The main firms delivering Collibra implementations for US enterprises include First San Francisco Partners, Kalypso, Attain Partners, Nexer United States, Kubrick Group, Murdio, and the global system integrators Accenture, Deloitte, PwC, Capgemini and Infosys. They fall into four categories: US-based service partners, Collibra-only specialists, global SIs with US practices, and talent-model firms. The right one depends on engagement shape, not on ranking.
Collibra’s partner directory lists firms alphabetically, with one paragraph each and no way to tell which of them has ever delivered a program the size of yours. There is no geography filter, no indication of bench depth, and no distinction between a three-person practice and a hundred-person one.
If you are shortlisting a partner for a United States Collibra implementation, this article is the map that directory should have been: how the US market is structured, who operates in it, and which selection criteria actually predict delivery outcomes.
Key takeaways
- Collibra implementations in the United States split into two tracks: commercial cloud, and Collibra Platform for Government, which is FedRAMP authorized and operated through Collibra Public Sector, a separately operated US subsidiary. The partner sets and contract vehicles differ.
- The US partner landscape has four distinct categories: US-based Collibra service partners, Collibra-only specialists, global system integrators with US Collibra practices, and talent-model firms that train and place certified consultants. They are not competing for the same engagements.
- US regulatory drivers for Collibra programs differ from European ones. Instead of a single GDPR baseline, US enterprises manage a state privacy patchwork alongside HIPAA, SOX, GLBA and, for large banks, the Fed’s CCAR stress tests. BCBS 239 applies here too, but as a global Basel standard it is shared with EU banking, not a US-specific driver..
- Certification counts are the most useful public signal of delivery depth, and they are rarely disclosed. Global firms do not publish them at all.
- A partner’s US address predicts very little about implementation outcomes. Certified bench depth, comparable use cases and named delivery staff predict a great deal.
- Murdio delivers Collibra implementations for United States enterprises from a European delivery base, with 19 Collibra Rangers and 29 certified specialists, including four delivered US engagements across pharma, life sciences and financial services.
What makes a US Collibra implementation different
A Collibra implementation in the United States differs from implementations in other regions mainly in its regulatory drivers and its delivery constraints, not in the platform itself. The three differences that matter are the US regulatory stack, the split between the commercial and federal tracks, and the data access rules that determine who is allowed to touch which systems during delivery.
- The regulatory stack: European programs configure against a single privacy baseline. US programs configure against a moving patchwork of state privacy laws layered over sector regulation, which changes what the catalog has to know about the data it describes.
- The federal fork: Early in scoping, a US Collibra program commits to one of two incompatible tracks: commercial cloud, or Collibra Platform for Government. The tracks carry different security baselines, contract vehicles and partner sets. Discovering late that your program belongs on the other track invalidates both the architecture and the shortlist.
- Data access during delivery: Some US contracts require that only US persons access production data, or restrict cross-border access to live systems. This does not stop the metadata work, but it determines how an engagement is structured, and it is a question to settle before signing a partner rather than during sprint three.
None of this changes the phases of the work itself; the rollout sequence is covered in the FAQ link below. This article stays on what the US context adds.
The US regulatory stack that shapes a Collibra rollout
This is not a compliance explainer. Your legal team knows the statutes. What matters is what each regulation forces you to configure in Collibra, because that is the part partners underestimate and the part that stalls programs when it surfaces late.
- FedRAMP and the federal track: Collibra Platform for Government received FedRAMP Moderate authorization in December 2019 and is operated by Collibra Public Sector, an independently operated US subsidiary. A self-hosted option exists for air-gapped and classified environments. Federal work runs through acquisition vehicles such as GSA, SEWP, ESI and NASPO, which narrows the eligible partner field considerably: a firm without a route onto those vehicles cannot contract for the work.
- The state privacy patchwork: Roughly twenty states have comprehensive consumer privacy laws in effect as of 2026, with several more taking effect through 2027; the IAPP US State Privacy Legislation Tracker is the reference to watch. The implication for Collibra: PII classification has to be attribute-level and jurisdiction-aware, because there is no national baseline to configure against, and consumer rights fulfilment requires the catalog to know where personal data for a given state’s residents lives. A glossary-level “contains PII” flag does not survive contact with a California deletion request.
- Sector regulation: HIPAA for healthcare and payer organizations, SOX for financial reporting lineage at public companies, GLBA for financial institutions, 21 CFR Part 11 for regulated pharma records, and CCAR alongside BCBS 239 as applied by US supervisors for large banks. Each translates into concrete Collibra artefacts:
| Regulation | What it forces you to configure in Collibra |
| FedRAMP (federal track) | Deployment on Collibra Platform for Government; partner personnel and boundary requirements; procurement via federal acquisition vehicles |
| State privacy laws (CCPA and successors) | Attribute-level, jurisdiction-aware PII classification; data location mapping to support deletion and opt-out fulfilment |
| HIPAA | PHI asset types and handling policies; access certification workflows for systems holding patient data |
| SOX | Trusted, auditable lineage for financial reporting data flows; change controls on report-feeding assets |
| GLBA | Classification and policy coverage for nonpublic personal information in financial institutions |
| 21 CFR Part 11 | Governance of records and signatures in regulated pharma systems; validated workflow states |
| CCAR / BCBS 239 (US supervision) | Demonstrable lineage and data quality controls for risk aggregation and regulatory reporting |
European banking drivers such as GDPR and DORA belong to a different conversation; if that is your context, see Collibra implementation in banking.
The Collibra partner landscape in the United States
The US market divides into four categories that are frequently mistaken for one competitive set. They are not, and most shortlist confusion comes from comparing firms across categories as if they were interchangeable. Partner rosters change; the descriptions below are current as of July 2026, verified against collibra.com and each firm’s own site.
- US-based Collibra service partners: Firms headquartered in the US with an established Collibra practice.
- First San Francisco Partners is a US-based Collibra service partner, a Collibra partner since 2012, strongest on governance operating model design and adoption alongside the technical build, with published work for healthcare and life sciences clients. Of the single-firm pages in this space, theirs is the most substantive.
- Kalypso is a Collibra Registered Services Partner within a broader systems-integration portfolio, strongest where Collibra sits inside a product or manufacturing digital-transformation program.
- Attain Partners is a US consulting firm whose Collibra practice concentrates on public sector, federal and higher education implementation tracks, which puts it on the federal side of the fork most other firms cannot serve.
- Nexer United States is a Collibra partner focused on template-led deployments, asset tracking and AI governance integration, suited to repeatable domain rollouts.
- Collibra-only specialists: Firms where Collibra is the entire practice rather than one line in a portfolio.
Murdio is the example in this category: a Collibra Service Partner where every consultant is certified, there is no platform context-switching, institutional knowledge compounds across projects, and tolerance for custom development beyond standard connectors is structurally higher.
The trade-off, stated plainly: a Collibra-only specialist has no capacity to run a broader transformation program around the Collibra workstream. If Collibra is one component of a five-workstream modernization, this category delivers the component, not the program.
- Global system integrators with US Collibra practices: Accenture, Deloitte, PwC, Capgemini and Infosys all maintain US Collibra capability.
Their strengths are real: scale, existing enterprise relationships, the ability to manage Collibra as one component of a larger program, and regulatory advisory credibility specialists cannot match.
Their structural weakness is equally real: Collibra specialist depth on any given account is a staffing outcome, not a firm property, and none of them discloses certification counts at firm level. The team in the proposal and the team in month four are not guaranteed to be the same people.
- Talent-model firms: Kubrick Group is the clearest US example: it trains and places certified Collibra consultants on long-term client engagements rather than delivering fixed-scope projects. This fits organizations building permanent internal capability, and it is a different purchase than an implementation.
Certification depth is the one public signal that cuts across all four categories, and the least published. Where a firm discloses it, Collibra Ranger certification counts are the number to ask about, because Ranger requires demonstrated delivery, not just an exam. For a globally scoped comparison, see our overview of the top Collibra implementation partners globally; this page stays on the US market’s structure.
Does your Collibra partner need to be in the United States?
This is the question the whole shortlist actually turns on, and it deserves a straight answer in both directions.
When US presence genuinely matters
Federal and public-sector work, where FedRAMP boundary and personnel requirements apply. Contracts that require US-person access to production data. Workloads where data residency terms restrict cross-border access to live systems. Programs with heavy in-person stakeholder facilitation across US sites. Procurement policies that simply mandate a US legal entity, which some do, and which no argument changes.
When US presence does not matter – most commercial implementations
Collibra work is metadata work, delivered against a cloud platform. Configuration, metamodel design, workflow development and integration engineering are not location-dependent, and nothing about a US address makes a metamodel better. Working-hours overlap is a scheduling problem, and a solvable one: a European afternoon is a US East Coast morning, which in practice produces more real-time overlap than a West Coast partner offers a New York client.
What procurement often does instead is apply the zip code proxy: using a partner’s US address as a stand-in for delivery quality, because an address is easy to verify and certified bench depth is not. The proxy fails in both directions. It clears a firm with a US headquarters and three certified people, and it eliminates the firm with the deepest certified bench because its office is in the wrong country.
What actually predicts delivery quality is a shorter and harder list:
- Certified bench depth, including the named individuals who will be on your account, not the firm’s aggregate.
- Delivered use cases comparable to yours, at use-case level rather than logo level.
- Custom development capability beyond standard connectors, because US programs hit connector limits early.
- Whether adoption is a parallel workstream from day one or a training sprint bolted on at the end.
Murdio’s own position belongs here, stated without defensiveness. We deliver for US enterprises from a European base, with 19 Collibra Rangers and 29 certified specialists.
For commercial configuration, metamodel, workflow and integration work, the delivery location has not been the variable that determined outcomes on any of our US engagements. And for federal work inside a FedRAMP boundary or on a federal acquisition vehicle, we are the wrong partner: that work belongs to the US federal-track firms, and pretending otherwise would waste your evaluation time and ours.
What US Collibra delivery looks like in practice
Murdio has delivered Collibra engagements for United States enterprises across pharma and life sciences. The four below are representative, described at the level of what was structurally hard rather than as case study recaps.
1. Governing bought-in data at a US pharmaceutical division.
A major division of a US pharmaceutical enterprise was buying external datasets from multiple vendors with no way to govern them inside Collibra. The hard part was not configuration but the missing bridge between the business layer. Without it, no one could trace a purchased dataset to where it lived in the client’s systems, and with no common catalog to check prior purchases, the same data got bought more than once.
Murdio embedded a Solution Architect who designed a custom metamodel mapping vendors, contracts and physical data sources; a Murdio engineer then built an integration that pulled contract and data-asset details from the client’s Contract Lifecycle Management system into Collibra. A steward linked those details to the physical data from the same purchase, and a separate recertification workflow in Collibra flipped an asset to expired status when its contract lapsed, with a path to recertify on extension.
Business taxonomies covering therapeutic area, disease and brand, among others such as subject area and geography, made previously undiscoverable assets findable.
Full detail in the embedded Collibra Solution Architect engagement.
2. Migrating a home-built Data Marketplace onto Collibra for a US life sciences company.
A US life sciences company already ran Collibra but maintained a separate custom-built web application as its Data Marketplace, with its own infrastructure, hosting cost and dedicated internal developers keeping it alive. The structural difficulty was that requirements could not be gathered the usual way, because the spec was an existing application with no documented limits.
Murdio’s three-person team reverse-engineered every feature and user flow, interviewed business users to separate the essential from legacy cruft, and migrated roughly 300 data publications and a user base of 100-plus onto a Collibra-native Data Product metamodel over about nine months. The legacy application was decommissioned, and the parallel infrastructure went with it.
Full detail in the Data Marketplace migration for a pharma company.
3. Building a reusable Data Marketplace inside a US life sciences enterprise.
The HR function of a US life sciences enterprise wanted a Collibra-based marketplace so data producers could share assets and employees could find and request access without the existing email-driven process. The technology was not the hard part; the stakeholder structure was. The initiative came through an intermediary group, the sponsor and the execution owner were different parties, and the internal Collibra owner who had declined to build the marketplace in-house still held influence over technical decisions.
Murdio deployed a Solution Architect and a Workflow Developer, designed a data-product metamodel and a multi-step access request and approval workflow with an integration-ready provisioning step, and built it to scale beyond HR once interest spread.
Full detail in a Collibra data marketplace for a life sciences company.
4. Automating Snowflake-to-Collibra technical lineage for a US pharma enterprise.
A US pharmaceutical enterprise needed reliable, column-level technical lineage from Snowflake into Collibra and was maintaining it manually, which meant it was perpetually stale and every impact analysis was a manual exercise.
The engagement built a custom technical lineage solution capturing data movement at table and column level across Snowflake transformations and surfacing it in the Collibra catalog, replacing the manual work and enabling automated impact analysis. This is the custom-parsing work standard integrations do not cover.
Full detail in Snowflake technical lineage for Collibra.
Signs your Collibra program needs outside help
US programs stall in recognisable ways. If more than two of these describe yours, the problem is structural, not a matter of trying harder.
- Collibra was bought for a compliance deadline and has not moved beyond the glossary since. The deadline pressure that funded the purchase evaporated at go-live, and nothing replaced it as the driver.
- Lineage exists on the diagram but nobody in the business trusts it enough to use it for impact analysis. Usually because it was loaded once, manually, and has drifted from reality ever since.
- Access requests still arrive by email despite the marketplace being live. The workflow exists; the adoption work that would have made it the path of least resistance never happened.
- Your SI’s Collibra “team” turned out to be two certified people rotating across four accounts. Specialist depth was a staffing outcome, and the staffing changed.
- Nobody can answer where personal data for a given state’s residents actually sits. Which turns every consumer rights request into a manual scramble, in an environment where the number of states asking is still growing.
- Adoption sits well below the licensed user count and the renewal conversation is approaching. The cost of inaction has a date on it: you will walk into that conversation with usage evidence or with explanations. Our breakdown of Collibra adoption covers what moves that number.
When to bring in a specialist and when not to
An honest split, because not every gap on that list needs a partner.
- Handle internally: glossary curation and content maintenance, stewardship community management, business-side use case prioritisation, ongoing metadata quality. These require domain knowledge you have and no partner does.
- Bring in a specialist for metamodel design before it calcifies, custom integrations beyond standard connectors, custom lineage for SAP or Snowflake, marketplace and workflow development, and recovering a program that has stalled after go-live. This is where a Collibra technical implementation team earns its cost fastest.
- Bring in a global SI when Collibra is embedded in a wider transformation, when the rollout spans multiple countries with heavy program governance, or when an existing SI relationship already manages the estate.
- Bring in a US federal-track partner for anything inside a FedRAMP boundary or on a federal acquisition vehicle. No exceptions, including us.
| US scenario | Partner type that fits |
| Federal agency or FedRAMP-boundary deployment | US federal-track partner (e.g. public sector specialists on GSA/SEWP vehicles) |
| Commercial program, custom metamodel or lineage work, contained scope | Collibra-only specialist |
| Collibra as one workstream in a multi-country transformation | Global SI with US Collibra practice |
| State privacy compliance build (jurisdiction-aware PII classification) | Collibra-only specialist or US service partner with privacy delivery evidence |
| SOX lineage for financial reporting at a US public company | Specialist with custom lineage capability; SI if embedded in a finance transformation |
| Building permanent internal Collibra capability | Talent-model firm |
| Contract requires US-person access to production data | US-based partner in any category; verify named staff, not just the address |
Where to take this next
If you are evaluating partners for a US program, the free Collibra Health Check is a one-hour consultation where we review your current setup, your regulatory scope and your shortlist logic, and tell you honestly which category of partner your program needs, including when it is not us.
If the symptom list above read like a description of your program, the conversation to have is about our Audit and Rescue path instead. Either way, talk to us and we will start from where your program actually is.
FAQ: Collibra implementation in the United States
Yes. Collibra Platform for Government received FedRAMP Moderate authorization in December 2019 and is operated by Collibra Public Sector, an independently operated US subsidiary. A self-hosted option exists for air-gapped and classified environments, and federal purchases run through acquisition vehicles such as GSA, SEWP, ESI and NASPO.
A first production use case typically lands in three to six months, with enterprise-wide rollout running considerably longer depending on scope. The phase-by-phase breakdown is in our Collibra implementation guide; US programs follow the same sequence with the regulatory configuration work described above added in.
Implementation services for a US enterprise program typically range from the low six figures for a contained first use case to seven figures for multi-domain rollouts, on top of licensing. The main cost drivers are the number of use cases, custom integration and lineage scope, and whether adoption is resourced as a workstream. US rates for global SI delivery run meaningfully higher than specialist rates for equivalent certified staff.
For most commercial implementations, no; for federal work and contracts with US-person data access requirements, yes. Configuration, metamodel design and integration engineering are not location-dependent, and a partner’s address predicts far less about outcomes than certified bench depth and comparable delivered use cases. The exceptions are hard ones: FedRAMP boundaries, US-person access clauses and procurement mandates for a US entity are non-negotiable where they apply.
Collibra supports state privacy compliance by classifying personal data at attribute level, mapping where it physically lives, and driving the workflows that fulfil consumer rights requests such as deletion and opt-out. With roughly twenty state laws in effect and no federal baseline, the configuration has to be jurisdiction-aware, which is a metamodel decision made early, not a setting toggled later.
A Services Partner is certified to implement and configure the platform; a reseller is authorized to sell licenses. Some firms are both, and the distinction matters when evaluating who will actually deliver. The commercial side is covered in our guide to working with a Collibra reseller.
Only if it can operate within the FedRAMP boundary, meet personnel requirements, and contract through federal acquisition vehicles. That describes a small subset of the partner landscape, mostly US public-sector specialists such as Attain Partners and the federal practices of the global SIs. European-based specialists, Murdio included, are not eligible for this track.
