# Linford & Company LLP - **Type:** Certification body - **Website:** https://linfordco.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US accountancy and audit firm doing SOC 2 and FedRAMP assessments. It says ANAB accredits it for ISO/IEC 27001 certification, but not currently for ISO/IEC 42001. ## Linford & Company scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 FedRAMP listing references post-ATO continuous monitoring as part of its assessment scope, but no disclosed incident outcomes, breach-support case studies or named results were found on its public site (linfordco.com, marketplace.fedramp.gov, checked 2026-09-20). ### Qualifications of the people who do the work: 4/5 FedRAMP 3PAO status independently confirmed on the official government marketplace since 2017-03-31 (Assessor ID 140531); 19 named partners publish CPA/CISA/CISSP/CRISC credentials; its ANAB accreditation for ISO/IEC 27001 is self-stated but not independently confirmed in ANAB's own directory, and it explicitly discloses it is NOT accredited for ISO/IEC 42001 despite marketing that service (linfordco.com, marketplace.fedramp.gov, checked 2026-09-20). ### What it publishes about fees: 4/5 Publishes an actual SOC 2 audit cost range, "$20,000 to $100,000, depending on a variety of factors," which is rare in this market, though no rate card or itemised worked example is given (linfordco.com/services/soc-2-audits/, checked 2026-09-20). ### Knowledge of your sector: 3/5 Wide breadth of standards (SOC 1/2, HIPAA, HITRUST, FedRAMP/GovRAMP, CMMC, PCI, five ISO schemes) and named credentialed partners, but no named sector case studies or client references were found on the pages reviewed (linfordco.com, checked 2026-09-20). ### Independence from what it sells: 3/5 No compliance-software product or reseller partnership found on its public site; its FedRAMP marketplace listing shows it offers both 3PAO assessment AND separate FedRAMP consulting/documentation-preparation services under the same entity, and its ISO page mentions impartiality only as an internal client-acceptance step, not a published standalone policy (linfordco.com, marketplace.fedramp.gov, checked 2026-09-20). ### Who carries the risk if the advice is wrong: 1/5 No professional-indemnity insurance, E&O cover or engagement liability terms are disclosed on the About, Leadership Team or service pages reviewed (linfordco.com, checked 2026-09-20). ## Sources for Linford & Company Every line carries the page it was read on and the date it was checked. - Colorado Secretary of State record confirms the entity as a domestic LLP in Good Standing, formed 2008-03-24, principal address 1550 Wewatta St, 2nd Floor, Denver, CO 80202. - Source: https://data.colorado.gov/resource/4ykn-tg5h.json?entityid=20081158743 - Checked: 2026-09-20 - The official FedRAMP.gov Marketplace lists Linford & Company as a recognized Third Party Assessment Organization (3PAO), Assessor ID 140531, recognized since 31 March 2017, with 13 total assessments and a highest impact class assessed of Class C (Moderate). - Source: https://marketplace.fedramp.gov/assessors/140531 - Checked: 2026-09-20 - Linford's own ISO service page states it holds ANAB accreditation for ISO/IEC 27001 certification audits and displays the ANAB accredited-body mark. - Source: https://linfordco.com/services/iso-compliance-assessment/ - Checked: 2026-09-20 - Linford explicitly discloses it is not currently accredited to issue accredited ISO/IEC 42001:2023 certificates, despite marketing an ISO 42001 assessment service. - Source: https://linfordco.com/services/iso-42001-compliance-assessment/ - Checked: 2026-09-20 - The firm publishes an actual SOC 2 audit cost range on its own site. - Source: https://linfordco.com/services/soc-2-audits/ - Checked: 2026-09-20 - The firm lists 19 named partners with individually published professional credentials (multiple CPA, CISA, CISSP, CRISC, CIA, CFE, PMP holders), led by Managing Partner Newel Linford, CPA, CISA. - Source: https://linfordco.com/about/leadership-team/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Published - Client results: Not published - How it uses AI: Not published ## Strengths - Listed by FedRAMP as an independent assessor for cloud services used by the US government. - 19 named partners with individually published credentials (multiple CPA, CISA, CISSP, CRISC, CIA, CFE, PMP), giving a buyer named people to check rather than an anonymous team. - Publishes an actual SOC 2 cost range ($20,000 to $100,000), unusual transparency in a market that is mostly 'book a call'. - Broad single-firm coverage across SOC 1/2, HIPAA, HITRUST, FedRAMP/GovRAMP, CMMC, PCI DSS, CSA-STAR and five ISO schemes. - Unusually candid, self-disclosed accreditation boundary: states plainly it is not yet accredited for ISO/IEC 42001 rather than implying blanket ISO cover. ## Things to check Each one carries the factual basis it rests on. - Markets ISO/IEC 42001:2023 (AI management system) assessments while explicitly stating it holds no accreditation to issue accredited certificates against that standard. - Basis: Firm's own site: "Linford & Company LLP is not currently accredited to perform third-party certification audits against ISO/IEC 42001:2023" (linfordco.com/services/iso-42001-compliance-assessment/, checked 2026-09-20). - FedRAMP marketplace data shows no track record above the Moderate impact level across its 13 completed assessments. - Basis: FedRAMP.gov Marketplace assessor profile lists "Highest Class Assessed: Class C (Moderate)" for Assessor ID 140531 (marketplace.fedramp.gov/assessors/140531, checked 2026-09-20). - No professional-indemnity insurance, errors-and-omissions cover, or engagement liability terms are disclosed anywhere on its public site. - Basis: Reviewed About, Leadership Team and SOC 2 service pages; none mention PI/E&O cover or liability terms (checked 2026-09-20). - Its self-stated ANAB accreditation for ISO/IEC 27001 could not be independently confirmed in ANAB's own public directory of accredited organizations during this research. - Basis: search.anab.org company/keyword searches for "Linford" and "Linford & Company LLP" returned no matching organization; ANAB's own site (anab.ansi.org) is behind a Cloudflare bot-check that blocked a direct read (checked 2026-09-20). ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.