS

Brentwood, Tennessee consulting firm listed as a HITRUST External Assessor and PCI QSA.

Brentwood, Tennessee

ISO 27001ISO 27701PCI DSSFedRAMP +2

Virginia-based assessment firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO, with an ANAB-accredited ISO certification arm.

Lansdowne, Virginia

HITRUSTPCI DSSCMMC

US accounting and advisory firm with offices in many states; listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Charlotte, North Carolina · Appleton, Wisconsin · Asheville, North Carolina · +72 more

SOC 1SOC 2ISO 27001ISO 27701

Licensed CPA firm with offices in California and Utah performing SOC 1 and SOC 2 examinations, with an affiliated ANAB-accredited entity for ISO/IEC 27001 and ISO/IEC 27701 certification.

Palo Alto, California · Sacramento, California · San Diego, California · +4 more

SOC 2HITRUSTPCI DSSHIPAA

Atlanta-based CPA and advisory firm whose cybersecurity practice covers SOC 2, HITRUST, HIPAA and PCI DSS; listed as a PCI QSA and HITRUST External Assessor.

Atlanta, Georgia · Alpharetta, Georgia · Auburn, Alabama · +12 more

PCI DSS

Edina, Minnesota security firm listed as a PCI Qualified Security Assessor (QSA) company.

Edina, Minnesota · Lakewood, Colorado · Bozeman, Montana

SOC 1SOC 2

CPA firm with its principal place of business in Durham, North Carolina, offering SOC 1 and SOC 2 examinations.

Durham, North Carolina

PCI DSSHITRUST

Puerto Rico-headquartered cybersecurity firm with a US office in Fort Lauderdale, offering PCI DSS assessments as a QSA company and HIPAA/HITRUST assessment services.

Río Piedras, Puerto Rico · Fort Lauderdale, Florida

PCI DSS

Peabody, Massachusetts IT, security and business consulting firm listed as a PCI Qualified Security Assessor (QSA) company.

Peabody, Massachusetts

CMMC

Huntsville, Alabama cybersecurity and IT firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Huntsville, Alabama · Glendale, California

PCI DSS

Reston, Virginia cybersecurity services firm listed as a PCI Qualified Security Assessor (QSA) company; its site offers PCI DSS compliance services.

Reston, Virginia

CMMC

Huntsville, Alabama cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Huntsville, Alabama

PCI DSS

Schaumburg, Illinois information security firm listed as a PCI QSA.

Schaumburg, Illinois

CMMC

Richmond, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Richmond, Virginia

ISO 27001HITRUSTCMMC

Compliance audit firm based in Dresher, Pennsylvania with a London office; listed as an ANAB-accredited ISO 27001 certification body, HITRUST External Assessor and CMMC C3PAO.

Dresher, Pennsylvania · London, England

ISO 27001

Management-system certification body of IAPMO R&T with its US office in Ontario, California, offering accredited ISO/IEC 27001 certification.

Ontario, California

CMMC

Silver Spring, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Silver Spring, Maryland

PCI DSSFedRAMPCMMC

Centerville, Ohio assessment firm; the Ignyte entities are listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.

Centerville, Ohio

CERT-In

Vadodara-headquartered application security company with offices in Bengaluru, Navi Mumbai and Dallas; listed as a CERT-In empanelled auditor.

Vadodara, Gujarat · Bengaluru, Karnataka · Navi Mumbai, Maharashtra · +1 more

HITRUSTPCI DSSFedRAMPCMMC +1

Tampa-based audit firm listed as a PCI QSA, HITRUST External Assessor, FedRAMP 3PAO and CMMC C3PAO.

Tampa, Florida

HITRUSTPCI DSS

The Woodlands, Texas audit and certification firm listed as a HITRUST External Assessor and a PCI Qualified Security Assessor (QSA) company.

The Woodlands, Texas

PCI DSS

Newport Beach, California information security firm listed as a PCI QSA.

Newport Beach, California

ISO 27001

US business assurance entity of Intertek (UK), with offices in Kentwood, Michigan and Boxborough, Massachusetts; ANAB-accredited for ISO/IEC 27001 certification.

Kentwood, Michigan · Boxborough, Massachusetts

HITRUSTHIPAA

Reston, Virginia healthcare cybersecurity firm listed as a HITRUST External Assessor; offers HIPAA security and privacy assessments.

Reston, Virginia

ISO 27001

Certification body in Bonita Springs, Florida, offering accredited ISO/IEC 27001 certification alongside quality, environmental and aerospace standards.

Bonita Springs, Florida

HITRUSTHIPAA

Alameda, California IT and compliance firm listed as a HITRUST External Assessor; also offers HIPAA risk assessments.

Alameda, California

PCI DSS

Houston, Texas payment security firm listed as a PCI Qualified Security Assessor (QSA) company.

Houston, Texas

CMMC

Woodbine, Maryland cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Woodbine, Maryland

CMMC

Cybersecurity and managed security firm in Akron, Ohio; authorized CMMC Third-Party Assessment Organization (C3PAO).

Akron, Ohio

HITRUST

Atlanta-based international law firm listed by HITRUST as an External Assessor.

Atlanta, Georgia

SOC 1SOC 2HITRUSTPCI DSS

Licensed CPA firm with a Nashville corporate office performing SOC, HITRUST and PCI DSS assessments, with locations listed in ten US cities.

Nashville, Tennessee · Atlanta, Georgia · Bethesda, Maryland · +7 more

CMMC

Framingham, Massachusetts firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Framingham, Massachusetts

CMMC

Carlsbad, California cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Carlsbad, California

SOC 1SOC 2ISO 27001ISO 27701 +4

Reston, Virginia attestation firm listed for SOC, ISO certification, FedRAMP, HITRUST and CMMC assessments.

Reston, Virginia

FedRAMPPCI DSS

US member firm of the KPMG network. FedRAMP-recognized third-party assessor and PCI Qualified Security Assessor company.

New York, New York · Chicago, Illinois · McLean, Virginia · +9 more

CERT-In

Noida-headquartered cybersecurity company with a Cupertino, California office; listed as a CERT-In empanelled information security auditor.

Noida, Uttar Pradesh · Cupertino, California

HITRUSTFedRAMPCMMCGovRAMP

Defense and technology company listed (as Kratos / Kratos Technology & Training Solutions) as a FedRAMP 3PAO, HITRUST External Assessor and CMMC C3PAO.

Herndon, Virginia

PCI DSS

New York risk and investigations firm whose cyber practice is listed as a PCI Qualified Security Assessor (QSA) company.

New York, New York

CMMC

Frederick, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Frederick, Maryland

PCI DSSFedRAMPCMMCGovRAMP

Scottsdale, Arizona cybersecurity audit firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO.

Scottsdale, Arizona

ISO 27001ISO 27701HITRUSTPCI DSS

Tennessee advisory firm headquartered in Brentwood (Nashville area) offering ISO certification, HITRUST and PCI DSS services.

Brentwood, Tennessee · Chattanooga, Tennessee · Knoxville, Tennessee · +5 more

CMMC

Charleston, South Carolina engineering and consulting firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Charleston, South Carolina

SOC 1SOC 2ISO 27001ISO 27701 +6

Denver-based CPA firm performing SOC examinations, ISO certification, FedRAMP, HITRUST, PCI DSS and CMMC assessments.

Denver, Colorado

FedRAMPCMMCGovRAMP

Ashburn, Virginia cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Ashburn, Virginia

CMMC

Huntsville, Alabama firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Huntsville, Alabama

SOC 1SOC 2HITRUST

Ohio CPA and advisory firm offering SOC 1 and SOC 2 reporting and HITRUST assessments, with offices in Ohio and Florida.

Cleveland, Ohio · Columbus, Ohio · Canton, Ohio · +3 more

CMMC

Arlington, Virginia CMMC assessment firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Arlington, Virginia

SOC 1SOC 2HITRUSTCMMC

Pennsylvania CPA firm based in Camp Hill offering SOC 1 and SOC 2 examinations and HITRUST assessments; listed as a CMMC C3PAO.

Camp Hill, Pennsylvania · Lancaster, Pennsylvania · Bloomsburg, Pennsylvania · +1 more

HITRUSTPCI DSS

Atlanta, Georgia healthcare-focused risk and compliance firm listed as a HITRUST External Assessor and PCI QSA.

Atlanta, Georgia

CMMC

McLean, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

McLean, Virginia

HITRUSTPCI DSSFedRAMPGovRAMP

Scottsdale, Arizona security and compliance firm listed as a PCI QSA, HITRUST External Assessor and FedRAMP 3PAO.

Scottsdale, Arizona

CMMC

Belcamp, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Belcamp, Maryland

CMMC

Portland, Maine information security firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Portland, Maine

ISO 27001ISO 27701

US entity of the NQA certification group with its North American headquarters in Acton, Massachusetts, offering accredited ISO/IEC 27001 and ISO/IEC 27701 certification.

Acton, Massachusetts

CERT-InPCI DSSHITRUST

Indian cybersecurity firm with offices in Bengaluru and Plano, Texas; listed as a CERT-In empanelled auditor (Mumbai address), PCI QSA and HITRUST External Assessor.

Bengaluru, Karnataka · Mumbai, Maharashtra · Plano, Texas

PCI DSS

Charlotte, North Carolina security firm listed as a PCI Qualified Security Assessor (QSA) company.

Charlotte, North Carolina

PCI DSS

Wichita, Kansas cybersecurity services firm with US offices in seven more states, listed as a PCI Qualified Security Assessor (QSA) company.

Wichita, Kansas · Paso Robles, California · Tempe, Arizona · +5 more

PCI DSS

Tokyo-based security services firm listed by the PCI SSC as a QSA company, with offices in Yokohama, Osaka and Irvine, California.

Tokyo, Tokyo · Yokohama, Kanagawa · Osaka, Osaka · +1 more

ISO 27001

US certification entity of Ireland’s National Standards Authority, headquartered in Nashua, New Hampshire; ANAB-accredited for ISO/IEC 27001 certification.

Nashua, New Hampshire

ISO 27001

Management systems certification body of the NSF group, based in Ann Arbor, Michigan, accredited by ANAB to certify information security management systems to ISO/IEC 27001.

Ann Arbor, Michigan

PCI DSSHITRUST

Leawood, Kansas cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company and a HITRUST External Assessor.

Leawood, Kansas · Newport Beach, California

CMMC

Atlanta, Georgia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Atlanta, Georgia

ISO 42001HITRUST

Princeton, New Jersey cybersecurity firm listed as a HITRUST External Assessor and an ANAB-accredited ISO/IEC 42001 certification body.

Princeton, New Jersey

CMMC

Tampa, Florida firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Tampa, Florida

PCI DSS

Chesterfield, Missouri security firm listed as a PCI Qualified Security Assessor (QSA) company.

Chesterfield, Missouri

CMMC

Tampa, Florida cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Tampa, Florida

SOC 1SOC 2

Licensed CPA firm headquartered in Cleveland, Ohio, performing SOC 1 and SOC 2 examinations, with offices in Ohio and New Jersey.

Cleveland, Ohio · Akron, Ohio · Lakewood, New Jersey

PCI DSS

Security testing and consultancy firm based in Buckingham, England with a New York office; listed as a PCI QSA.

Buckingham, England · New York, New York

CMMC

Hanover, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Hanover, Maryland

ISO 42001

Certification body headquartered in Troy, Michigan, offering accredited ISO/IEC 42001 AI management system certification among other standards.

Troy, Michigan

SOC 1SOC 2HITRUSTPCI DSS

Accounting and advisory firm with offices in Michigan, Illinois, Colorado, Ohio and other states; its cybersecurity practice covers SOC 1 and SOC 2 reporting, PCI DSS and HITRUST.

Southfield, Michigan · Broomfield, Colorado · Denver, Colorado · +17 more

HITRUSTPCI DSSFedRAMPCMMC +1

Nashville-based security assessment firm listed as a FedRAMP 3PAO, HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Nashville, Tennessee

ISO 27001

Certification program of the Performance Review Institute, headquartered in Warrendale, Pennsylvania, offering accredited ISO/IEC 27001 certification alongside aerospace and quality standards.

Warrendale, Pennsylvania

PCI DSS

US member firm of the PwC network; its site gives a registered address at 300 Madison Avenue, New York. Listed by the PCI Security Standards Council as a Qualified Security Assessor company.

New York, New York

HITRUSTPCI DSS

Menlo Park-based consulting firm offering PCI DSS assessments as a QSA company and HITRUST assessments as an authorized external assessor.

Menlo Park, California

CERT-InPCI DSS

Navi Mumbai-based security assurance firm with a US entity in Wilmington, Delaware; listed as a CERT-In empanelled auditor and PCI QSA.

Navi Mumbai, Maharashtra · Wilmington, Delaware

CMMC

Honolulu, Hawaii technology firm (CMMC services under its eResilience division) listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Honolulu, Hawaii

CMMC

Government technology services firm headquartered in Sterling, Virginia; authorized CMMC Third-Party Assessment Organization (C3PAO).

Sterling, Virginia

CMMC

Springfield, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Springfield, Virginia

PCI DSS

Montreal-based accounting and advisory firm listed as a PCI Qualified Security Assessor (QSA) company, with offices in Toronto, Calgary and Chicago.

Montreal, Quebec · Toronto, Ontario · Calgary, Alberta · +1 more

HITRUSTPCI DSS

Roswell, Georgia security and compliance firm listed as a PCI QSA and HITRUST External Assessor.

Roswell, Georgia

SOC 1SOC 2

CPA firm headquartered in Southlake, Texas, offering SOC 1, SOC 2 and SOC 3 attestations.

Southlake, Texas

HITRUSTPCI DSSCMMC

Southlake, Texas cybersecurity compliance firm listed as a HITRUST External Assessor, PCI QSA and CMMC C3PAO.

Southlake, Texas

PCI DSSHITRUSTFedRAMPGovRAMP

Chicago-headquartered US member of the RSM network; listed as a PCI Qualified Security Assessor company, HITRUST External Assessor and FedRAMP-recognized third-party assessor.

Chicago, Illinois

PCI DSS

US accounting and consulting firm with offices including St. Louis, Denver and Chicago; listed as a PCI Qualified Security Assessor company.

St. Louis, Missouri · Denver, Colorado · Chicago, Illinois

PCI DSS

Boulder, Colorado security firm listed as a PCI Qualified Security Assessor (QSA) company.

Boulder, Colorado

SOC 2ISO 27001

Maryland audit and advisory firm headquartered in Hunt Valley offering SOC examinations and ISO 27001 certification.

Hunt Valley, Maryland

ISO 27001ISO 27701ISO 42001HITRUST +5

Tampa-based attestation and certification firm offering ISO certification, FedRAMP, PCI DSS, HITRUST and CMMC assessments.

Tampa, Florida

SOC 1SOC 2HITRUSTPCI DSS +1

Pittsburgh-based CPA and advisory firm with offices in Columbus and McLean; performs SOC examinations and is listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Pittsburgh, Pennsylvania · Columbus, Ohio · McLean, Virginia

FedRAMPGovRAMP

Reston, Virginia-based cybersecurity advisory and assessment firm; listed on the FedRAMP Marketplace as a recognized independent assessor (3PAO) since October 2013.

Reston, Virginia

CMMC

Greenbelt, Maryland firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Greenbelt, Maryland · Baltimore, Maryland

CMMC

Lancaster, Pennsylvania cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Lancaster, Pennsylvania

ISO 27001ISO 42001HITRUSTPCI DSS +3

Security assessment firm with an Annapolis, Maryland address listed as a FedRAMP 3PAO, PCI QSA and HITRUST External Assessor, with an ANAB-accredited affiliate for ISO 27001 and ISO 42001.

Annapolis, Maryland

PCI DSSHITRUST

Orem, Utah data security and compliance company listed as a PCI QSA and HITRUST External Assessor.

Orem, Utah

SOC 1SOC 2ISO 27001ISO 27701 +3

California accounting and consulting firm whose GRC practice performs SOC, ISO and HITRUST engagements; its Drata directory listing describes its audits as remote-first.

San Jose, California · San Mateo, California · San Ramon, California · +3 more

FedRAMPCMMCGovRAMP

Huntsville, Alabama cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Huntsville, Alabama · North Charleston, South Carolina · Columbia, Maryland · +2 more

CMMC

Warrenton, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Warrenton, Virginia

FedRAMPCMMCGovRAMP

Cybersecurity assessment firm with offices listed in Plano, Norfolk and Washington, DC; listed as a FedRAMP 3PAO and CMMC C3PAO.

Plano, Texas · Norfolk, Virginia · Washington, District of Columbia

ISO 27001ISO 27701ISO 42001

US entity of the SGS group (Switzerland), accredited by ANAB for ISO/IEC 27001, 27701 and 42001 certification, with its local head office in Bloomfield, New Jersey.

Bloomfield, New Jersey

CMMC

Greenvale, New York firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Greenvale, New York

SOC 1SOC 2PCI DSS

Accounting, technology and advisory firm with US offices in the Midwest, Mid-Atlantic and New England and offices in India; its services include SOC reporting and PCI DSS assessments.

Chicago, Illinois · Alexandria, Virginia · Marlborough, Massachusetts · +13 more

CERT-InPCI DSSHITRUST

Bengaluru-headquartered information security firm listed as a CERT-In empanelled auditor, PCI QSA and HITRUST External Assessor.

Bengaluru, Karnataka · Irving, Texas

SOC 1SOC 2ISO 27001

Licensed CPA firm with offices in Georgia, North Carolina, South Carolina and Tennessee providing SOC 1 and SOC 2 reporting and accredited ISO/IEC 27001 certification.

Atlanta, Georgia · Cary, North Carolina · Charlotte, North Carolina · +4 more

ISO 27001CMMC

Fairlawn, Ohio certification body accredited by ANAB for ISO/IEC 27001 certification and listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Fairlawn, Ohio

PCI DSSCMMC

Plano, Texas security firm listed as a PCI Qualified Security Assessor (QSA) company and an authorized CMMC Third-Party Assessment Organization (C3PAO).

Plano, Texas

FedRAMP

Baltimore, Maryland-based cybersecurity assessment firm; listed on the FedRAMP Marketplace as a recognized third-party assessment organization (3PAO) since June 2025.

Baltimore, Maryland

CMMC

St. Louis, Missouri IT services firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

St. Louis, Missouri

SOC 1SOC 2HITRUST

Salt Lake City-based CPA firm whose IT assurance practice offers SOC 1 and SOC 2 examinations and HITRUST assessments, with offices in Lehi, Utah and Tempe, Arizona.

Salt Lake City, Utah · Lehi, Utah · Tempe, Arizona

CMMC

McLean, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

McLean, Virginia

HITRUSTPCI DSSFedRAMPCMMC

Irvine, California cybersecurity firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Irvine, California · Fairfax, Virginia · Scottsdale, Arizona

PCI DSS

Oakville, Ontario cybersecurity firm listed as a PCI Qualified Security Assessor (QSA) company.

Oakville, Ontario · West Palm Beach, Florida

PCI DSS

Charlotte, North Carolina penetration testing and security consulting firm; its QSA listing is under the legal name Strata Information Group, Inc.

Charlotte, North Carolina

PCI DSS

Fairlawn, Ohio-based cybersecurity firm offering penetration testing, incident response and compliance services, including PCI DSS assessments as a QSA company.

Fairlawn, Ohio

PCI DSS

Atlanta, Georgia cybersecurity and compliance firm listed as a PCI QSA.

Atlanta, Georgia

ISO 27001ISO 27701ISO 42001

North American entity of the TÜV Rheinland group, based in Boxborough, Massachusetts; ANAB-accredited for ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certification.

Boxborough, Massachusetts

ISO 27001

US subsidiary of the TÜV SÜD group (Germany), accredited by ANAB for ISO/IEC 27001 certification, headquartered in Wakefield, Massachusetts.

Wakefield, Massachusetts

HITRUSTPCI DSS

Chicago-headquartered security firm listed as a HITRUST External Assessor and PCI QSA.

Chicago, Illinois

FedRAMPCMMCGovRAMP

Northern Virginia cybersecurity assessment firm listed as a FedRAMP 3PAO and CMMC C3PAO.

McLean, Virginia

HITRUST

San Francisco-based law firm offering HITRUST readiness and certification services and privacy compliance work, listed by HITRUST as an External Assessor.

San Francisco, California

PCI DSS

Cybersecurity and compliance company with headquarters in Chicago and Dublin, offering PCI DSS assessments as a QSA company alongside penetration testing and vulnerability scanning.

Chicago, Illinois · Dublin, Dublin

PCI DSS

Los Angeles IT consulting and security firm listed as a PCI Qualified Security Assessor (QSA) company.

Los Angeles, California

PCI DSSHITRUST

US accounting and advisory firm headquartered in Milwaukee, Wisconsin; its Wipfli Advisory LLC entity (formerly CompliancePoint) is a PCI Qualified Security Assessor company and Wipfli LLP is a HITRUST External Assessor.

Milwaukee, Wisconsin

CMMC

Norfolk, Virginia cybersecurity and training firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Norfolk, Virginia

HITRUSTPCI DSS

Boston-based firm offering HITRUST and PCI DSS assessment services.

Boston, Massachusetts · Springfield, Massachusetts · Miami, Florida · +1 more

FedRAMP

Accenture Federal Services appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Chantilly, Virginia

FedRAMPGovRAMP

DataLock Consulting Group appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Fairfax, Virginia

FedRAMPGovRAMP

Earthling Security appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Potomac Falls, Virginia

FedRAMP

Excentium appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Reston, Virginia

FedRAMP

GMS Registrar appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Highland Heights, Ohio

FedRAMPGovRAMP

Information Technology Company appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Falls Church, Virginia

FedRAMP

MindPoint Group appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

McLean, Virginia

FedRAMPGovRAMP

RISC Point appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Cleveland, Ohio

FedRAMP

TalaTek appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Scottsdale, Arizona