pa.taxFind help
Independent directory

Find a compliance assessment firm.

Browse assessors from official registries, with firms that describe SOC 2 services on their own sites. Compare sourced locations and check each firm’s role. 3PAOs assess; agencies authorize. SOC 2 ends in an attestation report, not a certificate.

645 firms listed · October 2026 snapshot

Search the directory

Search a firm, city, state, or service. Every result has a crawlable profile.

Explore

Browse by assessment

FedRAMP 3PAOs

Recognized third-party assessment organizations in the FedRAMP Marketplace.

Explore 47 firms

SOC 2 service firms

Firms whose own sites confirm SOC 2 examination or readiness services. Confirm which firm issues any attestation report.

Explore 20 firms

FedRAMP + SOC 2

Firms appearing in the FedRAMP extract with a separately confirmed SOC 2 practice.

Explore 14 firms

GovRAMP 3PAOs

A2LA-accredited third-party assessment organizations participating in GovRAMP, which verifies cloud providers for state and local government.

Explore 32 firms

PCI QSA companies

Qualified Security Assessor companies listed by the PCI Security Standards Council to assess merchants and service providers against PCI DSS.

Explore 414 firms

PCI Approved Scanning Vendors

Approved Scanning Vendors listed by the PCI Security Standards Council to run external vulnerability scans required by PCI DSS.

Explore 81 firms

CMMC C3PAOs

Certified Third-Party Assessment Organizations (C3PAOs) listed in the Cyber AB CMMC Marketplace, which assess defense contractors for CMMC certification.

Explore 117 firms

HITRUST external assessors

Authorized External Assessor firms listed by HITRUST to perform validated assessments for HITRUST certification.

Explore 102 firms

ISO/IEC 27001 certification bodies (ANAB)

Certification bodies currently accredited by ANAB under ISO/IEC 17021-1 to certify information security management systems to ISO/IEC 27001.

Explore 50 firms

Browse by state

Locations come from registry records and firm sites. Listings without a sourced office are not assigned a state.

Alabama4Arizona3California10Colorado6District of Columbia2Florida12Georgia11Hawaii1Idaho1Illinois5Iowa1Kansas2Maine1Maryland21Massachusetts5Michigan4Minnesota2Missouri1New Hampshire1New Jersey2New Mexico1New York3North Carolina4Ohio7Oklahoma2Oregon1Pennsylvania5Rhode Island1South Carolina1Tennessee6Texas8Virginia41Washington2Wisconsin1

Frequently asked questions

What is a recognized 3PAO?

A third-party assessment organization recognized by FedRAMP to assess cloud services for the federal authorization process. The federal agency makes the authorization decision, not the 3PAO. Check the FedRAMP Marketplace for current recognition.

Is there an official SOC 2 auditor registry?

No. SOC 2 practice labels here require a supporting page on the firm's own website; they are not a government accreditation. An independent licensed CPA firm issues a SOC 2 attestation report, not a certificate.

SOC 2 practice confirmed from each firm's own site; no official SOC 2 auditor registry exists. Firms are listed from official registries, each with its own as-of date. Locations are shown only where the registry or the firm's own site provides them. A listing records registry status, not an endorsement, and directory information may change. SOC 2 is a CPA attestation report, not a certificate. pa.tax is independent: listed firms pay nothing for inclusion, ranking or referrals, and firms are listed alphabetically.