We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Kompleye Attestation, LLC review

Certification body

A US certification body accredited by ANAB for ISO/IEC 27001 and ISO/IEC 27701 certification. It also offers SOC reports and US HIPAA and federal assessments.

Relevant if you need an accredited ISO 27001 or 27701 certificate and SOC work from one firm

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Kompleye Attestation scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 1/5
Qualifications of the people who do the work 3/5
What it publishes about fees 1/5
Knowledge of your sector 3/5
Independence from what it sells 5/5
Who carries the risk if the advice is wrong 1/5

What Kompleye Attestation offers, and what it publishes

Kompleye Attestation can issue accredited certificates for ISO/IEC 27001 and ISO/IEC 27701. ANAB accredits it for those two standards under ID MS-2165, from 21 May 2022 to 21 May 2027. Its impartiality policy bars it from consulting on, or internally auditing, any system it certifies. The policy sets a two-year wait before a former consultant joins that client's certification team.

Kompleye Attestation does not publish a price. It discloses no professional indemnity cover. It markets ISO/IEC 27017 and 27018 assessments, which its ANAB scope does not cover. It calls itself 'a CPA firm' for SOC work but publishes no licence number. It states no FedRAMP or CMMC assessor authorisation, and we could not confirm one.

Kompleye Attestation's site offers nothing on ISO/IEC 42001, the AI management system standard. Its complaints and appeals process covers certification decisions only; it shows no work helping clients through a breach or investigation. We could not read Virginia's company register to confirm its registration. It has a second office in Bogota, Colombia.

Strengths

  • Genuine, dated, third-party ANAB accreditation (ID MS-2165) for ISO/IEC 27001 and ISO/IEC 27701 management-system certification, current to 21 May 2027 - checkable against a named accreditation body rather than a bare marketing claim.
  • A mechanism-level impartiality policy (no consulting on certified systems, no internal audits for certified clients, no outsourcing to consultancies, two-year practitioner cooling-off) rather than a generic independence statement.
  • One firm covers SOC 1/2/3, ISO 27001/27701, HITRUST, HIPAA, FedRAMP/StateRAMP/CMMC and pentesting, useful for a buyer wanting to consolidate several assessment types with a single point of contact.

Things to check

  • Kompleye markets ISO/IEC 27017:2015 and ISO/IEC 27018:2019 assessment services, but its current ANAB Scope of Accreditation (MS-2165, issued 9 Aug 2023) accredits only ISO/IEC 27001 (2013 and 2022) and ISO/IEC 27701:2019 - 27017 and 27018 fall outside the accredited scope.
  • Kompleye markets FedRAMP, StateRAMP and CMMC federal assessment services without stating a 3PAO or C3PAO authorization anywhere on its site, and this pass could not confirm such authorization via the official marketplaces.
  • Kompleye describes itself as 'a CPA firm' performing SOC 1/2/3 attestation engagements but publishes no state CPA firm license number, licensing state, or AICPA firm membership ID anywhere on its site.
  • We could not read the Virginia register. Ask for its company registration details.
  • No published evidence of client-incident, breach or regulatory-investigation support was found on the site.

Common questions

What is Kompleye accredited to certify?

ISO/IEC 27001 and ISO/IEC 27701. Its ANAB accreditation (ID MS-2165) runs from 21 May 2022 to 21 May 2027. It does not cover ISO/IEC 27017, 27018 or 42001.

Does Kompleye publish its fees?

No. It publishes no prices, rate card or worked examples. Each service page ends with an offer of a free consultation.

Does Kompleye consult on systems it certifies?

No, according to its published impartiality policy. The policy bars it from consulting on, or internally auditing, any system it certifies. It also bars outsourcing audits to consultancy firms and sets a two-year wait before a former consultant joins that client's certification team.

Is Kompleye's company registration confirmed?

Not by us. We could not read Virginia's State Corporation Commission register when we checked on 20 September 2026. Ask the firm for its registration details.

Evidence for each Kompleye Attestation score

Show our working

Notes behind each thing to check

  • Kompleye markets ISO/IEC 27017:2015 and ISO/IEC 27018:2019 assessment services, but its current ANAB Scope of Accreditation (MS-2165, issued 9 Aug 2023) accredits only ISO/IEC 27001 (2013 and 2022) and ISO/IEC 27701:2019 - 27017 and 27018 fall outside the accredited scope. (Compared the service list at kompleye.com/iso/ against the firm's own posted Scope of Accreditation PDF, which names only 27001 and 27701 under Information Security Management Systems.)
  • Kompleye markets FedRAMP, StateRAMP and CMMC federal assessment services without stating a 3PAO or C3PAO authorization anywhere on its site, and this pass could not confirm such authorization via the official marketplaces. (kompleye.com/federal-assessments/ describes the firm only as 'an independent audit firm'; marketplace.fedramp.gov and cyberab.org/Catalog are JS-rendered catalogues that returned no vendor data to a plain fetch.)
  • Kompleye describes itself as 'a CPA firm' performing SOC 1/2/3 attestation engagements but publishes no state CPA firm license number, licensing state, or AICPA firm membership ID anywhere on its site. (Reviewed kompleye.com/soc-2-2/ and kompleye.com/about-us/; neither names a license number. The Virginia Board of Accountancy firm-license lookup (cpaportal.boa.virginia.gov) requires an interactive form submission this pass could not complete.)
  • We could not read the Virginia register. Ask for its company registration details. (Two lookup attempts against cis.scc.virginia.gov: a direct fetch was refused (connection refused), and a Bright Data Web Unlocker retry returned HTTP 200 with a zero-byte body.)
  • No published evidence of client-incident, breach or regulatory-investigation support was found on the site. (Reviewed kompleye.com/complaints/ and the linked appeals-process document; both cover certification disputes, not client-side incident response.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 1/5 No published evidence anywhere on kompleye.com of supporting clients through a breach, incident or regulatory investigation; the firm's only public dispute processes (appeals, complaints, certificate suspension/withdrawal) cover certification decisions, not client incident response.
Qualifications of the people who do the work 3/5 Live ANAB accreditation (ID MS-2165, verified via the firm's own posted Scope-of-Accreditation PDF) covers only ISO/IEC 27001 (2013 & 2022) and ISO/IEC 27701:2019 - no ISO 42001 or wider ISO scope is accredited. The parallel 'CPA firm' claim for SOC work carries no published license number, and the FedRAMP/StateRAMP/CMMC services carry no stated 3PAO/C3PAO authorization; neither could be independently confirmed in this pass.
What it publishes about fees 1/5 No fee information, rate card or worked example is published on any service page reviewed; every page ends in a 'free consultation' contact prompt.
Knowledge of your sector 3/5 Distinct published service tracks for cloud/SaaS, healthcare (HIPAA/HITRUST) and government (FedRAMP/StateRAMP/CMMC/NIST 800-171), but only three named leaders firm-wide (CEO, COO, Senior Auditor/CTO) and no named sector specialists or published sector case studies.
Independence from what it sells 5/5 Published Impartiality Statement explicitly bars the firm from consulting on, or performing internal audits for, any management system it certifies, bars outsourcing audits to consultancy organisations, and imposes a two-year cooling-off period on former consultants before joining a certification team for that client - a documented policy separating certification from consulting.
Who carries the risk if the advice is wrong 1/5 No professional indemnity insurance, liability cap or client-facing liability terms are disclosed on the complaints/appeals page or elsewhere on the site reviewed.

Sources for Kompleye Attestation

  • Kompleye Attestation, LLC holds ANAB accreditation to ISO/IEC 17021-1, with accredited management-system standards limited to ISO/IEC 27001:2013, ISO/IEC 27001:2022 and ISO/IEC 27701:2019. (Accreditation ID MS-2165; accredited since 21 May 2022, expires 21 May 2027) (kompleye.com, checked 20 September 2026)
  • Kompleye's ANAB-registered head office is in Reston, Virginia, with a second, ANAB-designated critical office location in Bogota, Colombia. (12110 Sunset Hills Road, Suite 600, Reston, VA 20190; Torre Unika Virrey, Carrera 15 #88-21 Of. 702, Bogota, Colombia) (kompleye.com, checked 20 September 2026)
  • Kompleye publishes a certification-impartiality policy barring the firm from consulting on, or performing internal audits for, any management system it certifies. (No outsourcing of audits to consultancy organisations; two-year cooling-off period before a former consultant may join a certification team for that client) (kompleye.com, checked 20 September 2026)
  • Kompleye markets ISO/IEC 27017:2015 and ISO/IEC 27018:2019 assessment services in addition to its ANAB-accredited ISO/IEC 27001 and 27701 work. (27017 and 27018 do not appear on Kompleye's ANAB Scope of Accreditation (MS-2165)) (kompleye.com, checked 20 September 2026)
  • Kompleye markets FedRAMP, StateRAMP, CMMC and NIST 800-171 federal assessment services alongside its SOC 1/2/3, HITRUST and HIPAA offerings. (No 3PAO, C3PAO or RPO authorization is stated on the page; not independently confirmable via the FedRAMP Marketplace or Cyber-AB CMMC Marketplace, both JS-rendered) (kompleye.com, checked 20 September 2026)

ANAB accreditation to ISO/IEC 17021-1 (ID MS-2165) for ISO/IEC 27001:2013, ISO/IEC 27001:2022 and ISO/IEC 27701:2019, accredited since 21 May 2022, expiring 21 May 2027

Seeking ISO 42001 certificationRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.