Contact Us

Services

Suite of Services

Schellman began as a SOC audit firm 20+ years ago. While we still issue more than 2,000 SOC reports each year, our clients’ trust has propelled our expansion. Today, we offer nearly 60 types of audits and assessments.

Download a PDF of All Services

Learning Center

About Us

About Us

Schellman is the only Top 50 CPA firm focused exclusively on IT Compliance and Cybersecurity, and we’re the #1 service provider for FedRAMP Assessments. Our industry-leading NPS scores, client retention, and employee retention mean our clients experience greater continuity and quality.

Leadership Team
In a sea of sameness, we consistently apply our core values to stand apart.
Corporate Social Responsibility
Our B Corp certification underscores our commitment to a more sustainable future for the marketplace, our people, the community, and the environment.
Careers
Join a team of the industry’s most talented individuals at a company where one of our core values is People First.
Strategic Partnerships
We’re proud to collaborate with a diverse set of providers while remaining steadfast in our commitment to impartiality and independence.

Schellman's 2025 People & Talent Report

2025 People & Talent Report

Certificate Directory

Services

Services

View All Services

SOC & Attestations

SOC & Attestations

SOC 1 / SSAE 18 Examination

SOC 2 Examination

SOC 3 Examination

SOC for Supply Chain

SOC for Cybersecurity

C5 Attestation

CSA STAR Programs

Payment Card Assessments

Payment Card Assessments

PCI DSS Validation

PCI SSF

PCI P2PE Validation

PCI PIN Assessments

PCI 3DS Compliance

ISO Certifications

ISO Certifications

ISO 27001

ISO 42001

ISO 27701

ISO 9001

ISO 22301

ISO 20000-1

ISO 14001

ISO 45001

ISO 50001

Privacy Assessments

Privacy Assessments

Global CBPR & PRP Certification

GDPR Assessment

International Privacy Assessments

US Privacy Assessments

Microsoft SSPA/DPR Assessment

EU Cloud Code of Conduct

Federal Assessments

Federal Assessments

FedRAMP®

CMMC / NIST SP 800-171

FISMA/NIST

ITAR

CJIS

IRAP

FTC Consent Decrees

DoD IL6

Healthcare Assessments

Healthcare Assessments

HITRUST Certification

HIPAA Compliance

HIPAA Express

EPCS-DEA Audits

Health Data Host (HDS) Certification

Penetration Testing

Penetration Testing

Application

Network

Mobile

Red Teaming

Social Engineering

Cloud

Physical

Hardware and IoT

Advanced Services

AI Red Teaming

Cybersecurity Assessments

Cybersecurity Assessments

Cloud Configuration Assessments

Ransomware Assessments

NIST Cybersecurity Framework Assessments

Schellman Software Security Assessment (S³A)

TISAX®

SWIFT Customer Security Programme

Internal Audit Co-Sourcing

MTCS Certification

ENS Certification

Crypto and Digital Trust

Crypto and Digital Trust

Schellman Training

Schellman Training

Sustainability Services

Sustainability Services

AI Governance

Learning Center

About Us

About Us

Leadership Team

Leadership Team

Corporate Social Responsibility

Corporate Social Responsibility

Careers

Strategic Partnerships

Strategic Partnerships

Certificate Directory

The Schellman Blog

Blog Feature

Education | Healthcare Assessments

5 Things CISOs Should Know About HIPAA

By: Schellman
November 18th, 2015

The more advanced technology gets, the more chief information security officers have to worry about. And with hackers waging significant wars on major organizations like JPMorgan Chase and Anthem, their job has become more important than ever.

Blog Feature

Healthcare Assessments | Audit Readiness

Tips for Preparing Your Healthcare Organization for a HITRUST Audit

By: Doug Kanney
November 1st, 2015

The Health Information Trust Alliance is a U.S.-based organization that works with healthcare, technology and information security leaders to establish a Common Security Framework (CSF). A CSF is a body of controls for all organizations to follow to create, access, store and exchange private or regulated data. The Health Information Trust Alliance believes security should be a core pillar of health information systems and exchanges, not an obstacle to be hurtled, hence its mission to normalize security controls via the CSF. The CSF includes:

Blog Feature

Healthcare Assessments

HIPAA Omnibus Rule: What You As a Business Associate Need to Know

By: Danny Manimbo
May 5th, 2014

The HIPAA Omnibus Rule which took effect on September 23, 2013, has led to the evolution of the HIPAA Compliance environment. Now more than ever it is important to understand what the security and privacy obligations are of a business associate (BA) or a subcontractor of a BA. BA’s are now mandated to comply with the HIPAA Privacy and Security rule requirements. Below are some high level requirements that BA’s need to be aware of when assessing their compliance environment:

{

Previous All posts