# ControlCase Assessments LLC - **Type:** Certification body - **Website:** https://www.controlcase.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US certification and assessment body for PCI DSS, FedRAMP, CMMC, HITRUST and ISO 27001. It says ANAB accredited it for ISO 42001 from 13 August 2026. ## ControlCase Assessments scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 No published breach-response, incident-support or regulatory-defense service or track record was found on controlcase.com; the site markets vulnerability scanning, penetration testing and log monitoring as standalone technical testing services rather than incident/regulatory-defense support (checked 2026-09-20). ### Qualifications of the people who do the work: 3/5 ControlCase Assessments states ANAB accreditation for ISO/IEC 42001:2023, effective 13 Aug 2026, 'updated in the ANAB directory', but ANAB's own directory could not be independently checked (anab.ansi.org / anabpd.ansi.org returned HTTP 403 on repeated attempts, 2026-09-20), so this and ControlCase's other claimed authorisations (PCI QSA, FedRAMP 3PAO, CMMC C3PAO, HITRUST Authorized External Assessor, ISO 27001) are reported here as self-stated and dated, not independently register-verified in this pass; do not read this as confirmation of ISO 42001 scope beyond the company's own announcement. ### What it publishes about fees: 1/5 Every service page checked ends in 'Request Datasheet / Request Quote / Request Demo' with no fee model description or figures published anywhere found on controlcase.com (checked 2026-09-20). ### Knowledge of your sector: 3/5 Named industry pages exist for Business Process Outsourcing, Cloud Service Providers, Retail, Telecom & Entertainment and Managed Service Providers, but no named sector case study or practitioner-level sector expertise was found in this pass (controlcase.com, checked 2026-09-20). ### Independence from what it sells: 3/5 ControlCase, LLC publishes a Statement of Impartiality barring certification of its own consultancy clients, barring audit outsourcing to consultancies, and applying a two-year cooling-off period for former consultancy staff (controlcase.com/impartiality-statement, checked 2026-09-20). Against this, for CMMC the same company markets itself as both an Authorized C3PAO (certifier) and a Registered Provider Organization (RPO, i.e. compliance consultant) on one page, a mixed certification/consulting model the general impartiality statement does not explicitly name or resolve for that scheme (controlcase.com/certifications/cmmc, checked 2026-09-20). ### Who carries the risk if the advice is wrong: 1/5 No professional-indemnity insurance disclosure, liability terms or complaints/appeals process were found on controlcase.com's Terms and Conditions, Legal Notices or Impartiality Statement pages; the Terms and Conditions contain only a standard clause requiring the client to indemnify ControlCase (checked 2026-09-20). ## Sources for ControlCase Assessments Every line carries the page it was read on and the date it was checked. - ControlCase Assessments has been accredited by the ANSI National Accreditation Board (ANAB) for ISO/IEC 42001:2023 (AI Management Systems), effective 13 August 2026. - Source: https://www.controlcase.com/announces-iso-iec-42001-accreditation/ - Checked: 2026-09-20 - ControlCase is headquartered at 3975 Fair Ridge Dr Ste T25S-D, Fairfax, Virginia 22033. - Source: https://www.controlcase.com/company/ - Checked: 2026-09-20 - ControlCase states it is a FedRAMP Third Party Assessment Organization (3PAO). - Source: https://www.controlcase.com/certifications/fedramp-and-3pao-services/ - Checked: 2026-09-20 - ControlCase states it holds both CMMC Third-Party Assessment Organization (C3PAO) authorization and Registered Provider Organization (RPO) status. - Source: https://www.controlcase.com/certifications/cmmc/ - Checked: 2026-09-20 - ControlCase states it is a HITRUST Authorized External Assessor and points buyers to HITRUST's own assessor directory to verify this. - Source: https://www.controlcase.com/certifications/hitrust-certification/ - Checked: 2026-09-20 - ControlCase, LLC publishes a Statement of Impartiality committing not to certify a management system where it has provided consultancy, not to outsource audits to consultancy organisations, and to apply a two-year cooling-off period for former consultancy staff before they can audit that client. - Source: https://www.controlcase.com/impartiality-statement/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Published - Client results: Not published - How it uses AI: Not published ## Strengths - Newly accredited (13 Aug 2026) by ANAB for ISO/IEC 42001:2023 AI Management Systems, adding an accredited AI-governance certification scope to its portfolio. - Publishes a detailed Statement of Impartiality with specific, ISO-17021-style safeguards (no certifying own consultancy clients, no outsourcing audits to consultancies, two-year cooling-off for former consultancy staff). - Broad, one-stop US compliance footprint: PCI DSS QSA, FedRAMP 3PAO, CMMC C3PAO, HITRUST Authorized External Assessor and ISO 27001, alongside the new ISO 42001 scope. - Established, US-headquartered firm (Fairfax, VA) with a named executive team (CEO Mike Jenner and other named C-suite/partner titles) and offices across North America, Europe, Latin America, Asia/Pacific and the Middle East. ## Things to check Each one carries the factual basis it rests on. - Ask for fees, insurance cover, liability limits and the complaints process. These were not explained on the pages we checked. - Basis: Checked controlcase.com Terms and Conditions, Legal Notices and Impartiality Statement pages (2026-09-20); Terms and Conditions contain only a standard client-indemnifies-ControlCase clause, and every service page ends in 'Request Datasheet / Request Quote / Request Demo' with no pricing information. - The ISO/IEC 42001 ANAB accreditation is currently confirmed only via ControlCase's own press release, not independently against ANAB's public directory. - Basis: ANAB's directory (anab.ansi.org and anabpd.ansi.org) returned HTTP 403 on every direct attempt on 2026-09-20; ControlCase's own announcement states the status 'has been updated in the ANAB directory' but no schedule or certificate number is quoted on the ControlCase page itself. - For CMMC, ControlCase markets itself simultaneously as the certifying body (C3PAO) and as a compliance consultant (Registered Provider Organization) on the same page. - Basis: controlcase.com/certifications/cmmc/ states: 'ControlCase is both an Authorized CMMC Third-Party Assessment Organization (C3PAO) and a Registered Provider Organization (RPO). That means we can provide your certification assessment, or we can help you get compliant to CMMC Level 2 and prepare for your certification.' The general Statement of Impartiality addresses management-system consultancy generally but does not name or resolve this specific CMMC C3PAO/RPO pairing. - The exact legal entity name is inconsistent across ControlCase's own pages, and the Virginia state register could not be reached to resolve it. - Basis: 'ControlCase, LLC' appears on the Company/Impartiality/footer pages, 'ControlCase, Inc.' appears on the Legal Notices page (at an older McLean, VA address), and 'ControlCase Assessments' is the name used in the ANAB accreditation press release; the Virginia SCC Clerk's Information System could not be reached (see blockers) to confirm which entity is registered as 'ControlCase Assessments LLC'. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.