# Kompleye Attestation, LLC - **Type:** Certification body - **Website:** https://kompleye.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US certification body accredited by ANAB for ISO/IEC 27001 and ISO/IEC 27701 certification. It also offers SOC reports and US HIPAA and federal assessments. ## Kompleye Attestation scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 1/5 No published evidence anywhere on kompleye.com of supporting clients through a breach, incident or regulatory investigation; the firm's only public dispute processes (appeals, complaints, certificate suspension/withdrawal) cover certification decisions, not client incident response. ### Qualifications of the people who do the work: 3/5 Live ANAB accreditation (ID MS-2165, verified via the firm's own posted Scope-of-Accreditation PDF) covers only ISO/IEC 27001 (2013 & 2022) and ISO/IEC 27701:2019 - no ISO 42001 or wider ISO scope is accredited. The parallel 'CPA firm' claim for SOC work carries no published license number, and the FedRAMP/StateRAMP/CMMC services carry no stated 3PAO/C3PAO authorization; neither could be independently confirmed in this pass. ### What it publishes about fees: 1/5 No fee information, rate card or worked example is published on any service page reviewed; every page ends in a 'free consultation' contact prompt. ### Knowledge of your sector: 3/5 Distinct published service tracks for cloud/SaaS, healthcare (HIPAA/HITRUST) and government (FedRAMP/StateRAMP/CMMC/NIST 800-171), but only three named leaders firm-wide (CEO, COO, Senior Auditor/CTO) and no named sector specialists or published sector case studies. ### Independence from what it sells: 5/5 Published Impartiality Statement explicitly bars the firm from consulting on, or performing internal audits for, any management system it certifies, bars outsourcing audits to consultancy organisations, and imposes a two-year cooling-off period on former consultants before joining a certification team for that client - a documented policy separating certification from consulting. ### Who carries the risk if the advice is wrong: 1/5 No professional indemnity insurance, liability cap or client-facing liability terms are disclosed on the complaints/appeals page or elsewhere on the site reviewed. ## Sources for Kompleye Attestation Every line carries the page it was read on and the date it was checked. - Kompleye Attestation, LLC holds ANAB accreditation to ISO/IEC 17021-1, with accredited management-system standards limited to ISO/IEC 27001:2013, ISO/IEC 27001:2022 and ISO/IEC 27701:2019. - Source: https://kompleye.com/wp-content/uploads/2023/08/Kompleye-Scope-of-Accreditation-Executed-08092023.pdf - Checked: 2026-09-20 - Kompleye's ANAB-registered head office is in Reston, Virginia, with a second, ANAB-designated critical office location in Bogota, Colombia. - Source: https://kompleye.com/wp-content/uploads/2023/08/Kompleye-Scope-of-Accreditation-Executed-08092023.pdf - Checked: 2026-09-20 - Kompleye publishes a certification-impartiality policy barring the firm from consulting on, or performing internal audits for, any management system it certifies. - Source: https://kompleye.com/impartiality-statement/ - Checked: 2026-09-20 - Kompleye markets ISO/IEC 27017:2015 and ISO/IEC 27018:2019 assessment services in addition to its ANAB-accredited ISO/IEC 27001 and 27701 work. - Source: https://kompleye.com/iso/ - Checked: 2026-09-20 - Kompleye markets FedRAMP, StateRAMP, CMMC and NIST 800-171 federal assessment services alongside its SOC 1/2/3, HITRUST and HIPAA offerings. - Source: https://kompleye.com/federal-assessments/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Published - Client results: Not published - How it uses AI: Not published ## Strengths - Genuine, dated, third-party ANAB accreditation (ID MS-2165) for ISO/IEC 27001 and ISO/IEC 27701 management-system certification, current to 21 May 2027 - checkable against a named accreditation body rather than a bare marketing claim. - A mechanism-level impartiality policy (no consulting on certified systems, no internal audits for certified clients, no outsourcing to consultancies, two-year practitioner cooling-off) rather than a generic independence statement. - One firm covers SOC 1/2/3, ISO 27001/27701, HITRUST, HIPAA, FedRAMP/StateRAMP/CMMC and pentesting, useful for a buyer wanting to consolidate several assessment types with a single point of contact. ## Things to check Each one carries the factual basis it rests on. - Kompleye markets ISO/IEC 27017:2015 and ISO/IEC 27018:2019 assessment services, but its current ANAB Scope of Accreditation (MS-2165, issued 9 Aug 2023) accredits only ISO/IEC 27001 (2013 and 2022) and ISO/IEC 27701:2019 - 27017 and 27018 fall outside the accredited scope. - Basis: Compared the service list at kompleye.com/iso/ against the firm's own posted Scope of Accreditation PDF, which names only 27001 and 27701 under Information Security Management Systems. - Kompleye markets FedRAMP, StateRAMP and CMMC federal assessment services without stating a 3PAO or C3PAO authorization anywhere on its site, and this pass could not confirm such authorization via the official marketplaces. - Basis: kompleye.com/federal-assessments/ describes the firm only as 'an independent audit firm'; marketplace.fedramp.gov and cyberab.org/Catalog are JS-rendered catalogues that returned no vendor data to a plain fetch. - Kompleye describes itself as 'a CPA firm' performing SOC 1/2/3 attestation engagements but publishes no state CPA firm license number, licensing state, or AICPA firm membership ID anywhere on its site. - Basis: Reviewed kompleye.com/soc-2-2/ and kompleye.com/about-us/; neither names a license number. The Virginia Board of Accountancy firm-license lookup (cpaportal.boa.virginia.gov) requires an interactive form submission this pass could not complete. - We could not read the Virginia register. Ask for its company registration details. - Basis: Two lookup attempts against cis.scc.virginia.gov: a direct fetch was refused (connection refused), and a Bright Data Web Unlocker retry returned HTTP 200 with a zero-byte body. - No published evidence of client-incident, breach or regulatory-investigation support was found on the site. - Basis: Reviewed kompleye.com/complaints/ and the linked appeals-process document; both cover certification disputes, not client-side incident response. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.