Auditor Directory
NIST 800-53 Auditors
NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
Browse accredited firms offering NIST 800-53 audits. Filter by location, size, and budget.
65 firms — interactive filtering loads below.
A-LIGN
Tampa, FL
A-LIGN is one of the largest and most recognized compliance audit firms in the United States. Profile includes pricing, framework coverage, reviews, and engagement process.
Baker Tilly
Chicago, Illinois
Baker Tilly is a top-10 global advisory CPA firm network with 43,000+ professionals in 141 countries, serving mid-market and growth companies.
BDO International
Brussels, Belgium
BDO is the fifth-largest professional services network globally, providing audit, tax, and advisory services through member firms in over 160 countries.
CliftonLarsonAllen
Minneapolis, MN
CliftonLarsonAllen is a Top 10 CPA firm offering SOC, SOX, HIPAA, FedRAMP, and ISO 27001 audits.
Coalfire
Westminster, Colorado
Coalfire is a leading US cybersecurity advisory and audit firm specializing in FedRAMP, SOC 2, PCI DSS, HITRUST, and CMMC for cloud and technology companies.
Crowe Global
New York, United States
Crowe Global is a top-10 global accounting network providing audit, tax, and advisory services through member firms in over 145 countries worldwide.
Deloitte
London, United Kingdom
Deloitte is the world's largest professional services firm, offering audit, assurance, tax, and advisory services across 150+ countries worldwide.
Deloitte India
Mumbai, India
Deloitte India is a Big Four professional services firm providing SOC 2, ISO 27001, DPDPA, SOX, and comprehensive risk advisory services to India's largest corporations and multinational subsidiaries.
Deloitte Middle East
Dubai, UAE
Deloitte Middle East is the region's largest professional services firm, providing Big Four audit, assurance, and advisory services across the MENA region.
Ernst & Young (EY)
London, United Kingdom
EY is a Big Four professional services firm providing audit, assurance, tax, consulting, and strategy services across more than 150 countries worldwide.
EY India
Mumbai, India
EY India is the largest Big Four operation in India by headcount, providing SOC 2, ISO 27001, DPDPA, SOX, and comprehensive risk advisory services across all major industries.
EY MENA
Dubai, UAE
EY MENA provides Big Four audit, assurance, tax, and advisory services across the Middle East and North Africa with offices in 15+ MENA countries.
Forvis Mazars (US)
Springfield, Missouri
Forvis Mazars is a top-10 US professional services firm formed from the merger of BKD and Dixon Hughes Goodman, now part of the Mazars global network.
Grant Thornton
London, United Kingdom
Grant Thornton is a leading global professional services network providing audit, tax, and advisory services through member firms in over 140 countries.
Grant Thornton LLP
Chicago, IL
Grant Thornton US is a top-seven national CPA firm offering SOC 1, SOC 2, ISO 27001, HIPAA, HITRUST, FedRAMP, and CMMC audit services for mid-market and enterprise companies.
GuidePoint Security
Herndon, VA
GuidePoint Security offers SOC 2, ISO 27001, FedRAMP, and CMMC compliance assessments.
KPMG
Amstelveen, Netherlands
KPMG is a Big Four professional services firm providing audit, tax, and advisory services through a global network spanning 143 countries and territories.
KPMG India
Mumbai, India
KPMG India is a Big Four professional services firm providing SOC 2, ISO 27001, DPDPA, and enterprise risk advisory services to India's largest organizations across financial services, technology, and government sectors.
KPMG Lower Gulf
Dubai, UAE
KPMG Lower Gulf is KPMG's UAE and Oman practice, providing Big Four audit, assurance, tax, and advisory services across the Gulf region.
Kroll
New York, New York
Kroll is a global risk and financial advisory firm providing cybersecurity, compliance, and investigation services with deep expertise in digital forensics.
NCC Group (US)
New York, NY
NCC Group is a global cybersecurity consultancy offering SOC 2, ISO 27001, PCI DSS, and FedRAMP assessments.
PricewaterhouseCoopers (PwC)
London, United Kingdom
PwC is one of the Big Four professional services firms, providing audit, assurance, tax, and consulting services to major organizations in 152 countries.
Protiviti
Menlo Park, California
Protiviti is a global consulting firm specializing in internal audit, risk management, and compliance with 9,000+ professionals across 25+ countries.
PwC India
Mumbai, India
PwC India is a Big Four professional services firm providing SOC 2, ISO 27001, DPDPA, SOX, and enterprise risk advisory services to India's largest corporations and multinational subsidiaries.
PwC Middle East
Dubai, UAE
PwC Middle East is a Big Four professional services firm providing SOC 2, ISO 27001, NESA, PDPL, and enterprise risk advisory services across the UAE, Saudi Arabia, and the broader Middle East region.
RSM International
London, United Kingdom
RSM International is the sixth-largest global professional services network, delivering audit, tax, and consulting services across 120+ countries.
RSM US LLP
Chicago, IL
RSM US LLP is the fifth-largest US CPA firm and a leading mid-market auditor offering SOC 1, SOC 2, ISO 27001, HIPAA, HITRUST, FedRAMP, and CMMC services nationwide.
Schellman & Company
Tampa, Florida
Schellman is a leading US compliance audit firm specializing in SOC 2, ISO 27001, FedRAMP, HITRUST, and PCI DSS assessments for technology companies.
TCS (Tata Consultancy Services)
Mumbai, India
TCS is India's largest IT services company offering cybersecurity, compliance audit, and risk advisory services to enterprises across 46 countries worldwide.
ACI Federal
Alexandria, VA
ACI Federal is a FedRAMP 3PAO and CMMC C3PAO serving federal agencies and government contractors.
Aprio
Atlanta, Georgia
Aprio is a top-25 US CPA and advisory firm offering SOC 2, ISO 27001, HITRUST, and cybersecurity assessments with strong technology sector expertise.
Arete Advisors
Nashville, TN
Arete Advisors is a healthcare compliance specialist based in Nashville, focusing on HIPAA, HITRUST, and health-tech security assessments.
Armanino
San Ramon, California
Armanino is a top-25 US CPA firm based in California with strong technology sector focus, offering SOC 2, ISO 27001, and cybersecurity assessments.
ASGN Cybersecurity
Glen Allen, VA
ASGN Cybersecurity is a boutique US cybersecurity and compliance firm specializing in SOC 2, FedRAMP, CMMC, and HITRUST assessments for government contractors and technology companies.
ASM Research
Fairfax, VA
ASM Research is a FedRAMP 3PAO and CMMC assessor for federal government contractors.
AssurancePoint
Atlanta, GA
AssurancePoint is a boutique CPA firm specializing in SOC 2 audits for technology companies. Profile includes pricing, framework coverage, and engagement details.
BARR Advisory
Fairway, KS
BARR Advisory is a Kansas-based cybersecurity and compliance firm specializing in SOC 2, HITRUST, FedRAMP, and ISO 27001 audits for cloud-first companies.
Beryllium InfoSec
Minneapolis, MN
Beryllium InfoSec is a Minneapolis-based compliance consultancy helping DoD contractors meet CMMC, NIST 800-171, and DFARS requirements via its Cuick Trac platform.
BlueVoyant
New York, NY
BlueVoyant is a New York-based cyber defense company and CMMC RPO providing NIST 800-171 and CMMC compliance services to defense contractors.
CohnReznick LLP
New York, NY
CohnReznick is a top-20 US accounting firm providing SOC 2, ISO 27001, HIPAA, and financial audit services to mid-market and enterprise clients across technology, financial services, and healthcare.
Compass IT Compliance
Tampa, FL
Compass IT Compliance is a PCI DSS specialist firm serving retail, healthcare, and hospitality organizations. Profile includes pricing and framework coverage.
ComplianceForge
Scottsdale, Arizona
ComplianceForge provides cybersecurity documentation templates, consulting, and NIST/CMMC/ISO implementation support for organizations building compliance programs.
ControlCase
Fairfax, Virginia
ControlCase is a compliance and cybersecurity firm specializing in PCI DSS, SOC 2, ISO 27001, and HITRUST audits with a unified compliance approach.
CRI Advantage
Virginia Beach, VA
CRI Advantage specializes in FedRAMP, CMMC, and NIST compliance assessments for government contractors.
CSP & Associates
Reston, VA
CSP & Associates is a FedRAMP 3PAO and CMMC assessment firm serving government contractors.
EisnerAmper
New York, New York
EisnerAmper is a top-20 US accounting and advisory firm offering audit, tax, and cybersecurity services with strong presence in the Northeast and nationally.
IT Audit Labs
Minneapolis, Minnesota
IT Audit Labs is a boutique US cybersecurity firm specializing in SOC 2, NIST, CMMC, and IT audit services for SMBs and defense contractors.
Kratos Defense
San Diego, CA
Kratos Defense is one of the largest FedRAMP 3PAOs and among the first authorized CMMC C3PAOs, assessing cloud providers and defense contractors.
Lazarus Alliance
Scottsdale, AZ
Lazarus Alliance is a FedRAMP 3PAO and StateRAMP assessor in Scottsdale, AZ offering fast-track FedRAMP, SOC 2, PCI DSS, and CMMC assessments for government contractors.
MindPoint Group
Alexandria, VA
MindPoint Group, a Tyto Athene company, is an Alexandria, VA FedRAMP 3PAO providing FedRAMP, FISMA, SOC 2, and ISO 27001 assessment services.
Moss Adams
Seattle, Washington
Moss Adams is one of the largest US CPA firms, providing audit, tax, and consulting services from 30+ offices primarily across the Western United States.
Norse Shield
Washington, DC
Norse Shield specializes in CMMC, FedRAMP, and NIST compliance for defense contractors.
Plante Moran
Southfield, Michigan
Plante Moran is a top-15 US CPA firm known for exceptional workplace culture, providing audit, tax, and cybersecurity services to mid-market companies.
Plurilock
Toronto, ON, Canada
Plurilock is a Canadian cybersecurity and compliance firm offering SOC 2, ISO 27001, HITRUST, and FedRAMP assessments for technology and government organizations.
Protiviti India
Mumbai, India
Protiviti India provides internal audit, IT risk, and compliance services including ISO 27001, SOC 2, and CERT-In assessments for Indian enterprises.
Protiviti Middle East
Dubai, UAE
Protiviti Middle East provides internal audit, IT risk, and compliance services including ISO 27001 and SOC 2 for organizations across the Gulf region.
SecureIT
Reston, VA
SecureIT is a Reston, VA cybersecurity compliance firm and FedRAMP 3PAO performing FedRAMP, FISMA, SOC, and ISO 27001 assessments.
Sikich
Naperville, Illinois
Sikich is a top-30 US professional services firm offering audit, technology, and cybersecurity services with strong Midwest presence and CMMC capabilities.
StackArmor
Tysons, VA
StackArmor specializes in FedRAMP and CMMC compliance for government cloud deployments.
Summit 7 Systems
Huntsville, AL
Summit 7 Systems specializes in CMMC and NIST compliance for defense industrial base contractors.
System 1 Inc.
Denver, CO
System 1 Inc. is a Denver-area cybersecurity consultancy advising government and critical infrastructure clients on IT audit and NIST-based compliance.
Telos Compliance
Ashburn, VA
Telos provides FedRAMP, CMMC, and NIST compliance assessment services for government contractors.
Tevora
Irvine, CA
Tevora is a boutique cybersecurity and compliance firm based in Southern California specializing in SOC 2, PCI DSS, HITRUST, and ISO 27001 assessments for startups and mid-market companies.
Vista InfoSec
Mumbai, India
Vista InfoSec is a global cybersecurity and compliance firm offering PCI DSS, SOC 2, ISO 27001, and GDPR assessments at competitive international pricing.
Wipfli
Milwaukee, Wisconsin
Wipfli is a top-20 US CPA and consulting firm with strong Midwest presence, providing audit, tax, and cybersecurity advisory services to mid-market clients.