ISO 27001 certification bodies & auditors
This works differently from SOC 2. A SOC 2 report is a CPA firm's attestation. An ISO 27001 certificate is issued by a certification body, and buyers usually expect it to be accredited by a national accreditation body such as ANAB (US) or UKAS (UK).
What the sources say
- ISO doesn't certify companies. External certification bodies do. To find an accredited one, contact your country's national accreditation body or use IAF CertSearch. [ISO]
- ANAB accredits ISO/IEC 27001 certification bodies against ISO/IEC 17021-1 and ISO/IEC 27006. [ANAB] Search the ANAB CB directory by selecting ISO/IEC 27001.
Firms in our directory that list ISO 27001
| Firm | Published frameworks | Platforms |
|---|---|---|
| Johanson Group LLP | SOC 1/2/2+/3, ISO 27001/27017/27018/27701, HIPAA, GDPR, NIST CSFsource | Drata (Audit Alliance) |
| Insight Assurance | SOC 1/2/3, ISO 27001/27017/27018/27701/42001, PCI DSS (QSA), HITRUST, CMMC (C3PAO), FedRAMP (3PAO), CSA STAR, HIPAA, GDPR, NISTsource | Drata (Audit Alliance), Vanta |
| Sensiba LLP (with AssuranceLab) | SOC 1/2/3, HIPAA/HITRUST, ISO 27001/27017/27018/27701/42001, NIST CSF/800-171/CMMC/800-53, GDPR/CCPA, CSA STARsource | Drata (Elite Alliance member) |
| A-LIGN | SOC 2, ISO 27001, HITRUST, FedRAMP, PCI and moresource | Drata (Elite Alliance member); Vanta (as reported) |
| Schellman | SOC 1/2/3, ISO 27001/27701/42001, FedRAMP, StateRAMP, CMMC, PCI DSS, HITRUST, HIPAA, TISAX, C5, IRAP, GDPR, CCPA (95+ frameworks)source | Drata (Audit Alliance); Vanta (as reported) |
| Boulay | SOC 2 examinations; ISO 27001 certification (Boulay Certifications, LLC, ANAB-accredited); Microsoft SSPAsource | Drata (Audit Alliance) |
| KirkpatrickPrice | SOC 1, SOC 2, HIPAA, HITRUST, ISO 27001, ISO 42001, NIST, PCI DSS, PCI-SSF, CMMC readiness, pen testingsource | Not verified |
| BARR Advisory | SOC 1/2/3, SOC for Cybersecurity, ISO 27001/27701/27017/27018/42001, HIPAA, HITRUST, FedRAMP, GovRAMP, CMMC, NIST 800-53, PCI DSS, CSA STAR, GDPRsource | Drata (Audit Alliance); Vanta (listed in Vanta partner directory, as reported) |
| Advantage Partners | SOC 2 Type 1 and 2, HIPAA, ISO 27001 audits (site also lists ISO 27701/42001, HITRUST, CMMC services)source | Vanta (as reported; team bios cite Vanta experience) |
| IS Partners, LLC | SOC 1, SOC 2, HITRUST, HIPAA, ISO 27001, ISO 42001, PCI DSS, CMMC, CSA STAR, NIST, DORA, GDPRsource | Drata (Advanced Alliance member) |
| Tempo Audits | ISO 27001, ISO 42001, SOC 2source | Drata (Audit Alliance) |
| MHM Professional Corporation | SOC 1/2/3, ISO 27001, ISO 27701, ISO 42001, privacy auditssource | Drata (Audit Alliance) |
| AARC-360 | SOC 1, SOC 2, SOC 3 and readiness; ISO 27001, ISO 27701, ISO 42001; FISMA, FedRAMP, GovRAMP; HIPAA, HITRUST; PCI DSS; GDPR; CMMC readiness; NIST 800-171, NIST CSF (per firm) | Apptega, Drata, Vanta, Hyperproof, Secureframe (methodology aligned, per firm) |
| Decrypt Compliance | SOC 1/2/3, ISO 27001, ISO 27701, ISO 42001, PCI DSS, HIPAA, HITRUST, GDPRsource | Not verified |
| Modern Assurance | SOC 1/2/3, ISO 27001, ISO 27701, ISO 42001, CMMC, HIPAA, GDPRsource | Not verified |
| Render Compliance | SOC 1, SOC 2, SOC 2+ (ISO 27001, HIPAA, PCI DSS, FedRAMP mapping), Microsoft SSPAsource | Drata, Vanta, TrustCloud, Yak (direct experience, per firm) |
| CertPro | SOC 2, ISO 27001, ISO 42001, HIPAA, CCPA, PIPEDA, ISO 27701/27018source | Not verified |
| Fine Assurance | SOC 1/2/2+/3, ISO 27001 and 42001 internal audit, HIPAA, GDPR, CCPA/CPRAsource | Not verified |
| Auditwerx | SOC 1/2/2+/3, SOC for Cybersecurity, ISAE 3402, CSAE 3416, PCI DSS (QSA), HIPAA, HITRUST, ISO 27001, CMMC (C3PAO)source | Works alongside compliance automation platforms (none named) |
| Geels Norton | SOC 1, SOC 2, ISO 27001/27017/27018 internal auditsource | Not verified |
| Throughline CPA | SOC 2, SOC 1, ISO 27001, ISO 42001, HIPAA, GDPR, Consumer Data Rightsource | Not verified |
| FinAudit CPA | SOC 1/2/3, ISO 27001/27701/42001 internal audit, HIPAA, PCI DSS, GDPR, CCPA/CPRA, CMMC readinesssource | Not verified |
Related: ISO 27001 hub · ISO 27001 cost · SOC 2 vs ISO 27001 · All auditors
Frequently asked questions
Can my SOC 2 CPA firm issue an ISO 27001 certificate?
Only if the firm, or an affiliated entity, operates as a certification body. SOC 2 reports come from licensed CPA firms. ISO 27001 certificates come from certification bodies, and buyers usually expect them to be accredited (for example by ANAB in the US or UKAS in the UK).
How do I verify accreditation?
In the US, search ANAB's certification body directory and select ISO/IEC 27001. ISO also points to the accreditation body in your country and to the IAF CertSearch database.
Do the firms on this page hold accreditation?
We only say so when our data source does. Of the firms listed, our data shows Boulay's certification entity as ANAB-accredited. Check the others in the accreditation body's directory.
Form not loading? Subscribe on beehiiv. Or browse past issues in the archive.
Last verified 2026-10-19.