IT Audit Firm
Independent IT Audits.
Real Assurance.
Independent audits, assessments, and security testing for SOC, ISO, HITRUST, FedRAMP, CMMC, PCI DSS, and more, from experienced professionals who put independence first.
Accredited & Recognized
Verify our credentials: IAF CertSearch (ISO/IEC 27001 and 27701) · FedRAMP Marketplace · A2LA · GovRAMP program participants · HITRUST External Assessors · PCI SSC QSA directory
Our Services
One Firm. Every Framework.
Sixteen services in four practice areas, delivered by one experienced audit team. See all services.
ISO, Cloud, and Security Testing
ISO 27001 · ISO 42001 · ISO 9001 · ISO 22301 · PCI DSS · CSA STAR · Penetration Testing
ISO 42001, 9001, and 22301: accreditation in process.
Explore ISO, Cloud, and Security Testing servicesOur Process
A Clear Path
to Your Report.
- Phase 1
Scoping & Planning
- Phase 2
Fieldwork & Testing
- Phase 3
Reporting & Delivery
- Phase 4
Ongoing Support
From Our Auditors
Clear Answers on Compliance.
Common Questions
About Linford & Company LLP
What does Linford & Company LLP do?
Linford & Company LLP is an independent IT audit firm. It performs SOC 1 and SOC 2 audits, HIPAA audits, HITRUST assessments, FedRAMP and GovRAMP assessments, CMMC assessments, PCI DSS audits, CSA STAR attestations, and certifications, ISO/IEC 27001 and ISO/IEC 27701 certifications, and penetration testing. Linford & Company LLP is accredited by ANAB to certify against ISO/IEC 27001 and ISO/IEC 27701 (verify on IAF CertSearch). ISO 42001, ISO 9001, and ISO 22301 certification will be offered once the firm is accredited for those standards.
Where is Linford & Company LLP located?
The firm is headquartered at 1550 Wewatta Street, 2nd Floor, Denver, Colorado 80202, and serves clients around the world.
Is Linford & Company LLP an accredited FedRAMP assessor?
Yes. Linford & Company LLP is listed as an assessor on the FedRAMP Marketplace and is accredited by A2LA.
Is Linford & Company LLP backed by private equity?
No. Linford & Company LLP is owned by its partners, with no private equity or outside investors. The partners who own the firm lead your audit. Because no outside investor is planning a sale, your audit team and approach stay consistent year to year.
How do I start an audit with Linford & Company LLP?
Request a consultation through the contact page or call (720) 330-7201. An auditor will discuss your scope, timeline, and the framework that fits your customers' requirements.
Can one firm cover SOC 2, HIPAA, HITRUST, ISO 27001, PCI DSS, FedRAMP, and CMMC?
Yes. Linford & Company LLP is a licensed CPA firm that performs SOC 1 and SOC 2 examinations and HIPAA audits. It is also a HITRUST External Assessor, an A2LA-accredited FedRAMP 3PAO, a GovRAMP assessor, a PCI QSA company, an ANAB-accredited ISO/IEC 27001 and ISO/IEC 27701 certification body, and an authorized CMMC C3PAO. HIPAA, ISO 27001, and other frameworks can be added to the same SOC 2 engagement.
Will an audit disrupt our engineering team?
We keep disruption to a minimum. Interviews are scheduled in advance, requests come in one organized list, and most meetings and walkthroughs are held by video. We come onsite when the engagement calls for it. We communicate throughout the audit instead of sending requests for corrections at the end.
Who works on our audit?
On most engagements, the same partner is involved from the scoping call to the final report. Linford & Company LLP has no salespeople and no offshore staff, and the firm is 100% owned by its partners.
Do we have to use a particular compliance automation platform?
No. Linford & Company LLP has no referral or partner arrangements with software vendors or compliance automation platforms, and we neither pay nor accept referral fees. We audit the environment you have, with the tools you already use, and we never require ours.
How can we verify Linford & Company LLP's credentials?
Linford & Company LLP was founded in Denver in 2008. Its 20 partners trained at EY, PwC, KPMG, Deloitte, the Air Force, and Fortune 500 security teams. The firm is licensed by the Colorado State Board of Accountancy, and its AICPA peer review results are in the public peer review file. Each accreditation can be checked on the issuing body's own directory, linked from our About page.
Will we know the fee before the audit starts?
Yes. After a scoping call with a partner, you get a specific, written quote and a timeline before any work begins. That greatly reduces the risk of fee increases later.