Firms that do NIST CSF 2.0 and HITRUST work
Every firm below is a real, operating practice with a verified website. Firms described as HITRUST-authorized assessors appear on HITRUST’s published external assessor list (checked September 2026). Firms we could not confirm there are labeled as such — verify directly before engaging one for a validated assessment. Sponsorship never affects ranking; see our methodology.
All firms
A-LIGN
A-LIGN is a compliance and audit firm working across SOC 2, ISO 27001, PCI DSS, and healthcare frameworks. It appears on HITRUST's published external assessor list and performs HITRUST assessments alongside multi-framework audit programs.
Coalfire
Coalfire is a cybersecurity advisory and assessment firm with practices spanning HITRUST, FedRAMP, and enterprise frameworks. It appears on HITRUST's published external assessor list and advises on NIST CSF 2.0 programs for mid-market and enterprise clients.
Schellman
Schellman is an independent assessment firm known for audit work across SOC, ISO, FedRAMP, and HITRUST. It appears on HITRUST's published external assessor list. The firm is assessment-only by posture — it does not sell the remediation it would later assess.
KirkpatrickPrice
KirkpatrickPrice is an audit and assessment firm focused on SOC 2, ISO 27001, and HITRUST. It appears on HITRUST's published external assessor list and works with SaaS and healthcare companies on recurring audit programs.
360 Advanced
360 Advanced is a compliance and audit firm working across SOC 2, ISO 27001, and HITRUST. It appears on HITRUST's published external assessor list and serves healthcare and SaaS clients on assessment programs.
Sensiba
Sensiba is an accounting and advisory firm whose cybersecurity practice covers SOC 2, ISO 27001, and HITRUST. It appears on HITRUST's published external assessor list and works with growth-stage companies on combined audit programs.
BARR Advisory
BARR Advisory is a cybersecurity compliance firm focused on SOC 2, ISO 27001, and HITRUST engagements for cloud and SaaS companies. It appears on HITRUST's published external assessor list.
Lazarus Alliance
Lazarus Alliance is a cybersecurity compliance firm serving healthcare and enterprise clients on HITRUST readiness, SOC 2, and multi-framework programs. Note: we could not confirm this firm on HITRUST's published external assessor list as of September 2026 — verify assessor status directly if you need a validated (r2) assessment.
Comparing firms? Tell us your scope once — get quotes from your shortlist. Free · 2 minutes · no obligation.
Get matched quotesCompass IT Compliance
Compass IT Compliance is an IT audit and compliance firm working across SOC 2, ISO 27001, PCI DSS, and NIST CSF implementations. Note: we could not confirm this firm on HITRUST's published external assessor list as of September 2026 — verify assessor status directly if you need a validated assessment.
Eide Bailly
Eide Bailly is a national accounting and advisory firm whose technology consulting practice covers cybersecurity assessments including HITRUST. It appears on HITRUST's published external assessor list (as Eide Bailly LLP).
LBMC
LBMC's Security & Risk Services practice provides cybersecurity assessment and advisory services including HITRUST. It appears on HITRUST's published external assessor list (as LBMC Security & Risk Services) and is also listed as a HITRUST authorized reseller.
Optiv
Optiv is a cybersecurity advisory firm covering strategy, architecture, and managed security. It appears on HITRUST's published external assessor list and advises enterprises on NIST CSF 2.0 program design and implementation.
Kroll
Kroll is a global risk advisory firm whose cyber practice covers incident response, risk assessments, and security program consulting. Note: we could not confirm this firm on HITRUST's published external assessor list as of September 2026 — it is positioned here for NIST CSF program work, not validated HITRUST assessments.
Healthcare & HITRUST
HITRUST-authorized assessors and healthcare-focused firms for HIPAA-adjacent assurance programs.
| Firm | Type | Planning range | Typical timeline |
|---|---|---|---|
| A-LIGN | Cybersecurity compliance and audit firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Coalfire | Cybersecurity advisory and assessment firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Schellman | Independent cybersecurity assessment firm | Not published — request a scoped quote | Varies — confirm in proposal |
| KirkpatrickPrice | Cybersecurity audit and assessment firm | Not published — request a scoped quote | Varies — confirm in proposal |
| 360 Advanced | Cybersecurity compliance and audit firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Sensiba | Accounting and advisory firm with a cybersecurity practice | Not published — request a scoped quote | Varies — confirm in proposal |
| Lazarus Alliance | Cybersecurity compliance and audit firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Eide Bailly | Accounting and business advisory firm with a cybersecurity practice | Not published — request a scoped quote | Varies — confirm in proposal |
| LBMC | Professional services firm (LBMC Security & Risk Services) | Not published — request a scoped quote | Varies — confirm in proposal |
Planning ranges are not quotes. See our methodology for how prices are labeled and verified.
Growth-stage companies
Firms that work with startups and mid-market teams on their first CSF program or HITRUST assessment.
| Firm | Type | Planning range | Typical timeline |
|---|---|---|---|
| A-LIGN | Cybersecurity compliance and audit firm | Not published — request a scoped quote | Varies — confirm in proposal |
| KirkpatrickPrice | Cybersecurity audit and assessment firm | Not published — request a scoped quote | Varies — confirm in proposal |
| 360 Advanced | Cybersecurity compliance and audit firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Sensiba | Accounting and advisory firm with a cybersecurity practice | Not published — request a scoped quote | Varies — confirm in proposal |
| BARR Advisory | Cybersecurity compliance and advisory firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Lazarus Alliance | Cybersecurity compliance and audit firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Compass IT Compliance | IT compliance and audit firm | Not published — request a scoped quote | Varies — confirm in proposal |
Planning ranges are not quotes. See our methodology for how prices are labeled and verified.
Enterprise programs
CSF 2.0 program consulting and large-scope assessments for complex organizations.
| Firm | Type | Planning range | Typical timeline |
|---|---|---|---|
| A-LIGN | Cybersecurity compliance and audit firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Coalfire | Cybersecurity advisory and assessment firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Schellman | Independent cybersecurity assessment firm | Not published — request a scoped quote | Varies — confirm in proposal |
| BARR Advisory | Cybersecurity compliance and advisory firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Compass IT Compliance | IT compliance and audit firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Eide Bailly | Accounting and business advisory firm with a cybersecurity practice | Not published — request a scoped quote | Varies — confirm in proposal |
| LBMC | Professional services firm (LBMC Security & Risk Services) | Not published — request a scoped quote | Varies — confirm in proposal |
| Optiv | Cybersecurity advisory and solutions firm | Not published — request a scoped quote | Varies — confirm in proposal |
| Kroll | Global risk and cybersecurity consulting firm | Not published — request a scoped quote | Varies — confirm in proposal |
Planning ranges are not quotes. See our methodology for how prices are labeled and verified.
Get matched quotes
One brief reaches the firms above — scoped quotes, free, no obligation.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.