A-LIGN

A-LIGN is a Tampa certification and attestation firm. Public company materials date its founding to 2009. Mid-market technology, healthcare, financial-services, and defense or federal suppliers meet the name when a customer asks for an information-security certificate, a SOC 2 report, or both. The legal entity on the accreditation records is A-LIGN Compliance and Security, Inc., doing business as A-LIGN, at 400 North Ashley Drive, Suite 1325, Tampa. Match that name to the proposal. A platform brand is not the issuer.

Who should shortlist A-LIGN

This is a specialist entry, not a factory quality registrar. Software companies, professional-services firms that hold customer data, and IT-led teams that already live in vendor-risk questionnaires will usually get more from A-LIGN than a plant whose first need is ISO 9001, ISO 14001, or ISO 45001.

A-LIGN is not tagged here for those three standards. ANAB's withdrawal table shows a voluntary withdrawal of A-LIGN's ISO 9001 accreditation in November 2020. The current ANAB scope does not list ISO 9001. An older certificate that once did is not current scope.

On the quality, then security, then AI path, A-LIGN belongs on the ISO/IEC 27001 and ISO/IEC 42001 shortlist. A broader registrar can stay on the plant certificates. Some buyers keep two certification bodies for that reason. Which artifact this cycle actually is, the certificate or the SOC 2 report, is the question on ISO 27001 vs SOC 2. A-LIGN's public pages describe both products and say the firm can coordinate them. Coordination is not one permission. The certificate needs an accredited certification body. The report needs a licensed CPA firm. Confirm both before you put them on the same request.

For AI management, the ANAB scope includes ISO/IEC 42001:2023. The published UKAS schedule for this entity covers ISO/IEC 27001:2022 and privacy information management systems to ISO/IEC 27701:2019. That UKAS schedule does not list ISO/IEC 42001. If a customer wants a UKAS-marked AI management certificate, ask whether that mark exists. If they want an ANAB-marked one, confirm the live ANAB scope still includes 42001 for your locations. A 27001 line does not imply 42001. A UKAS line does not imply the ANAB line.

The ANAB scope also names offices in Sofia, New Delhi, and Panama City, and it marks the Panama City office as a critical location under ANAB's office rules. Ask which office will actually work your audit, and which accreditation mark will be on the certificate.

What to verify in a quote

• The legal entity is A-LIGN Compliance and Security, Inc. dba A-LIGN, not a sales name or a software tool.
• For ISO/IEC 27001, whether you need the ANAB mark, the UKAS mark, or both, and that the edition is the one your customer named (the ANAB scope includes ISO/IEC 27001:2022).
• For ISO/IEC 42001, that the mark you need is on the live schedule. Do not assume UKAS covers an AI management system because UKAS covers the information security management system.
• For SOC 2, the CPA firm that will sign, Type 1 or Type 2, and the Trust Services Criteria categories. Check that firm with the state board of accountancy, and with NASBA CPAverify where that board participates. The ANAB scope is not that check.
• Whether a combined 27001 and SOC 2 engagement still produces two artifacts, with two owners, rather than one blended letter.
• Transfer terms if you already hold an ISO/IEC 27001 certificate with another registrar. That move is a certificate transfer, not a logo swap.

Privacy (ISO/IEC 27701) and business continuity (ISO 22301) appear on the ANAB scope. Treat them as separate questions. This entry does not turn them into ISO 9001, ISO 14001, or ISO 45001 coverage.

When the scope on the page is the scope you can staff, send one pack through Get quotes. Re-check the live schedules before Stage 1, not only when you first open the directory.

Verify on ANAB's directory, UKAS, and IAF CertSearch.