Compliance audit firms in the United States

Global testing and certification firm, recognised by the PCI SSC for PTS POI and HSM evaluation, with labs in the UK and China.

A-LIGN provides cybersecurity compliance audits and certifications across frameworks like SOC 2 and ISO 27001.

The largest CPA-firm-based cybersecurity assessor in the US. Unique in holding FedRAMP 3PAO, PCI QSA, HITRUST, ISO 27001, and SOC attestation authority simultaneously.

Miami-based cybersecurity firm with 300+ employees and deep healthcare/HIPAA expertise. Delivering pen testing since 2000.

BARR Advisory helps organisations establish, manage, and audit cybersecurity and compliance programmes.

Johanson Group is a CPA firm providing security and compliance audits.

KirkpatrickPrice is a licensed CPA firm that performs cybersecurity audits and compliance assessments.

Prescient Assurance provides SOC 2 audits and security compliance certifications for SaaS companies.

TestPros is an independent IT compliance firm that has been testing since 1988.

YSecurity provides an on-demand cybersecurity team for startups, handling compliance and security reviews.

Compliance-focused cybersecurity advisory firm and FedRAMP 3PAO specializing in penetration testing that meets stringent regulatory requirements.

CREST-accredited California consultancy blending compliance expertise with penetration testing. First to earn ISO 17020 for MITRE ATT&CK and PTES frameworks.

Sets standards, audits and insures frontier AI systems and agents for security, safety and reliability.

Integrated risk management software covering enterprise and operational risk, IT and security risk, compliance, audit, third-party governance and operational resilience.

CyberSheath provides cybersecurity compliance services for DOD contractors, focusing on CMMC, DFARS, and NIST standards.

Drata provides a platform that automates security compliance, risk management and trust assurance for companies.

ERMProtect provides cybersecurity assessments, penetration testing, compliance audits, and digital forensics services.

Integris provides managed IT, cybersecurity, AI and cloud services to small and midsize businesses.

US engineering consultancy offering ISO 21434 consulting, TARA, security verification and automotive cybersecurity training.

GRC software covering IT and cyber risk, IT and cyber compliance, vendor and third-party risk, enterprise risk, regulatory compliance, internal audit and resilience.

Provides managed IT support, cybersecurity services and custom software to small businesses.

Audit, risk and compliance software, formerly AuditBoard, with controls management, cyber risk management, third-party risk, regulatory compliance and AI governance products.

Vanta provides a platform for automating security compliance and risk management.

Whistic provides a platform for assessing, monitoring, and sharing vendor security and compliance information.

Provides penetration testing, PCI ASV scanning, and managed security services for compliance and threat detection.

Cyberneza provides cybersecurity and compliance consulting for defense contractors and regulated organizations.

IntelliGRC provides software that helps managed service providers automate cybersecurity compliance and audit readiness.

NSS Labs provides independent testing and validation of cybersecurity controls and AI systems.