# Coalfire Certification, Inc. - **Type:** Certification body - **Website:** https://www.coalfirecertification.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US certification body accredited by ANAB for ISO 27001, 27701 and 42001, among others, that describes itself as the certification arm of consultancy Coalfire Systems. ## Coalfire Certification scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 4/5 Published, procedural complaints and appeals processes with defined staff separation from the affected audit team, plus a public certificate directory that visibly discloses a real suspended certificate (Aera Technology) rather than only showing active clients; docked one point because neither page commits to a response timeframe or SLA (coalfirecertification.com/complaints.html, /appeals.html, /client-directory.html, checked 2026-09-20). ### Qualifications of the people who do the work: 5/5 ANAB's own public CB Directory independently confirms Coalfire Certification (ref. Coalfire-MS-4539) is currently 'Accredited', with a scope that precisely and explicitly includes ISO/IEC 42001:2023 alongside ISO 9001, ISO/IEC 20000-1, ISO 22301, ISO/IEC 27001 and ISO/IEC 27701, verified against the register, not merely self-reported (anabdirectory.remoteauditor.com, checked 2026-09-20). ### What it publishes about fees: 1/5 No prices, rate cards or worked examples were found anywhere on the public site; every services page routes to a 'Contact a specialist' or 'Get services overview' form (coalfirecertification.com/services.html, /approach.html, checked 2026-09-20). ### Knowledge of your sector: 4/5 The firm states it serves 'cloud and technology, healthcare, and financial services' clients, and its own public certificate directory backs this with named, verifiable clients concentrated in technology and AI (Autodesk, Datadog, Axon Enterprise, Eightfold AI among 15 ISO/IEC 42001 holders); docked one point for having no structured, named-practitioner case studies (coalfirecertification.com/quality-statement.html and /data/data.json, checked 2026-09-20). ### Independence from what it sells: 2/5 A published impartiality policy exists (staff- and account-level neutrality plus an independent external oversight committee), but the firm's own lead auditors deliver consulting-style 'readiness assessments' and mock audits on the standards it certifies, and no policy addresses conflicts from its branding relationship with affiliate consulting firm Coalfire Systems, Inc. (coalfirecertification.com/quality-statement.html and /services.html, checked 2026-09-20). ### Who carries the risk if the advice is wrong: 1/5 No professional indemnity insurance cover or liability terms are published on the public site, and the appeals page explicitly disclaims any claim for cost or loss reimbursement even after a successful appeal reinstates a certificate (coalfirecertification.com/appeals.html, checked 2026-09-20). ## Sources for Coalfire Certification Every line carries the page it was read on and the date it was checked. - Colorado Secretary of State confirms Coalfire Certification Inc as a corporation in Good Standing, formed 18 January 2013, principal office 330 N Wabash Ave Ste 1430, Chicago, IL 60611. - Source: https://www.coloradosos.gov/biz/BusinessEntityDetail.do?quitButtonDestination=BusinessEntityResults&nameTyp=ENT&fileId=20131037156&masterFileId=&entityId2=20131037156&srchTyp=ENTITY - Checked: 2026-09-20 - ANAB's own public Certification Body Directory lists Coalfire Certification, Inc. as an accredited management-systems CB, with a scope that explicitly includes ISO/IEC 42001:2023 (AI management systems), independently confirming the firm's own website claim rather than taking it at face value. - Source: https://anabdirectory.remoteauditor.com/ - Checked: 2026-09-20 - Coalfire Certification's own public certificate directory shows it has already issued live ISO/IEC 42001:2023 certificates to named organisations, not just held a dormant accreditation. - Source: https://www.coalfirecertification.com/client-directory.html - Checked: 2026-09-20 - Coalfire Certification publicly discloses at least one suspended certificate in its live certificate directory, rather than only showing active clients. - Source: https://www.coalfirecertification.com/data/data.json - Checked: 2026-09-20 - Coalfire Certification's own site states it offers optional 'readiness assessments', including a mock audit, delivered by its own lead auditors, on the same standards it then certifies. - Source: https://www.coalfirecertification.com/services.html - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Published - Client results: Published - How it uses AI: Not published ## Strengths - ANAB accreditation for ISO/IEC 42001:2023 is independently verified via ANAB's own public CB Directory (ref. Coalfire-MS-4539, status 'Accredited'), not just a claim on the firm's own marketing pages. - Already has a real, active ISO/IEC 42001 certification track record, 15 named organisations certified as of this check, including well-known technology and AI-sector firms (Autodesk, Datadog, Axon Enterprise, Eightfold AI), rather than an unused accreditation. - Runs a public, searchable certificate directory that discloses certificate status transparently, including at least one currently suspended certificate (Aera Technology, Inc.), which is a genuine transparency signal rather than a curated client-logo list. - Publishes defined complaints and appeals procedures that separate the audit team supporting a client from the staff who review a complaint or appeal against that same client's audit. ## Things to check Each one carries the factual basis it rests on. - Coalfire Certification's own lead auditors deliver optional pre-certification 'readiness assessments' and mock audits against the same standards (including ISO/IEC 42001 and ISO/IEC 27001) the firm then certifies, and its public Quality Statement does not say whether a different auditor is required to perform the subsequent certification audit. - Basis: Coalfire Certification services page (coalfirecertification.com/services.html), checked 2026-09-20. - Coalfire Certification is described on its own site as 'the certification arm of Coalfire Systems, Inc.', a large cybersecurity consulting, penetration-testing and assessment firm, and its published impartiality policy addresses only staff- and account-level neutrality, it does not disclose any policy managing conflicts arising from that affiliate consulting relationship (unlike some peer certification bodies, which publish an explicit bar on certifying organisations their own group has consulted for). - Basis: Coalfire Certification quality statement (coalfirecertification.com/quality-statement.html) and site footer trademark notice, checked 2026-09-20; no equivalent affiliate-conflict policy was found on the public site. - No professional indemnity insurance or liability terms are published anywhere on Coalfire Certification's public site, and its own appeals page states that even where an appeal succeeds and a suspended or withdrawn certificate is reinstated, no claim can be made against Coalfire Certification for reimbursement of any resulting costs or losses. - Basis: Coalfire Certification appeals page (coalfirecertification.com/appeals.html), checked 2026-09-20; no PI-insurance disclosure was found on the site. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.