Auditors in Vanta, Drata, Secureframe and Sprinto
The auditor directory in your platform is a partner list. It finds bodies that know the platform. It does not prove accreditation for ISO/IEC 27001.
How each platform lists firms
Audit firms apply and sign a partner agreement. The platform then lists them.
| Platform | How it lists firms |
|---|---|
| Vanta | A partner directory. Vanta says more than 100 audit firms partner with it. |
| Drata | "Pre-vetted" auditors in an alliance directory. |
| Sprinto | An auditor directory with a filter for the accreditation body, for example UKAS or ANAB. It says its ISO auditors are IAF-accredited certification bodies. |
| Secureframe | An audit partner programme, with an application and a partnership agreement. |
Check a listed firm in 4 steps
- Find the legal name of the certification body. It can differ from the brand in the directory.
- Ask for the accreditation body and the accreditation number for ISO/IEC 27001.
- Search the body in the official registry of that accreditation body.
- Ask for a sample certificate. Check the mark, the scope wording and the dates.
Listings mix 2 kinds of firm
SOC 2 reports come from licensed CPA firms; ISO/IEC 27001 certificates from accredited certification bodies. Some listings also sell advisory work. That is fine for SOC 2 readiness, but the body that certifies your ISMS must not also advise on it.
A platform discount is fine. Still compare the 3-year total with 1-2 bodies from outside the directory, and ask if anyone receives a referral fee.
Check a listed firm in its accreditation registry
Pick the accreditation body named on the firm's certificate. You get the official registry and the exact clicks.