Johanson Group

Who is Johanson Group LLP?

Johanson Group LLP is a licensed CPA firm and an IAS-accredited ISO 27001 certification body (MSCB-314). Its About page, reviewed 17 August 2026, dates the firm to 2012, lists a Colorado Springs headquarters, and names 50-plus people on the public roster.

The same page lists 6547 North Academy Boulevard #105, says the firm serves clients in the US, Latin America, Europe, and APAC, and assigns a Customer Success Manager to every engagement.

The reason to shortlist Johanson is that combination: CPA-signed SOC reports plus an accredited ISO certificate from the same legal entity. The About page lists 50-plus named staff, including co-founders, an ISO practice (Managing Director Stewart Riley; Quality Director John Miller), a PCI director who is a QSA, an Audit Director, and customer-success staff.

Named clients on Johanson’s own site and partner pages include Bitkub Exchange (SOC 2 Type 2) and Scisco Genetics (SOC 2, published as a six-week engagement). LendAPI announced Johanson as its SOC 2 firm in its own blog. Testimonials on johansonllp.com name WunderGraph, Clozd, and Kaboom AI.

Johanson is enrolled in the AICPA Peer Review Program. The AICPA public file, retrieved 17 August 2026, shows a review dated 30 April 2025 covering 1 August 2023 to 31 July 2024. The rating is not disclosed in that file.

How long does Johanson say a SOC 2 audit takes?

Johanson’s homepage states a 4–8 week audit planning range for SOC 2, ISO 27001, PCI DSS, GDPR, and HIPAA. The footnote says timelines are approximate and depend on readiness, scope, and client responsiveness. The SOC 2 service page is more specific for Type 1.

Deliverable	What Johanson publishes	What that number does not include
SOC 2 Type 1	4–6 weeks on the SOC 2 page	Control design work you still have to finish before kickoff
SOC 2 Type 2	6–12 month observation window in the homepage FAQ, then fieldwork/reporting	The observation period itself
ISO 27001, PCI DSS ROC, HIPAA attestation	4–8 weeks sitewide planning range	Stage-1/Stage-2 sequencing for ISO; acquirer calendars for PCI

Type 2 observation (usually 6–12 months on Johanson’s own FAQ) is a separate clock from the 4–8 week planning range.

What does Johanson’s ISO 27001 accreditation actually cover?

Johanson Group LLP holds IAS certification-body accreditation MSCB-314 for ISO/IEC 27001:2022. The certificate on file, effective 7 April 2026 (accredited since 16 April 2023), attests ISO/IEC 17021-1:2015 compliance for a virtual Colorado Springs operation. It lists:

• Certification standard: ISO/IEC 27001:2022
• Additional level-4 standards: ISO/IEC 27006:2015/AMD 1:2020 and ISO/IEC 27006-1:2024
• Operating model: virtual, from the Colorado Springs address
• IAS contact on the certificate: Thomas Miller

When Johanson issues an ISO/IEC 27001:2022 certificate under that accreditation, it is a certification-body deliverable, not an advisory letter. IAF CertSearch also lists the firm as a certification body under IAS.

The firm now also sells ISO 42001 certification audits (Stage 1 documentation review and Stage 2 implementation audit). The current MSCB-314 scope does not list ISO/IEC 42001. Treat 42001 as a marketed service until an accreditor lists it. Buyers who need an accredited 42001 certificate should ask which accreditation, if any, would sit on that certificate.

ISO/IEC 27017 and 27018 appear as service pages. ISO 27701 and BSI C5 are not in the current public service menu.

What SOC, HIPAA, and PCI work does Johanson perform?

Johanson lists SOC 1, SOC 2, and SOC 3 under SOC & Attestation, plus standalone HIPAA attestation and a QSA-led PCI DSS ROC. Johanson says it maps overlapping evidence across concurrent programs; that does not replace a HIPAA attestation or an ISO certificate.

The SOC 2 page describes Type 1 (point in time) and Type 2 (typically 6–12 months of operating effectiveness) and says the firm regularly runs concurrent SOC 1 + SOC 2, SOC 2 + ISO 27001, and SOC 2 + HIPAA programs.

HIPAA is a standalone attestation service covering Privacy, Security, and Breach Notification, including a Security Risk Analysis and BAA review. There is no HIPAA certification body; this is third-party attestation, so it is not a credential.

PCI DSS is sold as a QSA-led Report on Compliance against PCI DSS v4.0.1, producing a ROC and AOC. Anthony Fulda is listed as Director of PCI with QSA in his credentials. Johanson Group LLP itself, not only an individual, was listed as a QSA company on the PCI SSC QSA list when we checked on 6 October 2026.

GDPR, CCPA, and NIST assessments are in the current menu. Johanson does not list FedRAMP, StateRAMP, CMMC, HITRUST, or FFIEC. Its homepage FAQ mentions CMMC and NIST as frameworks buyers sometimes need; that is not the same as Johanson being a C3PAO or 3PAO.

Which GRC platforms does Johanson work with?

Johanson’s partners directory (17 August 2026) names four compliance-automation partners: Drata, Vanta, Secureframe, and Sprinto. Drata’s auditor directory lists Johanson as a Registered Alliance Member with the Code of Ethics Pledge, English and Spanish, and client sizes from SMB through enterprise.

Rippling, TrustCloud, and Securicy do not appear on the current partners page. The firm says it audits inside the client’s existing GRC tools rather than requiring a proprietary platform.

Who leads Johanson Group?

Ryan Johanson, CPA, and Ramil Cortez are the named co-founding partners on Johanson’s About page as of 17 August 2026. Stewart Riley leads the ISO practice; Anthony Fulda is Director of PCI; John Miller is ISO Quality Director.

Public About-page titles, reviewed 17 August 2026:

• Ryan Johanson, CPA: Partner & Co-Founder
• Ramil Cortez: Partner & Co-Founder
• Stewart Riley: ISO Managing Director
• Anthony Fulda, CISA, CISSP, QSA: Director of PCI (not a named partner on the current roster)
• John Miller: ISO Quality Director (lead auditor credentials listed for 27001 and 42001)
• Keshia Belong: Audit Director
• Ryan McBride: Vice President of Sales
• Tom Miller: CTO, VP Product Development. The IAS certificate names Thomas Miller as the contact; the About page does not spell out whether that is the same person.

Customer-success leadership on the same page includes Mark Andia (Manager, Customer Success). Raahsaan Fox, listed earlier as a CS contact, is not on the current roster.

How much does a Johanson SOC 2 audit cost?

Johanson does not publish a rate card. Our estimates are $10,000–$18,000 for SOC 2 Type 1 and $15,000–$30,000 for Type 2 for typical startup-to-SMB SaaS scope. Those figures are ours, not firm-confirmed, and they do not price ISO certification, HIPAA attestation, or a PCI ROC.

A testimonial on Johanson’s site (Sheryl Briggs, CEO, Classapps) cites affordable pricing as a reason for switching firms. That is a client comment, not a public price list. Request a quote for a scoped number.

Who is Johanson Group a good fit for?

Johanson is a poor fit for FedRAMP, CMMC, HITRUST, or a Big Four name on the report. The same-entity SOC 2 plus accredited ISO 27001 case is the shortlist reason; buyers needing those other credentials should compare broader firms.

Best fit for:

• Teams that want a CPA-issued SOC 2 and an IAS-accredited ISO/IEC 27001:2022 certificate without hiring a second firm
• Companies already on Drata, Vanta, Secureframe, or Sprinto
• Healthtech buyers who need a HIPAA attestation alongside SOC 2
• Payments and fintech teams evaluating a QSA-led PCI DSS ROC from the same relationship (confirm QSA company status in the proposal)
• Buyers who want a named CSM and a published 4–8 week planning range, with Type 2 observation scheduled separately

Not ideal for:

• Enterprise or public-company procurement that requires a Big Four or Top 25 firm name on the report
• FedRAMP, StateRAMP, CMMC, HITRUST, or FFIEC scope
• Buyers who need an accredited ISO 42001 certificate unless Johanson can show a current accreditation that includes 42001
• Anyone treating the 4–8 week planning range as a guaranteed Type 2 calendar, since the observation window still has to run

How current is this Johanson profile?

We checked Johanson’s public site, the IAS MSCB-314 certificate, IAF CertSearch, and the AICPA peer-review public file on 17 August 2026. PCI QSA company status was re-checked on the PCI SSC list on 6 October 2026. Re-check ISO 42001 accreditation before you sign.

• Johanson Group homepage, About, SOC 2, ISO 27001, ISO 42001, HIPAA, PCI DSS, and partners
• IAS MSCB-314 certificate (PDF)
• IAF CertSearch listing
• Drata Audit Alliance directory
• LendAPI announcement
• AICPA Peer Review public file (enrollment and 30 April 2025 review date)