Coalfire

Coalfire is a cybersecurity advisory and assessment firm built around compliance and audit work rather than a single security product. It holds accreditations that let it perform assessments other firms cannot — including PCI DSS Qualified Security Assessor (QSA) status and FedRAMP Third-Party Assessment Organization (3PAO) authorization — and advises clients across roughly 100-plus regulatory and security frameworks, from PCI DSS and HIPAA to FedRAMP, FISMA, and CMMC.

Founded in 2001 and headquartered in Westminster, Colorado, Coalfire has grown into one of the larger independent compliance and cybersecurity consultancies in the U.S., with more than a thousand employees across 17-plus locations. Its Coalfire Federal division focuses specifically on FedRAMP strategy and CMMC assessments for government and defense-adjacent clients, while a separate team, DivisionHex, runs offensive security engagements (penetration testing, red teaming) alongside the firm’s traditional defensive and managed SOC services.

Apax Partners, a global private equity firm, acquired Coalfire in 2020, providing capital for continued expansion. Coalfire says it has helped secure more than 700 cloud service provider environments through its FedRAMP and cloud assessment work — a claim that is partly verifiable, since FedRAMP-authorized cloud offerings and their assessing 3PAOs are listed in the public FedRAMP marketplace, though the specific count of 700-plus is Coalfire’s own figure.