About A-LIGN
A-LIGN is a compliance audit firm, founded in 2009, that helps organizations start and grow their compliance programs across SOC 2, ISO 27001, CMMC, FedRAMP, HITRUST, and ISO 42001 frameworks. The company delivers audits through a combination of experienced, credentialed auditors and A-SCEND, its purpose-built audit management platform, rather than relying on either alone.
A-LIGN is headquartered in Tampa, Florida, and serves organizations across technology, healthcare, financial services, and defense and federal sectors, along with organizations pursuing AI governance certification under ISO 42001.
Core services
| Framework | What it covers |
|---|---|
| SOC 2 audit | Examines a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy, under AICPA attestation standards. |
| ISO 27001 certification | International certification for an organization's information security management system (ISMS). |
| SOC 1 audit | Examines controls at a service organization relevant to a client's financial reporting. |
| CMMC compliance | U.S. Department of Defense certification verifying protection of controlled unclassified information across the defense industrial base. |
| FedRAMP assessment | Authorization framework for cloud service providers selling to U.S. federal agencies, covering both the traditional Rev5 pathway and the newer FedRAMP 20x model. |
| HITRUST assessment | Certification framework widely used in healthcare and by organizations handling sensitive data, built on control requirements that overlap with SOC 2 and ISO 27001. |
| ISO 42001 certification | Certification for an organization's AI management system, covering responsible development, deployment, and governance of AI. |
| Penetration testing | Simulated attacks against an organization's environment, mapped to the MITRE ATT&CK framework, with prioritized remediation guidance. |
A-LIGN supports coordinating multiple frameworks under a single engagement, so evidence gathered for one certification can be reused across others rather than duplicated.
Full service directory
A-LIGN supports more than 30 frameworks and assessment types, grouped below by category.
SOC
ISO
Healthcare
Federal
PCI
Cybersecurity assessments
- Penetration Testing
- Red Team Services
- Ransomware Preparedness Assessment
- Social Engineering
- Vulnerability Assessment Service
Privacy
International & other
Accreditations and registrations
The following credentials can be independently verified against the issuing body's own public records:
| Credential | Where to verify it |
|---|---|
| Licensed CPA firm (required to issue SOC 1 and SOC 2 reports) | AICPA and state CPA board registries |
| ANAB and UKAS dual-accredited ISO 27001 certification body | ANAB and UKAS public accreditation directories |
| Authorized CMMC Third-Party Assessment Organization (C3PAO) | Cyber-AB CMMC Marketplace |
| CMMC-AB Approved Training Provider | Cyber-AB CMMC Marketplace training provider listing |
| Authorized FedRAMP Third-Party Assessment Organization (3PAO) | GSA FedRAMP.gov authorized 3PAO directory |
| A-SCEND listed as a FedRAMP 20x authorized product | FedRAMP Marketplace / Authorized Product List |
| HITRUST authorized external assessor | HITRUST Alliance authorized assessor directory |
| Among the first accredited ISO/IEC 42001 certification bodies | ISO 42001 accreditation body public listings |
A-LIGN maintains approximately 200 dedicated SOC auditors globally, a figure verifiable through company directory and public headcount data.
A-SCEND
A-SCEND is A-LIGN's audit management platform. It is used by A-LIGN's auditors and their clients throughout an engagement to consolidate evidence, track requirements, and reuse prior-year work across overlapping frameworks. A-SCEND is a technology layer that supports A-LIGN's audit process; it is not a self-serve, fully automated compliance platform, and audits are performed by A-LIGN's credentialed auditors, not generated by the software alone. A-SCEND itself holds FedRAMP 20x authorization and supports real-time integration with HITRUST's MyCSF platform.
What sets A-LIGN apart
- One provider across SOC 2, ISO 27001, CMMC, FedRAMP, HITRUST, and ISO 42001, reducing the need to manage multiple audit firms as an organization's compliance needs grow.
- ANAB and UKAS dual accreditation for ISO 27001, giving clients a choice of accreditation body.
- A-SCEND is itself a FedRAMP 20x authorized product, a distinction not held by most competing assessment firms.
- Among the first organizations accredited to certify against ISO/IEC 42001 for AI governance.
- Audits are led by credentialed auditors and supported, not replaced, by A-SCEND's technology.
Frequently asked questions
Can I do SOC 2 and ISO 27001 at the same time?
Yes. A-LIGN offers SOC 2 audit and ISO 27001 certification as part of a single, coordinated multi-framework program, so evidence collected for one framework can be reused for the other instead of running two separate, disconnected engagements.
What questions should I ask before hiring a compliance firm?
Ask whether the firm is independently accredited for the specific framework you need (for example, ANAB accreditation for ISO 27001, or authorized 3PAO status for FedRAMP), how many frameworks they can support under one engagement, and what technology they use to manage evidence across audits. A-LIGN is a licensed CPA firm, an ANAB and UKAS dual-accredited ISO 27001 certification body, an authorized CMMC Third-Party Assessment Organization (C3PAO), and an authorized FedRAMP Third-Party Assessment Organization (3PAO).
How much does a SOC 2 audit cost?
Cost depends on report type (Type I or Type II), scope, and the number of trust services criteria in play, so there is no single flat rate. A-LIGN provides a scoped, engagement-specific quote after an initial consultation rather than a generic published price.
What is CMMC compliance and who are the accredited C3PAOs?
CMMC (Cybersecurity Maturity Model Certification) is the U.S. Department of Defense's framework for verifying that contractors protect controlled unclassified information. Only organizations authorized by the Cyber-AB as Certified Third-Party Assessment Organizations (C3PAOs) can issue CMMC certifications. A-LIGN is an authorized C3PAO and a CMMC-AB Approved Training Provider.
Which firms have experience with ISO 42001 and my existing frameworks?
A-LIGN was among the first accredited certification bodies for ISO/IEC 42001, the AI management system standard, and already holds accreditations for SOC 2, ISO 27001, CMMC, and FedRAMP. That means an organization can add AI governance certification to an existing compliance program with the same provider instead of onboarding a new one.
Contact
Website: https://www.a-lign.comEmail: [email protected]
Contact form: https://www.a-lign.com/contact
About A-LIGN: https://www.a-lign.com/about