Audit firms in Virginia

PCI DSSHITRUST

Chantilly, Virginia cybersecurity firm listed as a PCI QSA (places of business include USA, UK and India) and HITRUST External Assessor.

Chantilly, Virginia

PCI DSSFedRAMPCMMC

Fredericksburg, Virginia assessment firm listed as a FedRAMP 3PAO, CMMC C3PAO and PCI QSA.

Fredericksburg, Virginia

CMMC

Sterling, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Sterling, Virginia

CMMC

Technology and consulting firm headquartered in McLean, Virginia; authorized CMMC Third-Party Assessment Organization (C3PAO).

McLean, Virginia

SOC 1SOC 2HITRUSTCMMC

CPA and advisory firm with offices across the US; performs SOC 1 and SOC 2 examinations and is listed as a HITRUST External Assessor and CMMC C3PAO.

Raleigh, North Carolina · Carlsbad, California · Torrance, California · +51 more

ISO 27001ISO 27701ISO 42001HITRUST +4

Cybersecurity advisory and assessment firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST assessor, ISO certification body and (via Coalfire Federal) CMMC C3PAO.

Chicago, Illinois · Alpharetta, Georgia · Bellevue, Washington · +2 more

CMMC

Accounting and advisory firm whose advisory affiliate is listed as a CMMC C3PAO (Tysons, Virginia).

Tysons, Virginia

ISO 27001ISO 27701ISO 42001HITRUST +5

Compliance assessment firm based in Fairfax, Virginia with an Indian entity in Mumbai; listed as PCI QSA, FedRAMP 3PAO, HITRUST assessor, C3PAO and CERT-In empanelled auditor. The Indian entity is NABCB-accredited for ISO/IEC 27001.

Fairfax, Virginia · Mumbai, Maharashtra

PCI DSSHITRUSTHIPAA

Reston, Virginia security compliance and assessment firm listed as a PCI Qualified Security Assessor (QSA) company and a HITRUST External Assessor; its site offers HIPAA-based assessments.

Reston, Virginia

ISO 27001FedRAMPHITRUST

US member firm of the Deloitte network. ANAB-accredited ISO/IEC 27001 certification body, FedRAMP-recognized third-party assessor and HITRUST External Assessor.

New York, New York · Chicago, Illinois · Arlington, Virginia · +15 more

PCI DSSHITRUST

US member firm of the EY global network; listed as a PCI DSS Qualified Security Assessor and a HITRUST External Assessor.

New York, New York · Chicago, Illinois · San Francisco, California · +11 more

FedRAMPCMMC

Arlington, Virginia information security and compliance firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Arlington, Virginia · Bellevue, Washington

ISO 27001ISO 27701PCI DSSFedRAMP +2

Virginia-based assessment firm listed as a FedRAMP 3PAO, PCI QSA and CMMC C3PAO, with an ANAB-accredited ISO certification arm.

Lansdowne, Virginia

HITRUSTPCI DSSCMMC

US accounting and advisory firm with offices in many states; listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Charlotte, North Carolina · Appleton, Wisconsin · Asheville, North Carolina · +72 more

PCI DSS

Reston, Virginia cybersecurity services firm listed as a PCI Qualified Security Assessor (QSA) company; its site offers PCI DSS compliance services.

Reston, Virginia

CMMC

Richmond, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Richmond, Virginia

HITRUSTHIPAA

Reston, Virginia healthcare cybersecurity firm listed as a HITRUST External Assessor; offers HIPAA security and privacy assessments.

Reston, Virginia

SOC 1SOC 2ISO 27001ISO 27701 +4

Reston, Virginia attestation firm listed for SOC, ISO certification, FedRAMP, HITRUST and CMMC assessments.

Reston, Virginia

FedRAMPPCI DSS

US member firm of the KPMG network. FedRAMP-recognized third-party assessor and PCI Qualified Security Assessor company.

New York, New York · Chicago, Illinois · McLean, Virginia · +9 more

HITRUSTFedRAMPCMMCGovRAMP

Defense and technology company listed (as Kratos / Kratos Technology & Training Solutions) as a FedRAMP 3PAO, HITRUST External Assessor and CMMC C3PAO.

Herndon, Virginia

FedRAMPCMMCGovRAMP

Ashburn, Virginia cybersecurity firm listed as a FedRAMP 3PAO and CMMC C3PAO.

Ashburn, Virginia

CMMC

Arlington, Virginia CMMC assessment firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Arlington, Virginia

CMMC

McLean, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

McLean, Virginia

CMMC

Government technology services firm headquartered in Sterling, Virginia; authorized CMMC Third-Party Assessment Organization (C3PAO).

Sterling, Virginia

CMMC

Springfield, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Springfield, Virginia

SOC 1SOC 2HITRUSTPCI DSS +1

Pittsburgh-based CPA and advisory firm with offices in Columbus and McLean; performs SOC examinations and is listed as a PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Pittsburgh, Pennsylvania · Columbus, Ohio · McLean, Virginia

FedRAMPGovRAMP

Reston, Virginia-based cybersecurity advisory and assessment firm; listed on the FedRAMP Marketplace as a recognized independent assessor (3PAO) since October 2013.

Reston, Virginia

CMMC

Warrenton, Virginia cybersecurity firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Warrenton, Virginia

FedRAMPCMMCGovRAMP

Cybersecurity assessment firm with offices listed in Plano, Norfolk and Washington, DC; listed as a FedRAMP 3PAO and CMMC C3PAO.

Plano, Texas · Norfolk, Virginia · Washington, District of Columbia

SOC 1SOC 2PCI DSS

Accounting, technology and advisory firm with US offices in the Midwest, Mid-Atlantic and New England and offices in India; its services include SOC reporting and PCI DSS assessments.

Chicago, Illinois · Alexandria, Virginia · Marlborough, Massachusetts · +13 more

CMMC

McLean, Virginia firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

McLean, Virginia

HITRUSTPCI DSSFedRAMPCMMC

Irvine, California cybersecurity firm listed as a FedRAMP 3PAO, PCI QSA, HITRUST External Assessor and CMMC C3PAO.

Irvine, California · Fairfax, Virginia · Scottsdale, Arizona

FedRAMPCMMCGovRAMP

Northern Virginia cybersecurity assessment firm listed as a FedRAMP 3PAO and CMMC C3PAO.

McLean, Virginia

CMMC

Norfolk, Virginia cybersecurity and training firm listed as an authorized CMMC Third-Party Assessment Organization (C3PAO).

Norfolk, Virginia

FedRAMP

Accenture Federal Services appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Chantilly, Virginia

FedRAMPGovRAMP

DataLock Consulting Group appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Fairfax, Virginia

FedRAMPGovRAMP

Earthling Security appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Potomac Falls, Virginia

FedRAMP

Excentium appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Reston, Virginia

FedRAMPGovRAMP

Information Technology Company appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

Falls Church, Virginia

FedRAMP

MindPoint Group appears on the FedRAMP Marketplace — recognized assessors (3PAO) as of 2026-10-27. This firm appears on the official registry, not independently verified by Agent Index.

McLean, Virginia