Coalfire

Who is Coalfire?

Coalfire is a cybersecurity advisory and assessment firm founded in 2001, with headquarters at 330 N Wabash Ave in Chicago. Current offices also listed: Alpharetta, GA; Bellevue, WA; Manchester, UK; and Buenos Aires, Argentina, a delivery office announced on 13 October 2026. Westminster, Colorado is the former HQ from the Carlyle/Chertoff era; it is no longer on the public contact page.

Coalfire’s own About page says 1,000+ expert team members. Delivery figures Coalfire publishes: 3,000 assessments a year, 500+ SOC reports a year, and 600+ framework specialists / 1 million+ assessment hours behind Compliance Essentials.

Funds advised by Apax Partners acquired Coalfire from Carlyle and The Chertoff Group; the sale closed in April 2020. Coalfire’s April 2020 announcements tie the status of Coalfire Federal as a structurally separate, wholly owned subsidiary with its own US leadership and board to U.S. foreign-investment rules after the UK-based Apax purchase.

Three legal names matter on a contract:

• Coalfire Controls: licensed CPA affiliate that issues SOC 1 / SOC 2 / SOC 3 reports under AICPA standards. Coalfire says it participates in the AICPA peer-review program.
• Coalfire Certification Inc (coalfirecertification.com): ANAB-accredited certification body. Rebranded from Coalfire ISO in December 2021. Current public scope: ISO/IEC 27001, ISO 9001, ISO/IEC 27701, ISO/IEC 42001, ISO 22301, ISO/IEC 20000-1. Dual UKAS accreditation was obtained in 2019–2021; the current CB site lists ANAB only.
• Coalfire Federal (coalfirefederal.com): separately governed federal/CMMC entity.

What does Coalfire’s FedRAMP marketplace record actually show?

Coalfire Systems, Inc. is FedRAMP Marketplace assessor 138514: accredited 17 July 2015, High (Class D), with 128 assessments as of 16 October 2026.

Schellman’s profile tracks a larger marketplace count.

Coalfire says on its SOC page that 75% of its SOC engagements are for cloud service providers, and it names Google, Amazon, IBM, and Microsoft as CSP examples.

FedRAMP work at Coalfire includes readiness (RAR), initial assessment (SAP/SAR), annual assessment, continuous monitoring, and FedRAMP-required penetration testing / red teaming. The current FedRAMP advisory page says a standard authorization can take anywhere from six to 18 months. ACE here is Accelerated Cloud Engineering (pre-engineered FedRAMP-ready modules, marketed since 2020), not “Accelerated Compliance Experience.” A Gartner Peer Insights federal reviewer credited ACE with beating a typical two-year ATO path; that is one review, not a rating.

DoD work is sold as DoD RMF and, in advisory bios, the DoD Cloud Computing SRG. That is not the same thing as IL6 or classified-facility work.

What is Coalfire Federal, and who does the CMMC work?

Coalfire Federal has operated as a separately governed subsidiary of the commercial parent since the Apax close in April 2020, under U.S. foreign-investment rules. Bill Malone was promoted from EVP to President on 29 April 2020, when the subsidiary got its own board (first chair: Mary Griggs).

CMMC timeline, as the firm states it:

• 23 August 2022: among the first Cyber AB-authorized C3PAOs (CMMC 1.0-era authorization).
• 3 January 2025: began conducting official CMMC Level 2 assessments as an authorized C3PAO under the live program.
• 16–18 July 2025: triennial DIBCAC CMMC Level 2 re-certification, announced as a perfect score. DIBCAC is the body that re-assesses C3PAOs.

On 4 August 2025, Dr. Amy Williams, then VP of CMMC, was appointed Vice Chair of the Cyber AB C3PAO Advisory Council Accreditation Committee (two-year term). That appointment is not confirmation of her current operating title.

Coalfire Federal also assessed AWS’s Controlled Working Environment to CMMC Level 2 (announced June 2025). Its CMMC pages emphasize in-house assessors and say Level 2 assessments do not bundle remediation products; the same site still sells mock assessments and readiness. Ask which entity and which statement of work you are signing.

Which frameworks can Coalfire combine on one program?

Coalfire Controls issues SOC 1, SOC 2, SOC 3, SOC for Cybersecurity, and SOC for Supply Chain; related pages also list CSA STAR, BSI C5, Microsoft SSPA, and combined examples such as SOC + HIPAA and SOC + CSA STAR. PCI, HITRUST, and ISO sit in other legal entities, so the contract name matters.

PCI: Coalfire’s current services page positions Coalfire as a large QSAC with QSA and PFI capacity, and as a founding member of the PCI Global Executive Assessor Roundtable. Older 2021 accreditation sheets also listed PA-QSA, P2PE, and Secure Software/SLC; the current PCI page describes P2PE and Secure Software Framework services and does not name PA-QSA.

HITRUST: Coalfire calls itself an original HITRUST External Assessment firm, with 35+ certified CSF practitioners. Services include e1 / i1 / r2, interim, rapid recertification, and bridge assessments, plus coordinated HITRUST + other-framework reporting.

ISO (Coalfire Certification): ANAB CB for the standards listed above, including ISO/IEC 42001. Coalfire also sells ISO 42001 readiness and pairs certification with model testing under AIMS+. Augment Code is a named ISO 42001 client.

Federal-adjacent (commercial Coalfire): FISMA, NIST SP 800-53, NIST SP 800-171, ITAR/EAR, DEA EPCS.

If Coalfire does both advisory and the SOC examination, its own FAQ says independence still has to be maintained. Raise that on the first call.

What is Compliance Essentials, and does Coalfire use Audit AI?

Compliance Essentials is Coalfire’s current assessment product, not a GRC overlay it merely connects to. As of 5 May 2026 it includes Audit AI: MCP and open APIs so a client’s existing assistant can query live program data, plus AI policy/procedure review with page-level citations.

Coalfire’s launch claims: up to 40% less manual process work on the prior platform, up to 200% faster policy review in testing, and 70% greater accuracy than off-the-shelf chatbots for those reviews. Those are vendor test figures.

MCP sources named at launch: Jira, GitHub, Microsoft 365, and “hundreds” of other MCP-compatible systems. Audit AI policy review and the MCP server are included with a Coalfire assessment on Compliance Essentials.

The practical pattern, from Coalfire case studies: map PCI (or another framework) once, reuse evidence for SOC 2. Effectual went PCI ROC (2020) then SOC 2 Type 2 in six months (2022) on that mapping. BigCommerce used the same platform to stack PCI DSS, then ISO 27001, SOC 1/2/3, and ISO 27017/27018. AnewHealth reported cutting assessment duration by four weeks via the Continuous Compliance module.

CoalfireOne still appears on coordinated-assessment materials as the visibility portal. The 2026 product story is Compliance Essentials.

Homepage copy currently says coordinated assessments across 85+ frameworks; Compliance Essentials and Audit AI pages say 100+. The platform pages are the better figure for mapping.

Who leads Coalfire?

Brad Little became CEO on 6 January 2026, succeeding Tom McAndrew, who was announced as moving to a board and senior advisory role. Little’s last role was Global Head of Professional Services at Google Cloud, after more than two decades at Capgemini.

Immediate prior Capgemini titles include EVP and global head of application services and head of Capgemini’s global SAP business. Career start: Ernst & Young. Tom McAndrew had been CEO for the prior 20 years.

Also on the current leadership page: Bill Malone (President, Coalfire Federal); Merri Chandler, CPA (CFO; KPMG, later Chartis Group); Vineet Seth (Chief Product & Technology Officer: BitSight VP of Product, SAP, RSA); Karen Laughton (EVP, Advisory Services); Adam Shnider (EVP, Assessment Services). Charles Henderson (EVP, DivisionHex) runs the offensive-security brand used for FedRAMP pentest and AI red-teaming.

How much does a Coalfire SOC 2 audit cost, and how long does it take?

Coalfire does not publish SOC prices. Our figures are estimates: Type 1 about $25k–$60k, Type 2 about $40k–$120k.

Coalfire’s SOC FAQ: a Type 2 covers operating effectiveness typically at least six months. That is Coalfire’s usual window, not an AICPA-mandated floor. End-to-end advisory + readiness + examination is often 6–9 months. Fieldwork-to-report, once evidence is in, is the shorter 4–12 week band we estimate. Clients already in PCI or HITRUST can cut calendar time by reusing mapped evidence. That is the Effectual example, not a guarantee.

Positioning is premium: this is a Schellman / large-advisory comparable, not a first-SOC boutique.

Who is Coalfire a good fit for?

Coalfire is a poor fit for a first SOC 2 on a startup budget, or for anyone who wants the commercial parent and Coalfire Federal on one SOW. The shortlist case is FedRAMP High, CMMC, or stacked PCI/HITRUST/ISO; resolve the entity split during contracting.

Best fit

• CSPs that need a 3PAO with a large High-capable book (128 marketplace assessments as of October 2026) and will ask for named assessor experience at their baseline.
• DoD contractors wanting CMMC Level 2 from Coalfire Federal, with a clear split between mock/readiness and the official assessment.
• Mid-market and enterprise programs stacking SOC 2 with PCI, HITRUST, and/or ISO, where one evidence library is the point of the engagement.
• Healthcare SaaS that wants HITRUST plus a SOC 2 + HIPAA overlay from the same family of firms.
• Buyers who already expect a specialist cyber brand in procurement, not a Top 50 CPA logo.

Poor fit

• First SOC 2 on a startup budget. Estimated Type 2 sits well above boutique specialists.
• Buyers who want Schellman’s CPA-firm / classified-adjacent story (Top 50 ranking, FCL, 211 Total Assessments on the FedRAMP Marketplace, checked 7 October 2026) or A-LIGN’s SOC volume and A-SCEND platform.
• Anyone who needs the commercial parent and Coalfire Federal on one SOW without reading how the two entities are separated.
• Teams that only want a portal overlay on Drata/Vanta/Secureframe. Coalfire has announced partnerships with Vanta (4 November 2025) and Drata (9 March 2026) and no Secureframe partnership is documented, but the native path is Compliance Essentials.

What changed recently at Coalfire?

Between January 2025 and May 2026 Coalfire Federal began official CMMC Level 2 assessments, the commercial firm appointed Brad Little CEO, and Compliance Essentials launched Audit AI.

• 5 May 2026: Audit AI launched inside Compliance Essentials (MCP + policy review).
• 6 January 2026: Brad Little appointed CEO; Tom McAndrew to board/advisor.
• 4 August 2025: Dr. Amy Williams (then VP of CMMC) named Vice Chair, Cyber AB C3PAO Advisory Council Accreditation Committee.
• 16–18 July 2025: Coalfire Federal DIBCAC CMMC Level 2 re-certification, perfect score announced.
• 18 June 2025: announced ISO/IEC 42001 ANAB accreditation / AIMS+ (model testing + certification).
• 3 January 2025: Coalfire Federal began official CMMC Level 2 assessments.

When should a buyer shortlist Coalfire?

Coalfire is a specialist cyber assessor with a real FedRAMP marketplace book (128, High, as of October 2026), a CPA affiliate for SOC, an ANAB ISO certification body, and a separately governed CMMC C3PAO. The operational advantage, when it exists, is Compliance Essentials mapping PCI, HITRUST, or ISO evidence into SOC 2.

If the question is FedRAMP High or CMMC Level 2 plus SOC 2 from one family of firms, Coalfire belongs on the short list. If the question is cheapest first Type 2, look elsewhere.