# CBIZ Pivot Point Security - **Type:** Advisory firm - **Website:** https://www.pivotpointsecurity.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US security and compliance adviser, part of CBIZ since June 2023, preparing firms for ISO 27001, SOC 2, US HIPAA and HITRUST, with a virtual CISO service. ## CBIZ Pivot Point Security scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 One anonymized case study cites ongoing outsourced incident-response and SIEM SME work, but no named regulatory action, breach, or enforcement outcome is disclosed publicly. ### Qualifications of the people who do the work: 4/5 Named GRC lead Rich Stever is credited site-wide with supporting 100+ ISO 27001 certifications plus SOC 2, HIPAA and HITRUST engagements over a multi-year career. ### What it publishes about fees: 4/5 The vCISO service page publishes explicit retainer bands of $4,000 to $30,000+ per month, an unusually direct pricing disclosure for this market segment. ### Knowledge of your sector: 4/5 Published case studies cover energy, financial services, government, healthcare, legal and technology sectors, plus a NIST AI RMF-aligned AI governance advisory line. ### Independence from what it sells: 3/5 CBIZ, Inc.'s 10-K states it is legally barred from performing attest work itself, but Pivot Point Security sits inside a large multi-service group with affiliated CPA firms that could receive referred attestation work. ### Who carries the risk if the advice is wrong: 3/5 The vCISO page offers a satisfaction guarantee with fee adjustment for missed outcomes, but no professional liability insurance level is disclosed on the public site. ## Sources for CBIZ Pivot Point Security Every line carries the page it was read on and the date it was checked. - CBIZ, Inc. acquired information security firm Pivot Point Security, effective June 1, 2023 (announced June 5, 2023). - Source: https://www.pivotpointsecurity.com/pressrelease/cbiz-acquires-information-security-firm-pivot-point-security/ - Checked: 2026-09-20 - Pivot Point Security's Virtual CISO (vCISO) service is priced on a retainer/scope basis, published as roughly $4,000 to $30,000+ per month. - Source: https://www.pivotpointsecurity.com/services/virtual-ciso/ - Checked: 2026-09-20 - Named GRC Practice Lead Rich Stever is credited with leading support for 100+ ISO 27001 certifications plus SOC 2, HIPAA and HITRUST engagements. - Source: https://www.pivotpointsecurity.com/company/meet-the-team/ - Checked: 2026-09-20 - Parent CBIZ, Inc. is a Delaware corporation (NYSE: CBZ, CIK 0000944148) that states in its 10-K it is barred from performing attest/audit services directly; those are performed only by separately owned, independently licensed CPA firms under administrative service agreements. - Source: https://www.sec.gov/Archives/edgar/data/944148/000162828025008893/cbz-20241231.htm - Checked: 2026-09-20 - Pivot Point Security was founded in 2001 and is headquartered in Hamilton, New Jersey, with staff spread across roughly 14 additional US cities. - Source: https://www.pivotpointsecurity.com/company/locations/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Not published ## Strengths - A long-established, security/GRC-focused practice (founded 2001, ~30 staff and $6.6M revenue at the 2023 acquisition) now backed by a large, financially stable, NYSE-listed parent (CBIZ, Inc.). - Named, credentialed practice leadership: GRC lead Rich Stever is credited with supporting 100+ ISO 27001 certifications plus SOC 2, HIPAA and HITRUST work, and CEO John Verry hosts the long-running 'Virtual CISO Podcast'. - Unusually transparent vCISO pricing, published retainer bands ($4K-$30K+/month), where most competitors disclose no fee information at all. - National coverage (roughly 15 US office locations) with published case studies spanning energy, finance, government, healthcare, legal and technology sectors relevant to the US tranche's HIPAA and sector-specialism scope. - A dedicated AI governance and advisory line (AI risk management, AI ethics consulting, governance frameworks) explicitly aligned to NIST AI RMF and ISO 42001, matching the in-scope US regime list. ## Things to check Each one carries the factual basis it rests on. - Pivot Point Security has no confirmed standalone legal registration of its own: an OpenCorporates search for the name returned zero matching companies, and it does not appear in CBIZ's own FY2024 SEC Exhibit 21 subsidiary list. - Basis: OpenCorporates company search for 'Pivot Point Security' (New Jersey jurisdiction) returned 'Found 0 companies'; CBIZ, Inc.'s FY2024 10-K Exhibit 21 subsidiary list (filed 2025-02-28) does not list an entity of that name. - Published case studies are fully anonymized, so claimed outcomes cannot be checked against a named, verifiable client. - Basis: The technology-sector case study on pivotpointsecurity.com names no client company, referring only to an unnamed 'CTO of a SAAS vendor' called 'Rajeev'. - The firm discloses no information about its own AI tool use or where client data goes when AI is used in service delivery, despite actively marketing AI governance advisory services to clients. - Basis: The AI Governance and Advisory Service page markets NIST AI RMF and ISO 42001-aligned client work but contains no internal AI-use or data-handling disclosure of its own. - No professional liability or errors-and-omissions insurance level is disclosed anywhere on the public-facing site pages reviewed. - Basis: Company, vCISO and case-study pages reviewed contain no professional liability insurance figure or policy statement. ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.