What does Linford & Company LLP do?

Linford & Company LLP is an independent IT audit firm. It performs SOC 1 and SOC 2 audits, HIPAA audits, HITRUST assessments, FedRAMP and GovRAMP assessments, CMMC assessments, PCI DSS audits, CSA STAR attestations, and certifications, ISO/IEC 27001 and ISO/IEC 27701 certifications, and penetration testing. Linford & Company LLP is accredited by ANAB to certify against ISO/IEC 27001 and ISO/IEC 27701 (verify on IAF CertSearch). ISO 42001, ISO 9001, and ISO 22301 certification will be offered once the firm is accredited for those standards.

Where is Linford & Company LLP located?

The firm is headquartered at 1550 Wewatta Street, 2nd Floor, Denver, Colorado 80202, and serves clients around the world.

Is Linford & Company LLP an accredited FedRAMP assessor?

Yes. Linford & Company LLP is listed as an assessor on the FedRAMP Marketplace and is accredited by A2LA.

Is Linford & Company LLP backed by private equity?

No. Linford & Company LLP is owned by its partners, with no private equity or outside investors. The partners who own the firm lead your audit. Because no outside investor is planning a sale, your audit team and approach stay consistent year to year.

How do I start an audit with Linford & Company LLP?

Request a consultation through the contact page or call (720) 330-7201. An auditor will discuss your scope, timeline, and the framework that fits your customers' requirements.

Can one firm cover SOC 2, HIPAA, HITRUST, ISO 27001, PCI DSS, FedRAMP, and CMMC?

Yes. Linford & Company LLP is a licensed CPA firm that performs SOC 1 and SOC 2 examinations and HIPAA audits. It is also a HITRUST External Assessor, an A2LA-accredited FedRAMP 3PAO, a GovRAMP assessor, a PCI QSA company, an ANAB-accredited ISO/IEC 27001 and ISO/IEC 27701 certification body, and an authorized CMMC C3PAO. HIPAA, ISO 27001, and other frameworks can be added to the same SOC 2 engagement.

Will an audit disrupt our engineering team?

We keep disruption to a minimum. Interviews are scheduled in advance, requests come in one organized list, and most meetings and walkthroughs are held by video. We come onsite when the engagement calls for it. We communicate throughout the audit instead of sending requests for corrections at the end.

Who works on our audit?

On most engagements, the same partner is involved from the scoping call to the final report. Linford & Company LLP has no salespeople and no offshore staff, and the firm is 100% owned by its partners.

Do we have to use a particular compliance automation platform?

No. Linford & Company LLP has no referral or partner arrangements with software vendors or compliance automation platforms, and we neither pay nor accept referral fees. We audit the environment you have, with the tools you already use, and we never require ours.

How can we verify Linford & Company LLP's credentials?

Linford & Company LLP was founded in Denver in 2008. Its 20 partners trained at EY, PwC, KPMG, Deloitte, the Air Force, and Fortune 500 security teams. The firm is licensed by the Colorado State Board of Accountancy, and its AICPA peer review results are in the public peer review file. Each accreditation can be checked on the issuing body's own directory, linked from our About page.

Will we know the fee before the audit starts?

Yes. After a scoping call with a partner, you get a specific, written quote and a timeline before any work begins. That greatly reduces the risk of fee increases later.

Home / Blog / Danielle Pei

Insights

Articles by Danielle Pei

5 articles by Danielle Pei, partner. View Danielle’s profile.

Articles

All articles

HIPAA

HIPAA Security Rule Requirements: What’s in Effect, What’s Changing, & What Are Auditors Seeing?

The HIPAA Security Rule faces its biggest proposed update in 20+ years. See what's required now, what's changing, and what auditors are already flagging.

By Danielle PeiJuly 8, 2026
Compliance

Mobile Device Management Guide: Work From Anywhere, Protect From Everywhere

Discover MDM best practices to secure your mobile workforce. Learn how mobile device management protects data, reduces risks, and supports BYOD programs.

By Danielle PeiDecember 17, 2025
SOC 2

Mapping AWS Controls to Your SOC 2 Requirements: What You Need to Know

Learn to effectively map AWS controls to SOC 2 requirements. Understand the shared responsibility model and implement proper documentation for compliance.

By Danielle PeiMay 7, 2025
Compliance

Role-Based Access Control (RBAC): A Key to Streamlined Access Management

Discover how RBAC enhances security and streamlines access management. Learn key components, best practices, and industry examples for effective implementation.

By Danielle PeiOctober 9, 2024
Compliance

Audit Readiness: Professional Tips for a Successful Audit

This guide to audit readiness provides professional insights into how to best prepare for your organization's upcoming audit, and what to avoid.

By Danielle PeiMarch 6, 2024

Get in touch

Have a question an article didn't answer? Talk to a partner.

Get straightforward answers from experienced auditors.

Request a Consultation

Articles by Danielle Pei

Articles

HIPAA Security Rule Requirements: What’s in Effect, What’s Changing, & What Are Auditors Seeing?

Mobile Device Management Guide: Work From Anywhere, Protect From Everywhere

Mapping AWS Controls to Your SOC 2 Requirements: What You Need to Know

Role-Based Access Control (RBAC): A Key to Streamlined Access Management

Audit Readiness: Professional Tips for a Successful Audit

Have a question an article didn't answer? Talk to a partner.

Your privacy