Government SOC 2 Auditors: FedRAMP

Thomas Howell Ferguson (THF) is a CPA firm offering SOC examination and IT audit services, with deep expertise in government and nonprofit compliance.

UHY LLP is a national CPA firm and a member of UHY International providing SOC examination, IT risk advisory, and compliance audit services.

MNP LLP is Canada's third-largest accounting and business advisory firm, with over 8,000 employees across 150+ offices. The firm provides SOC 1 and SOC 2 attestation services alongside internal audit, enterprise risk management, and cybersecurity advisory capabilities.

BerryDunn is the largest assurance, tax, and consulting firm headquartered in New England with nearly 1,000 employees across 7 states and Puerto Rico. Their attest services are provided by BDMP Assurance, LLP, a licensed CPA firm. They have successfully guided MSPs and technology firms through SOC 2 examinations to meet enterprise vendor requirements.

Mauldin & Jenkins is a regional CPA and advisory firm offering SOC examinations, IT audit, and cybersecurity compliance services across the Southeast.

HI-TEX Solutions is a White Glove IT Managed Services Provider and AWS Consulting Partner founded in 1999, offering compliance assessments across SOC 2, HIPAA, HITRUST, PCI, NIST, and FedRAMP frameworks for healthcare, financial, legal, and government sectors.

BARR Advisory is a cloud-based cybersecurity and compliance firm specializing in SOC 2, ISO 27001, and FedRAMP for fast-growing SaaS and cloud-based organizations, with a net promoter score of 89.

Sikich is one of the largest US CPA firms with 2,000+ professionals across North America, EMEA, and APAC. Sikich CPA LLC, the licensed attest entity, provides SOC 2 audit services, while the broader firm offers cybersecurity, ERP/CRM, managed IT, and advisory services.

Sidekick Security is an AI-native cybersecurity consulting firm led by former CMS CISO Robert Wood, offering program transformation, offensive security, and compliance support with a data-driven delivery model that prioritizes measurable outcomes.

Eide Bailly LLP is a Top 25 national CPA firm with 3,500 employees across 50+ offices in 17 states, having surpassed $750M in revenue in 2025. They offer SOC audits through their Risk Advisory Services practice, with industry expertise spanning healthcare, banking, and government sectors.

CBIZ is a leading provider of financial, insurance, and advisory services including SOC reporting and IT audit through its MHM subsidiary partnership.

Deloitte is one of the Big Four accounting firms with a massive security and risk management practice, serving as a go-to for complex, global SOC 2 audits for the largest enterprises.

Plante Moran is one of the nation's largest CPA and business advisory firms with nearly 4,000 staff. Their cybersecurity practice has over 30 years of SOC consulting experience and is actively involved with the AICPA SOC committees, providing advanced visibility into upcoming SOC reporting standards.

HHM CPAs is a regional accounting firm providing SOC reporting, audit, tax, and advisory services in Tennessee and the Southeast.

SecurePath Solutions specializes in guiding businesses through complex compliance frameworks including SOC 2, PCI, HITRUST, and FedRAMP, with a team of certified security and compliance professionals.

McKonly & Asbury is a Central Pennsylvania CPA firm providing SOC 1, SOC 2, SOC 3, and SOC for Cybersecurity reporting, along with IT audit, penetration testing, and vCISO support for regulated industries.

Alexander Thompson Arnold (ATA) is a regional CPA and advisory firm offering SOC examination, IT audit, and risk advisory services across the Mid-South.

OCD Tech is an IT audit and cybersecurity consulting firm providing SOC 2 readiness assessments, SOC 2 certification services, penetration testing, and vCISO support for regulated industries in the Northeast US.

James Moore & Co is one of Florida's largest independent CPA firms, offering SOC 2 examinations alongside IT audit and risk advisory services with deep expertise in government, higher education, and healthcare compliance.

PBMares is a CPA firm and approved Qualified Security Assessor (QSA) providing SOC 1, SOC 2, and SOC 3 examinations. Their SOC team combines licensed CPAs with cybersecurity professionals for dual compliance and technical expertise.

GRF CPAs & Advisors is a Washington DC-area CPA firm with 45 years of experience serving 1,600+ nonprofit and government clients. They provide end-to-end SOC 2 Type I and Type II audit services including readiness advisory and GAP assessments. Recognized by Accounting Today as a 2025 Regional Leader and Firm to Watch.

Postlethwaite & Netterville is a regional CPA firm in the Gulf South providing SOC 1 and SOC 2 examinations, IT risk advisory, and internal audit services for government, healthcare, and financial services organizations.

Cherry Bekaert is a national CPA and advisory firm with 3,000+ professionals and 75+ years of experience. They offer SOC 1, SOC 2, SOC 2+, SOC 3, and SOC for Cybersecurity, and are an authorized CMMC C3PAO. Their Risk & Cybersecurity team has 30+ years of SOC and information assurance experience across all industries.

Aronson is a Washington D.C.-area CPA and advisory firm offering SOC 2 examinations, IT audit, and risk advisory services with deep expertise in government contracting and technology organizations.

Compass IT Compliance provides SOC examination, IT audit, and cybersecurity compliance services to organizations across the United States.

TestPros has provided SOC 2 readiness assessments since 1998. Serving both government and commercial clients, they offer gap analysis, control implementation, and audit preparation services with deep expertise in federal compliance requirements.

Schellman is a leading compliance assessment firm focused exclusively on attestation and cybersecurity services, including SOC 2, ISO 27001, HITRUST, FedRAMP, and PCI DSS.

Hyper Vigilance is a cybersecurity and compliance advisory firm offering SOC 2 readiness, FedRAMP consulting, and cloud security services for technology and government contracting organizations.

Councilor, Buchanan & Mitchell (CBM) is a full-service CPA firm serving the Washington, DC metropolitan area since 1921. The firm provides SOC 1 and SOC 2 audit services across the Mid-Atlantic region, helping organizations demonstrate the effectiveness of their internal controls and data security practices.

Weaver is a Top-35 US CPA firm headquartered in Texas offering SOC 1 and SOC 2 Type I and Type II examinations. Their IT advisory team is led by professionals including Neha Patel (CISA, CDPSE), a former AICPA national SOC School trainer named to Forbes' 2025 Best-in-State CPAs.

CLA (CliftonLarsonAllen) is one of the largest US CPA and business advisory firms with 8,500+ professionals across nearly 130 US locations. They provide SOC 2 audit services with industry-focused expertise spanning technology, government, healthcare, and nonprofit sectors. CLA Global was co-founded in 2022.

Carr, Riggs & Ingram is a Top 25 U.S. CPA and advisory firm providing SOC 2 examinations, IT audit, cybersecurity assessments, and risk advisory through its national practice. Parent firm of the Auditwerx SOC practice.

Ferro Technics is a Canadian IT consulting and auditing firm certified by accrediting institutes for SOC 2 Type I and II, ISO 27001, HIPAA, and PCI DSS audit services. The firm provides compliance auditing, cybersecurity consulting, and training services to organizations across Canada and the United States.

HoganTaylor is one of the largest business advisory and CPA firms in Oklahoma and Arkansas with 350+ personnel. Their Risk Assurance team specializes in SOC reports, HITRUST validated assessments, and CMMC certification for small to medium-sized companies across the US, delivering highly customized SOC audits.

Lazarus Alliance is a licensed CPA firm and cybersecurity audit specialist providing SOC 1, SOC 2, and SOC 3 examinations, along with FedRAMP, CMMC, and HIPAA compliance services.

YHB (Yount, Hyde & Barbour) is a Virginia-based CPA and consulting firm established in 1947 with SOC audit and IT audit services. Their Risk Advisory Services team includes CITPs and CISAs who focus on AICPA Trust Services Categories and ISACA COBIT frameworks, providing vulnerability assessments, penetration testing, and SOC auditing.

Coalfire is a leading cybersecurity advisory firm founded in 2001, completing 3,000+ assessments annually through Coalfire Controls, its fully licensed CPA affiliate. With 20+ years of SOC assessment experience and offices in the US and UK, Coalfire partners with Vanta to deliver AI-powered compliance acceleration.