theagentindex.io/guides/govramp-3pao-assessors/ · Last reviewed 27 Oct 2026
Free guide · GovRAMP · 3PAO · 27 Oct 2026
GovRAMP 3PAO list: A2LA-accredited assessors (32)
GovRAMP lists 32 A2LA-accredited Third-Party Assessment Organizations. This page uses the names exactly as that official table published them when we fetched it, links a firm to our profile when the firm is already in this directory, and explains Ready versus Core. Not a ranking.
What a GovRAMP 3PAO does
GovRAMP is a nonprofit membership organization with a NIST-aligned framework for verifying cloud and third-party technology used by state, local, tribal and education government. A2LA-accredited 3PAOs conduct independent assessments at the formal verification stages. [1]
GovRAMP’s third-party assessors page describes the path as follows:
- Core is a PMO-validated assessment of 60 NIST controls. A 3PAO is not required.
- Ready is a 12-month status based on an independent 3PAO assessment of 80 NIST controls, with PMO validation.
- Authorized / Provisional is a 12-month status based on an independent 3PAO assessment of 300+ NIST controls, with PMO validation.
Security Snapshot and Progressing Security Snapshot also do not require a 3PAO. [1]
Related: GovRAMP hub · agents tagged GovRAMP · FedRAMP 3PAOs · FedRAMP compliance automation tools.
The 32 A2LA-accredited 3PAOs
Names below are copied from the Organization Name column on govramp.org/third-party-assessors. Count at fetch: 32. Fetch time: 2026-10-27 14:50:00 UTC. 30 names already have an Agent Index profile; the rest are shown as plain text and are not added to the directory from this page. [1] [4]
| # | Organization (GovRAMP listing) | In this directory |
|---|---|---|
| 1 | A-LIGN | Yes — Verified |
| 2 | 360 Advanced | Yes — Verified |
| 3 | Coalfire | Yes — Verified |
| 4 | Emagine IT | Yes — Verified |
| 5 | Fortreum | Yes — Verified |
| 6 | Insight Assurance | Yes — Verified |
| 7 | Prescient Security | Yes — Verified |
| 8 | Securisea | Yes — Verified |
| 9 | AARC-360 | Yes — Verified |
| 10 | Aprio | Yes — Verified |
| 11 | Baker Tilly | Yes — Verified |
| 12 | Bladestack | Not yet listed |
| 13 | COACT | Yes — Verified |
| 14 | Control Case | Yes — Verified |
| 15 | Datalock Consulting Group | Yes — registry-listed |
| 16 | Earthling Security | Yes — registry-listed |
| 17 | Information Technology Company | Yes — registry-listed |
| 18 | InfusionPoints | Not yet listed |
| 19 | Kompleye | Yes — Verified |
| 20 | Kratos Defense | Yes — Verified |
| 21 | Lazarus Alliance | Yes — Verified |
| 22 | Linford & Company LLP | Yes — Verified |
| 23 | Lunarline, Inc. | Yes — Verified |
| 24 | MegaPlanIT | Yes — Verified |
| 25 | NCC Group Security Services, Inc. | Yes — Verified |
| 26 | RISCPoint | Yes — registry-listed |
| 27 | RSM | Yes — Verified |
| 28 | Schellman | Yes — Verified |
| 29 | SecureIT | Yes — Verified |
| 30 | Sentar | Yes — Verified |
| 31 | Sera Brynn | Yes — Verified |
| 32 | Vaultes | Yes — Verified |
Also see the GovRAMP program participants page. [2]
3PAO Discount Program
On 6 October 2026 GovRAMP announced that the 3PAO Discount Program includes 17 participating assessment organizations. That announcement is recorded here as a program fact. This page does not publish rates or treat participation as a price or ranking. [3]
Get matched
If you want a shortlist of listed firms for a published framework we already tag (SOC 2, ISO 27001, FedRAMP, GovRAMP, and the others in the form), use Get matched or the form below. We store the request for review; we do not email firms automatically.
Request received
Reference:
We'll review your request; no automatic emails. Introductions start later. Nothing was sent to any firm.
FAQ
What does a GovRAMP 3PAO do?
A GovRAMP Third-Party Assessment Organization (3PAO) is an independent A2LA-accredited assessor. GovRAMP says 3PAOs conduct independent assessments for Ready (80 NIST controls) and Authorized / Provisional (300+ NIST controls) verification. Core is a PMO-validated assessment and does not require a 3PAO.
How many A2LA-accredited GovRAMP 3PAOs are listed?
GovRAMP’s third-party assessors page listed 32 A2LA-accredited 3PAOs when we fetched it on 2026-10-27 14:50:00 UTC. 30 of those names already have a profile in this directory (Verified or registry-listed). Names without a profile are shown as plain text.
What is the GovRAMP 3PAO Discount Program?
GovRAMP announced on 6 October 2026 that the 3PAO Discount Program includes 17 participating assessment organizations. This page does not publish rates or imply a price.
Get updates by email
Subscribe to the Brief
Weekly, free, unsubscribe anytime.
Check your inbox to confirm your email. We’ll only send the weekly brief after you click the link.
We use your email only to send the newsletter. See our privacy policy.
Sources
- GovRAMP third-party assessors (A2LA-accredited 3PAOs), fetched 2026-10-27 14:50:00 UTC. https://govramp.org/third-party-assessors
- GovRAMP program participants. https://govramp.org/program-participants
- GovRAMP 3PAO Discount Program expands to 17 participating assessment organizations, 6 Oct 2026. https://govramp.org/news/govramp-3pao-discount-program-expands-to-17-participating-assessment-organizations
- Agent Index auditors dataset v0.1.32, generated 2026-10-27. https://theagentindex.io/auditors.json
Prepared by Agent Index (Heritage Services). Last reviewed 27 Oct 2026. General information, not legal advice. Confirm scope with your counsel or auditor. Licensed CC BY 4.0.