We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

CBIZ Pivot Point Security review

Advisory firm

A US security and compliance adviser, part of CBIZ since June 2023, preparing firms for ISO 27001, SOC 2, US HIPAA and HITRUST, with a virtual CISO service.

Relevant if you want an outsourced security chief with published monthly prices, or help towards ISO 27001

Price Published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

CBIZ Pivot Point Security scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 4/5
What it publishes about fees 4/5
Knowledge of your sector 4/5
Independence from what it sells 3/5
Who carries the risk if the advice is wrong 3/5

What CBIZ Pivot Point Security offers, and what it publishes

You get a New Jersey practice that prepares organisations for ISO 27001, SOC 2, US HIPAA and HITRUST, and sells virtual CISO retainers. Its team page credits its practice lead, Rich Stever, with supporting more than 100 ISO 27001 certifications. It also runs an AI governance service aligned to the US NIST AI RMF and ISO 42001.

CBIZ Pivot Point Security publishes its virtual CISO prices: retainers of roughly $4,000 to $30,000 or more a month. It does not publish its professional liability insurance. Its case studies name no clients. It does not say how it uses AI in its own work, though it sells AI governance advice.

NYSE-listed CBIZ, Inc. bought the firm effective 1 June 2023. We could not confirm a separate legal registration for Pivot Point Security: OpenCorporates found no New Jersey match, and it is not in CBIZ's 2024 subsidiary list. Ask which company signs your contract. CBIZ says it is barred from doing audit work itself; separately owned CPA firms do it.

Strengths

  • A long-established, security/GRC-focused practice (founded 2001, ~30 staff and $6.6M revenue at the 2023 acquisition) now backed by a large, financially stable, NYSE-listed parent (CBIZ, Inc.).
  • Named, credentialed practice leadership: GRC lead Rich Stever is credited with supporting 100+ ISO 27001 certifications plus SOC 2, HIPAA and HITRUST work, and CEO John Verry hosts the long-running 'Virtual CISO Podcast'.
  • Unusually transparent vCISO pricing, published retainer bands ($4K-$30K+/month), where most competitors disclose no fee information at all.
  • National coverage (roughly 15 US office locations) with published case studies spanning energy, finance, government, healthcare, legal and technology sectors relevant to the US tranche's HIPAA and sector-specialism scope.
  • A dedicated AI governance and advisory line (AI risk management, AI ethics consulting, governance frameworks) explicitly aligned to NIST AI RMF and ISO 42001, matching the in-scope US regime list.

Things to check

  • Pivot Point Security has no confirmed standalone legal registration of its own: an OpenCorporates search for the name returned zero matching companies, and it does not appear in CBIZ's own FY2024 SEC Exhibit 21 subsidiary list.
  • Published case studies are fully anonymized, so claimed outcomes cannot be checked against a named, verifiable client.
  • The firm discloses no information about its own AI tool use or where client data goes when AI is used in service delivery, despite actively marketing AI governance advisory services to clients.
  • No professional liability or errors-and-omissions insurance level is disclosed anywhere on the public-facing site pages reviewed.

Common questions

Does the firm publish its fees?

Yes, for its virtual CISO service: retainers of roughly $4,000 to $30,000 or more a month. The same page says it will adjust its fee for missed outcomes.

Is Pivot Point Security a company in its own right?

Not that we could confirm. OpenCorporates lists no New Jersey company by that name, and it is not in CBIZ, Inc.'s 2024 subsidiary list filed with the US SEC. Ask the firm which legal entity signs your engagement.

Who leads its certification work?

Rich Stever, who leads its governance, risk and compliance practice. The firm's team page credits him with supporting more than 100 ISO 27001 certifications, plus SOC 2, US HIPAA and HITRUST work.

Does it say how it uses AI itself?

No. Its AI governance page sells work aligned to the US NIST AI RMF and ISO 42001, but says nothing about its own AI use or where client data goes.

Evidence for each CBIZ Pivot Point Security score

Show our working

Notes behind each thing to check

  • Pivot Point Security has no confirmed standalone legal registration of its own: an OpenCorporates search for the name returned zero matching companies, and it does not appear in CBIZ's own FY2024 SEC Exhibit 21 subsidiary list. (OpenCorporates company search for 'Pivot Point Security' (New Jersey jurisdiction) returned 'Found 0 companies'; CBIZ, Inc.'s FY2024 10-K Exhibit 21 subsidiary list (filed 2025-02-28) does not list an entity of that name.)
  • Published case studies are fully anonymized, so claimed outcomes cannot be checked against a named, verifiable client. (The technology-sector case study on pivotpointsecurity.com names no client company, referring only to an unnamed 'CTO of a SAAS vendor' called 'Rajeev'.)
  • The firm discloses no information about its own AI tool use or where client data goes when AI is used in service delivery, despite actively marketing AI governance advisory services to clients. (The AI Governance and Advisory Service page markets NIST AI RMF and ISO 42001-aligned client work but contains no internal AI-use or data-handling disclosure of its own.)
  • No professional liability or errors-and-omissions insurance level is disclosed anywhere on the public-facing site pages reviewed. (Company, vCISO and case-study pages reviewed contain no professional liability insurance figure or policy statement.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 One anonymized case study cites ongoing outsourced incident-response and SIEM SME work, but no named regulatory action, breach, or enforcement outcome is disclosed publicly.
Qualifications of the people who do the work 4/5 Named GRC lead Rich Stever is credited site-wide with supporting 100+ ISO 27001 certifications plus SOC 2, HIPAA and HITRUST engagements over a multi-year career.
What it publishes about fees 4/5 The vCISO service page publishes explicit retainer bands of $4,000 to $30,000+ per month, an unusually direct pricing disclosure for this market segment.
Knowledge of your sector 4/5 Published case studies cover energy, financial services, government, healthcare, legal and technology sectors, plus a NIST AI RMF-aligned AI governance advisory line.
Independence from what it sells 3/5 CBIZ, Inc.'s 10-K states it is legally barred from performing attest work itself, but Pivot Point Security sits inside a large multi-service group with affiliated CPA firms that could receive referred attestation work.
Who carries the risk if the advice is wrong 3/5 The vCISO page offers a satisfaction guarantee with fee adjustment for missed outcomes, but no professional liability insurance level is disclosed on the public site.

Sources for CBIZ Pivot Point Security

  • CBIZ, Inc. acquired information security firm Pivot Point Security, effective June 1, 2023 (announced June 5, 2023). (Acquired June 1, 2023) (pivotpointsecurity.com, checked 20 September 2026)
  • Pivot Point Security's Virtual CISO (vCISO) service is priced on a retainer/scope basis, published as roughly $4,000 to $30,000+ per month. ($4K-$30K+/month retainer) (pivotpointsecurity.com, checked 20 September 2026)
  • Named GRC Practice Lead Rich Stever is credited with leading support for 100+ ISO 27001 certifications plus SOC 2, HIPAA and HITRUST engagements. (100+ ISO 27001 certifications supported) (pivotpointsecurity.com, checked 20 September 2026)
  • Parent CBIZ, Inc. is a Delaware corporation (NYSE: CBZ, CIK 0000944148) that states in its 10-K it is barred from performing attest/audit services directly; those are performed only by separately owned, independently licensed CPA firms under administrative service agreements. (CBIZ, Inc. does not itself perform attest services) (sec.gov, checked 20 September 2026)
  • Pivot Point Security was founded in 2001 and is headquartered in Hamilton, New Jersey, with staff spread across roughly 14 additional US cities. (Founded 2001; HQ Hamilton, NJ) (pivotpointsecurity.com, checked 20 September 2026)

Seeking ISO 42001 certificationRegulated sectorsFirst DPO or AI policy

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.