Audit firms by framework and region

CMMC is the US Department of Defense's cybersecurity certification requirement for contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), assessed by accredited C3PAOs (Level 2) or the government's DIBCAC (Level 3).

• CMMC auditors in North America10 firms

GDPR is the EU's data protection law. Compliance is demonstrated through audits and documentation, not a single official certificate.

• GDPR auditors in Europe8 firms

HIPAA is US law governing how protected health information is safeguarded. There is no official certificate. Compliance is shown through independent assessment.

• HIPAA auditors in North America13 firms

HITRUST CSF is a certifiable framework widely required in US healthcare and health-tech, increasingly used alongside or instead of HIPAA, assessed by HITRUST Authorized External Assessor organizations.

• HITRUST auditors in North America9 firms

ISO/IEC 27001 is the international standard for information security management. An accredited certification body audits your ISMS and issues a certificate.

• ISO 27001 auditors in North America19 firms
• ISO 27001 auditors in Europe24 firms

NIS2 is an EU cybersecurity law requiring essential and important entities to manage security risks, report incidents, and hold management accountable.

• NIS2 auditors in Europe5 firms

PCI DSS is the mandatory security standard for any organization that stores, processes, or transmits payment card data, assessed by Qualified Security Assessor (QSA) firms via a Report on Compliance (RoC).

• PCI DSS auditors in North America12 firms

SOC 2 is an AICPA attestation report that shows how a company protects customer data. A licensed CPA firm tests your controls and issues an independent opinion.

• SOC 2 auditors in North America24 firms
• SOC 2 auditors in Europe14 firms