Auditor Directory
CMMC Auditors
Cybersecurity Maturity Model Certification (CMMC) 2.0
Browse accredited firms offering CMMC audits. Filter by location, size, and budget.
72 firms — interactive filtering loads below.
A-LIGN
Tampa, FL
A-LIGN is one of the largest and most recognized compliance audit firms in the United States. Profile includes pricing, framework coverage, reviews, and engagement process.
CliftonLarsonAllen
Minneapolis, MN
CliftonLarsonAllen is a Top 10 CPA firm offering SOC, SOX, HIPAA, FedRAMP, and ISO 27001 audits.
CliftonLarsonAllen LLP
Minneapolis, MN
CliftonLarsonAllen (CLA) is a top-eight US CPA firm headquartered in Minneapolis, offering SOC 1, SOC 2, ISO 27001, HIPAA, HITRUST, and CMMC audit services nationally.
Coalfire
Westminster, Colorado
Coalfire is a leading US cybersecurity advisory and audit firm specializing in FedRAMP, SOC 2, PCI DSS, HITRUST, and CMMC for cloud and technology companies.
Deloitte
London, United Kingdom
Deloitte is the world's largest professional services firm, offering audit, assurance, tax, and advisory services across 150+ countries worldwide.
Ernst & Young (EY)
London, United Kingdom
EY is a Big Four professional services firm providing audit, assurance, tax, consulting, and strategy services across more than 150 countries worldwide.
Grant Thornton LLP
Chicago, IL
Grant Thornton US is a top-seven national CPA firm offering SOC 1, SOC 2, ISO 27001, HIPAA, HITRUST, FedRAMP, and CMMC audit services for mid-market and enterprise companies.
GuidePoint Security
Herndon, VA
GuidePoint Security offers SOC 2, ISO 27001, FedRAMP, and CMMC compliance assessments.
KPMG
Amstelveen, Netherlands
KPMG is a Big Four professional services firm providing audit, tax, and advisory services through a global network spanning 143 countries and territories.
Kroll
New York, New York
Kroll is a global risk and financial advisory firm providing cybersecurity, compliance, and investigation services with deep expertise in digital forensics.
Optiv Security
Denver, CO
Optiv Security is one of the largest cybersecurity solutions firms offering SOC 2, ISO 27001, HITRUST, and FedRAMP.
PricewaterhouseCoopers (PwC)
London, United Kingdom
PwC is one of the Big Four professional services firms, providing audit, assurance, tax, and consulting services to major organizations in 152 countries.
Protiviti
Menlo Park, California
Protiviti is a global consulting firm specializing in internal audit, risk management, and compliance with 9,000+ professionals across 25+ countries.
RSM US LLP
Chicago, IL
RSM US LLP is the fifth-largest US CPA firm and a leading mid-market auditor offering SOC 1, SOC 2, ISO 27001, HIPAA, HITRUST, FedRAMP, and CMMC services nationwide.
Schellman & Company
Tampa, Florida
Schellman is a leading US compliance audit firm specializing in SOC 2, ISO 27001, FedRAMP, HITRUST, and PCI DSS assessments for technology companies.
24By7Security
Coral Springs, FL
24By7Security is a Coral Springs, FL cybersecurity consultancy and PCI QSA specializing in HIPAA, PCI DSS, SOC 2, and CMMC compliance.
360 Advanced
Nashville, TN
360 Advanced is a US-based compliance audit firm offering SOC 2, PCI DSS, HITRUST, ISO 27001, and HIPAA audits with a focus on technology and healthcare companies.
Abacode
Tampa, FL
Abacode is a Tampa-based managed cybersecurity and compliance provider aligning clients to CMMC, SOC 2, ISO 27001, and HIPAA frameworks.
ACI Federal
Alexandria, VA
ACI Federal is a FedRAMP 3PAO and CMMC C3PAO serving federal agencies and government contractors.
ANAB Accredited Certification Bodies
Milwaukee, WI
ANAB is the US national accreditation body under ANSI, accrediting ISO certification bodies to deliver ISO 27001, ISO 27701, and management system certifications.
Aprio
Atlanta, Georgia
Aprio is a top-25 US CPA and advisory firm offering SOC 2, ISO 27001, HITRUST, and cybersecurity assessments with strong technology sector expertise.
ASGN Cybersecurity
Glen Allen, VA
ASGN Cybersecurity is a boutique US cybersecurity and compliance firm specializing in SOC 2, FedRAMP, CMMC, and HITRUST assessments for government contractors and technology companies.
ASM Research
Fairfax, VA
ASM Research is a FedRAMP 3PAO and CMMC assessor for federal government contractors.
ATX Defense
Austin, TX
ATX Defense is the first Google Partner to become a CMMC C3PAO, specializing in FedRAMP and CMMC assessments for defense contractors in Austin, TX.
Avertium
Phoenix, AZ
Avertium is a managed security and compliance firm offering PCI DSS, HIPAA, CMMC, and SOC 2 assessment services from Arizona and Tennessee.
Beryllium InfoSec
Minneapolis, MN
Beryllium InfoSec is a Minneapolis-based compliance consultancy helping DoD contractors meet CMMC, NIST 800-171, and DFARS requirements via its Cuick Trac platform.
BKD CPAs & Advisors
Springfield, MO
BKD CPAs & Advisors is a leading mid-market US CPA firm based in Missouri offering SOC, ISO 27001, HIPAA, and cybersecurity audit services across the central United States.
BlueVoyant
New York, NY
BlueVoyant is a New York-based cyber defense company and CMMC RPO providing NIST 800-171 and CMMC compliance services to defense contractors.
Cadre Information Security
Cincinnati, OH
Cadre Information Security is a Cincinnati-based security consultancy founded in 1992 offering ISO 27001, CMMC, and NIST CSF compliance and assessment services.
ComplianceForge
Scottsdale, Arizona
ComplianceForge provides cybersecurity documentation templates, consulting, and NIST/CMMC/ISO implementation support for organizations building compliance programs.
CRI Advantage
Virginia Beach, VA
CRI Advantage specializes in FedRAMP, CMMC, and NIST compliance assessments for government contractors.
CSP & Associates
Reston, VA
CSP & Associates is a FedRAMP 3PAO and CMMC assessment firm serving government contractors.
CyberGuard360
Orlando, FL
CyberGuard360 provides SOC 2, CMMC, and NIST compliance assessments for SMBs and government contractors.
CyberSecOp
New York, NY
CyberSecOp is a New York-based security consultancy and CMMC RPO delivering SOC 2, ISO 27001, HIPAA, and PCI compliance readiness and advisory services.
CyberSheath
Reston, VA
CyberSheath is a Reston, VA compliance firm dedicated to DoD contractor requirements, delivering CMMC, NIST 800-171, and DFARS assessment and managed services.
DirectDefense
Englewood, CO
DirectDefense is a Colorado security services firm founded in 2011 offering PCI, CMMC, HIPAA, ISO 27001, and NERC CIP compliance assessments and managed security.
FTI Consulting
Washington, DC
FTI Consulting is a global expert firm founded in 1982, headquartered in Washington, DC, offering cybersecurity, risk, and regulatory compliance advisory.
HALOCK Security Labs
Schaumburg, IL
HALOCK Security Labs offers SOC 2, ISO 27001, HITRUST, and PCI DSS compliance assessments.
HoganTaylor
Tulsa, OK
HoganTaylor is a Tulsa-based CPA and advisory firm whose risk assurance team delivers SOC reports, HITRUST validated assessments, and CMMC services.
I.S. Partners LLC
Horsham, PA
I.S. Partners LLC is a Horsham, PA CPA and IT audit firm delivering SOC 1/2, HITRUST, HIPAA, PCI DSS, and ISO 27001 compliance assessments.
IBSS Corporation
San Antonio, TX
IBSS Corporation is a 30+ year federal cybersecurity provider and CMMC C3PAO maintaining strict separation between assessment and consulting services.
Illume Intelligence
Kozhikode, Kerala, India
Illume Intelligence is a Kerala-based cybersecurity firm with 16+ years experience in VAPT, red team testing, and compliance auditing for government and enterprise clients.
IT Audit Labs
Minneapolis, Minnesota
IT Audit Labs is a boutique US cybersecurity firm specializing in SOC 2, NIST, CMMC, and IT audit services for SMBs and defense contractors.
KForce Cybersecurity
Tampa, FL
KForce Cybersecurity provides SOC 2, ISO 27001, NIST, and CMMC compliance assessments.
Kratos Defense
San Diego, CA
Kratos Defense is one of the largest FedRAMP 3PAOs and among the first authorized CMMC C3PAOs, assessing cloud providers and defense contractors.
Lazarus Alliance
Scottsdale, AZ
Lazarus Alliance is a FedRAMP 3PAO and StateRAMP assessor in Scottsdale, AZ offering fast-track FedRAMP, SOC 2, PCI DSS, and CMMC assessments for government contractors.
Maxis Technology Group
Tampa, FL
Maxis Technology Group offers SOC 2, ISO 27001, CMMC, and PCI DSS compliance assessments.
McKonly & Asbury
Camp Hill, PA
McKonly & Asbury is a Camp Hill, PA CPA firm providing SOC 1, SOC 2, SOC 3, and HIPAA compliance audits alongside traditional assurance services.
Norse Consulting Group
Raleigh, NC
Norse Consulting Group offers SOC 2, ISO 27001, and CMMC assessments for mid-market companies.
Norse Shield
Washington, DC
Norse Shield specializes in CMMC, FedRAMP, and NIST compliance for defense contractors.
OCD Tech
Braintree, MA
OCD Tech is a Braintree, MA IT audit and cybersecurity firm delivering SOC 2 reporting, CMMC readiness, and IT security assessments across New England.
PBMares
Newport News, VA
PBMares is a top-100 CPA firm based in Newport News, VA offering SOC attestations, cybersecurity assessments, and DoD compliance services.
Pivot Point Security
Hamilton, NJ
Pivot Point Security is a New Jersey firm specializing in ISO 27001 certification, SOC 2, and PCI DSS assessments.
Pondurance
Indianapolis, IN
Pondurance provides managed detection and compliance assessments including SOC 2, ISO 27001, and CMMC.
Prescient Security
Nashville, TN
Prescient Security is a global compliance auditor with 3,600+ SOC 2 audits and 5,000+ customers, offering SOC 2, ISO 27001, HITRUST, FedRAMP, and CMMC assessments.
RedPoint Cybersecurity
San Antonio, TX
RedPoint Cybersecurity offers CMMC, SOC 2, and NIST compliance assessments in Texas.
Redspin
Duluth, GA
Redspin is the first authorized CMMC C3PAO in the US, conducting ~25% of all CMMC Level 2 assessments with former DoD cybersecurity professionals.
RISCPoint
Richmond, VA
RISCPoint is a security and compliance advisory firm and FedRAMP/StateRAMP 3PAO covering SOC 2, ISO 27001, CMMC, HITRUST, and federal frameworks.
Risk3Sixty
Roswell, GA
Risk3Sixty is a Roswell, GA security and compliance firm delivering SOC 2, ISO 27001, PCI DSS, HITRUST, and CMMC assessments plus vCISO services.
RSI Security
San Diego, CA
RSI Security is a San Diego compliance and cybersecurity firm — PCI QSA, CMMC C3PAO, and HITRUST External Assessor — covering SOC 2, HIPAA, and NIST.
SecurIT360
Birmingham, AL
SecurIT360 is a Birmingham, AL cybersecurity consultancy offering ISO 27001, CMMC, and NIST CSF compliance assessments alongside a 24/7 SOC.
Seiso
Pittsburgh, PA
Seiso is a Pittsburgh-based cybersecurity and GRC consultancy guiding growing companies through ISO 27001, SOC 2, CMMC, and NIST compliance.
Sera-Brynn
Chesapeake, VA
Sera-Brynn is a veteran-owned Virginia firm operating as an authorized CMMC C3PAO and FedRAMP 3PAO for defense and government cloud assessments.
Sikich
Naperville, Illinois
Sikich is a top-30 US professional services firm offering audit, technology, and cybersecurity services with strong Midwest presence and CMMC capabilities.
Silent Sector
Scottsdale, AZ
Silent Sector is a Scottsdale, AZ cybersecurity firm guiding mid-market companies through SOC 2, ISO 27001, CMMC, and HIPAA compliance.
StackArmor
Tysons, VA
StackArmor specializes in FedRAMP and CMMC compliance for government cloud deployments.
Summit 7 Systems
Huntsville, AL
Summit 7 Systems specializes in CMMC and NIST compliance for defense industrial base contractors.
TechGuard Security
Chesterfield, MO
TechGuard Security is a woman-owned Chesterfield, MO cybersecurity firm providing CMMC readiness, NIST 800-171 assessments, and IT audit services.
Telos Compliance
Ashburn, VA
Telos provides FedRAMP, CMMC, and NIST compliance assessment services for government contractors.
Tetra Defense (Arctic Wolf)
Madison, WI
Tetra Defense (Arctic Wolf) provides SOC 2, ISO 27001, and incident response compliance services.
Thrive
Foxborough, MA
Thrive is a Massachusetts-based global technology outsourcing provider delivering managed security and compliance services across regulated industries.
TwoSense Cybersecurity
Phoenix, AZ
TwoSense Cybersecurity offers SOC 2, ISO 27001, and CMMC assessments for growing companies.