Print / Save PDF

Agent Index lists 518 Verified · 51 registry-listed compliance audit firms (569 total) in dataset v0.1.33. The auditors directory is the full index. This page adds the per-framework and per-country tables that hub does not show, plus UK office counts and the official-registry links used to check a name. [1]

Verified firms by framework

A firm can hold more than one framework tag, so rows do not sum to the directory total. Only Verified firms count toward the three-firm floor for a location page. Registry-listed firms appear on existing pages and are labelled.

Verified firms by HQ country

Headquarters country is the stored hq_country field. A firm can also have offices in other countries. Location pages exist only where at least three Verified firms have an office.

Firms holding three or more frameworks

65 Verified firms and 0 registry-listed firms carry three or more stored framework tags. Verified firms are listed first. Tag count is not a quality score.

• 360 Advanced — SOC 1, SOC 2, ISO 27001, ISO 27701, HITRUST, PCI DSS, FedRAMP, GovRAMP
• A-LIGN — ISO 27001, ISO 27701, ISO 42001, HITRUST, PCI DSS, FedRAMP, CMMC, GovRAMP
• AARC-360 — SOC 1, SOC 2, HITRUST, PCI DSS, FedRAMP, GovRAMP
• Anthony Timbers — PCI DSS, FedRAMP, CMMC
• Aprio — SOC 2, ISO 27001, ISO 27701, ISO 42001, HITRUST, PCI DSS, FedRAMP, CMMC, GovRAMP
• Armanino — PCI DSS, HITRUST, ISO 27001, ISO 27701, ISO 42001
• Baker Tilly US — PCI DSS, HITRUST, FedRAMP, ISO 27001, ISO 27701, ISO 42001, GovRAMP
• Boulay — SOC 1, SOC 2, ISO 27001
• BSI — ISO 27001, ISO 27701, ISO 42001
• BSI Group Japan — ISO 27001, ISO 27701, PCI DSS
• Bureau Veritas India — ISO 27001, ISO 27701, ISO 42001
• CBIZ — PCI DSS, ISO 27001, ISO 27701
• Cherry Bekaert — SOC 1, SOC 2, HITRUST, CMMC
• Coalfire — ISO 27001, ISO 27701, ISO 42001, HITRUST, PCI DSS, FedRAMP, CMMC, GovRAMP
• ControlCase — ISO 27001, ISO 27701, ISO 42001, HITRUST, PCI DSS, FedRAMP, CMMC, CERT-In, GovRAMP
• Crimson Security — PCI DSS, HITRUST, HIPAA
• CyberCrest Compliance — SOC 2, HITRUST, HIPAA
• Decrypt Compliance — SOC 1, SOC 2, HITRUST, HIPAA
• DEKRA Certification, Inc. (DEKRA US) — ISO 27001, ISO 27701, ISO 42001
• Deloitte & Touche LLP (Deloitte US) — ISO 27001, FedRAMP, HITRUST
• DNV Business Assurance Netherlands — ISO 27001, ISO 27701, ISO 42001
• Elliott Davis — SOC 1, SOC 2, PCI DSS
• Emagine IT — FedRAMP, CMMC, GovRAMP
• Fortreum — ISO 27001, ISO 27701, PCI DSS, FedRAMP, CMMC, GovRAMP
• Forvis Mazars — HITRUST, PCI DSS, CMMC
• Frank, Rimerman + Co. — SOC 1, SOC 2, ISO 27001, ISO 27701
• Frazier & Deeter — SOC 2, HITRUST, PCI DSS, HIPAA
• I.S. Partners — ISO 27001, HITRUST, CMMC, PCI DSS
• Ignyte Assurance — PCI DSS, FedRAMP, CMMC
• Insight Assurance — HITRUST, PCI DSS, FedRAMP, CMMC, GovRAMP
• KirkpatrickPrice — SOC 1, SOC 2, HITRUST, PCI DSS
• Kompleye — SOC 1, SOC 2, ISO 27001, ISO 27701, HITRUST, FedRAMP, CMMC, GovRAMP
• KPMG LLP (KPMG US) — FedRAMP, PCI DSS, HITRUST
• Kratos — HITRUST, FedRAMP, CMMC, GovRAMP
• Lazarus Alliance — PCI DSS, FedRAMP, CMMC, GovRAMP
• LBMC — ISO 27001, ISO 27701, HITRUST, PCI DSS
• Linford & Company — SOC 1, SOC 2, ISO 27001, ISO 27701, HITRUST, PCI DSS, FedRAMP, CMMC, HIPAA, GovRAMP
• Lunarline — FedRAMP, CMMC, GovRAMP
• Maloney + Novotny — SOC 1, SOC 2, HITRUST
• McKonly & Asbury — SOC 1, SOC 2, HITRUST, CMMC
• MegaplanIT — HITRUST, PCI DSS, FedRAMP, GovRAMP
• MHM CPA — SOC 1, SOC 2, ISO 27001, ISO 27701, ISO 42001
• NCC Group — PCI DSS, HITRUST, FedRAMP, GovRAMP
• Network Intelligence — CERT-In, PCI DSS, HITRUST
• Plante Moran — SOC 1, SOC 2, HITRUST, PCI DSS
• Prescient Security — HITRUST, PCI DSS, FedRAMP, CMMC, GovRAMP
• RSI Security — HITRUST, PCI DSS, CMMC
• RSM US LLP — PCI DSS, HITRUST, FedRAMP, GovRAMP, CMMC
• Schellman — ISO 27001, ISO 27701, ISO 42001, HITRUST, PCI DSS, FedRAMP, CMMC, HIPAA, GovRAMP
• Schneider Downs — SOC 1, SOC 2, HITRUST, PCI DSS, CMMC
• Securisea — ISO 27001, ISO 42001, HITRUST, PCI DSS, FedRAMP, HIPAA, GovRAMP
• Sensiba — SOC 1, SOC 2, ISO 27001, ISO 27701, ISO 42001, HITRUST, HIPAA
• Sentar — FedRAMP, CMMC, GovRAMP
• Sera Brynn — FedRAMP, CMMC, GovRAMP
• SGS North America — ISO 27001, ISO 27701, ISO 42001
• Sikich — SOC 1, SOC 2, PCI DSS
• SISA — CERT-In, PCI DSS, HITRUST
• Smith + Howard — SOC 1, SOC 2, ISO 27001
• Tanner LLP — SOC 1, SOC 2, HITRUST
• Tevora — HITRUST, PCI DSS, FedRAMP, CMMC
• TÜV India — ISO 27001, ISO 27701, ISO 42001
• TÜV NORD Nederland — ISO 27001, ISO 27701, ISO 42001
• TÜV Rheinland of North America — ISO 27001, ISO 27701, ISO 42001
• TÜV SÜD South Asia — ISO 27001, ISO 27701, ISO 42001, PCI DSS, CERT-In
• Vaultes — FedRAMP, CMMC, GovRAMP

UK presence

60 Verified firms have a United Kingdom headquarters or a UK office. 23 of the UK-office firms list London and 7 list Manchester. Audit firms in the United Kingdom (61 firms with a UK office).

Search demand for IT auditing services in London and the UK is a reason this page exists; the counts are still the stored office rows, not a ranking of UK firms.

How to choose and how to verify

Pick the framework you need first, then confirm the legal name on the official registry. Use Check an Auditor to look up the stored row, then open the live registry.

1. Choose the framework (SOC 2, ISO 27001, PCI DSS, CMMC, HITRUST, FedRAMP, GovRAMP, CERT-In, ISMAP or another published tag).
2. Filter the directory or this page’s assessor guides.
3. Open the official registry and match the legal entity, not a trading name.
4. Read the stored checked date on the firm profile. Re-check the live source before you engage the firm.

Official registries used on this site:

• ANAB Management Systems CB Directory — US ISO/IEC 27001 (and related) certification-body accreditation
• UKAS certification-body schedules — UK ISO/IEC 27001 certification-body accreditation
• HITRUST External Assessor list — HITRUST Authorized External Assessors (not readiness licensees)
• PCI SSC Qualified Security Assessor list — PCI DSS QSA companies
• FedRAMP Marketplace assessors — FedRAMP-recognized 3PAO assessors
• Cyber AB Marketplace — CMMC C3PAO listings
• CERT-In empanelled auditors list — India CERT-In empanelment
• NABCB management-system certification bodies — India ISO/IEC 27001 (and related) certification-body accreditation
• ISMAP audit institution list — Japan ISMAP (government cloud security) audit institutions
• GovRAMP accredited 3PAO list — GovRAMP A2LA-accredited third-party assessment organizations

Related: all audit firms · UK audit firms · PCI QSA · ISO 27001 certification bodies · CMMC C3PAO · HITRUST · FedRAMP 3PAO · GovRAMP 3PAO · CERT-In · ISMAP.

Registry-listed firms

51 firms are labelled Registry-listed. This firm appears on the official registry, not independently verified by Agent Index. They appear on existing pages, search, MCP (verified: false) and Check an Auditor, ranked after Verified firms. They do not get a badge page or a claim CTA, and they do not create new city or framework-by-location pages.

• 0 Tolerance Security · Registry-listed — PCI DSS
• 112Cyber · Registry-listed — CMMC
• AAA Technologies · Registry-listed — CERT-In
• Accenture Federal Services · Registry-listed — FedRAMP
• Ace of Cloud · Registry-listed — CMMC
• Alliant Cybersecurity · Registry-listed — HITRUST
• Ariento · Registry-listed — CMMC
• Bastion Security Group · Registry-listed — PCI DSS
• Blue Ink Security · Registry-listed — HITRUST
• Bonadio Group · Registry-listed — HITRUST
• Business Transformation Institute · Registry-listed — CMMC
• Citrin Cooperman Advisors · Registry-listed — PCI DSS
• Confide · Registry-listed — PCI DSS
• CyberNINES · Registry-listed — CMMC
• CyberOne · Registry-listed — PCI DSS
• Cyderes · Registry-listed — PCI DSS
• Cynox Security · Registry-listed — CERT-In
• CyNtell · Registry-listed — CMMC
• CypherLeap · Registry-listed — PCI DSS
• Cyro Cyber · Registry-listed — PCI DSS
• DataLock Consulting Group · Registry-listed — FedRAMP, GovRAMP
• DeMase Technical Services · Registry-listed — CMMC
• DTC · Registry-listed — CMMC
• Earthling Security · Registry-listed — FedRAMP, GovRAMP
• Emerald Technical Solutions · Registry-listed — CMMC
• Eretmis · Registry-listed — PCI DSS
• Excentium · Registry-listed — FedRAMP
• FASTRICS · Registry-listed — PCI DSS
• FD Cyber Defense · Registry-listed — CMMC
• GMS Registrar · Registry-listed — FedRAMP, CMMC
• Grant Thornton Taiyo LLC (太陽有限責任監査法人) · Registry-listed — ISMAP
• ISOAH Data Securities · Registry-listed — CERT-In
• JHS & Associates · Registry-listed — CERT-In
• Katz, Sapper, & Miller · Registry-listed — HITRUST
• LevelBlue · Registry-listed — HITRUST
• Link Tech · Registry-listed — PCI DSS
• MindPoint Group · Registry-listed — FedRAMP
• Nangia & Co · Registry-listed — CERT-In
• Neutral Partners · Registry-listed — HITRUST
• PKF O'Connor Davies · Registry-listed — CMMC
• Reef Systems Security · Registry-listed — CMMC
• RISC Point · Registry-listed — FedRAMP, GovRAMP
• Sandbox Security · Registry-listed — PCI DSS
• Streamscan AI · Registry-listed — PCI DSS
• SysAudits · Registry-listed — CMMC
• TalaTek · Registry-listed — FedRAMP, CMMC
• Techellence · Registry-listed — CMMC
• The CMMC Team · Registry-listed — CMMC
• Tuxcentrix Consultancy · Registry-listed — CERT-In
• Univate Solutions · Registry-listed — PCI DSS
• usd AG · Registry-listed — PCI DSS

Get matched

If you want a shortlist of listed firms for any published framework or location, use Get matched or the form below. We store the request for review; we do not email firms automatically.

Get matched

FAQ

How many cybersecurity audit companies are listed?

This directory lists 518 Verified · 51 registry-listed compliance audit firms (569 total) in dataset v0.1.33. Counts are computed at build from auditors.json.

What is the difference between Verified and registry-listed?

Verified firms are independently checked by Agent Index. A registry-listed firm appears on the official registry, not independently verified by Agent Index.

Which frameworks have the most Verified firms here?

Verified headquarters counts are not a ranking. Verified firm counts by stored framework tag: SOC 2 26, ISO 27001 185, PCI DSS 166, CMMC 78, HITRUST 70, FedRAMP 36, GovRAMP 27, CERT-In 117, ISMAP 7, ISO 27701 45, ISO 42001 33, HIPAA 12, SOC 1 22.

How many cybersecurity audit companies are in the UK?

60 Verified firms have a UK headquarters or a UK office. 23 have a London office and 7 have a Manchester office, counting stored office rows.

How do I verify a cybersecurity audit company?

Search the legal name on the official registry for that framework (PCI SSC QSA, Cyber AB Marketplace, HITRUST External Assessor list, CERT-In PDF, FedRAMP Marketplace, GovRAMP 3PAO list, ISMAP audit institution list, or the national accreditation register for ISO 27001). Check an Auditor on this site links the stored registry row.

Sources

1. Agent Index auditors dataset v0.1.33, generated 2026-10-28. https://theagentindex.io/auditors.json
2. PCI SSC Qualified Security Assessor list. https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors/
3. Cyber AB Marketplace (C3PAO). https://cyberab.org/Catalog
4. HITRUST Authorized External Assessor list. https://hitrustalliance.net/find-an-external-assessor
5. CERT-In empanelled information security auditing organisations. https://www.cert-in.org.in/PDF/Empanel_org.pdf
6. FedRAMP Marketplace — recognized assessors (3PAO). https://www.fedramp.gov/marketplace/assessors/
7. GovRAMP accredited 3PAO list. https://govramp.org/third-party-assessors
8. ISMAP audit institution list. https://www.ismap.go.jp/csm?id=audit_institution_list

Prepared by Agent Index (Heritage Services). Last reviewed 28 Oct 2026. General information, not legal advice. Confirm scope with your counsel or auditor. Licensed CC BY 4.0.