We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Compass IT Compliance, LLC review

Advisory firm

A US security and compliance consultancy that prepares organisations for SOC 2, PCI DSS and CMMC, with SOC reports issued by an affiliated CPA firm.

Relevant if you want help preparing for SOC 2, PCI DSS or CMMC from named practice leads

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Compass IT Compliance scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 3/5
Qualifications of the people who do the work 4/5
What it publishes about fees 2/5
Knowledge of your sector 3/5
Independence from what it sells 3/5
Who carries the risk if the advice is wrong 2/5

What Compass IT Compliance offers, and what it publishes

You get readiness work for SOC 2, PCI DSS and CMMC, plus a virtual CISO service and an AI governance service. It says it holds PCI DSS Qualified Security Assessor and CMMC Registered Provider Organization status. It names its practice leads, Jeffrey Torrance and Kelly O'Brien, and says it has served 1,000+ clients since 2010.

Compass IT Compliance does not publish a price for SOC 2 or ISO readiness work; the SOC page leads to a 'Get a Quote' form. Only its virtual CISO page gives a rough range. It does not publish professional indemnity insurance or named client results.

For Compass IT Compliance clients, SOC reports come from its affiliate, Compass Assurance Team, a separate AICPA-accredited CPA firm. So the adviser that prepares you and the firm that issues the report are linked. It sells AI governance advice but does not say how it uses AI itself, or how AI tools handle client data.

Strengths

  • Structurally separates readiness consulting from attestation: SOC reports are issued by Compass Assurance Team, its own AICPA-accredited CPA affiliate, rather than the readiness advisor self-attesting.
  • Holds firm-level PCI DSS QSA and CMMC RPO accreditation and has traded since November 2010 (14+ years), serving 1,000+ clients across nine named sectors.
  • Names actual practice leads with dedicated service pages: Jeffrey Torrance (SVP of Virtual CISO) and Kelly O'Brien (SVP of Risk & Compliance), spanning SOC, ISO 27002, HIPAA, NIST, GLBA, CJIS and GDPR.
  • Founder-led continuity: co-founders Jerry Hughes and William DePalma remain in leadership 14+ years after founding, per the company's own 10-year anniversary press material.

Things to check

  • Compass IT Compliance prepares clients for SOC 2 readiness and then routes the actual attestation to its own affiliate, Compass Assurance Team, rather than an unaffiliated CPA firm, narrowing the arm's-length gap between readiness advisor and attestor.
  • Compass IT Compliance sells an AI Governance advisory service but discloses nothing about its own AI tool use or how client data is handled by any AI tooling in its own service delivery.
  • No public pricing or rate card exists for SOC 2/ISO readiness work; the SOC service page routes all inquiries to a 'Get a Quote' contact form with no indicative figures, unlike the vCISO page which gives a rough range.

Common questions

Does it publish prices for SOC 2 or ISO readiness?

No. On 20 September 2026 its SOC page led to a 'Get a Quote' form with no rate card or price range. Only its virtual CISO page gives a rough percentage-and-dollar range.

Who issues its SOC 2 reports?

Its affiliate. Compass Assurance Team, a separate AICPA-accredited CPA firm affiliated with Compass IT Compliance, issues the report. Compass IT Compliance does the readiness and gap-assessment work.

Does it hold any accreditations?

Yes, by its own account. Its certifications page lists firm-level PCI DSS Qualified Security Assessor status and CMMC Registered Provider Organization status.

Does it say how it uses AI itself?

No. Its AI Governance page and site footer carry no statement on its own AI use or data handling, though it sells AI governance advice.

Evidence for each Compass IT Compliance score

Show our working

Notes behind each thing to check

  • Compass IT Compliance prepares clients for SOC 2 readiness and then routes the actual attestation to its own affiliate, Compass Assurance Team, rather than an unaffiliated CPA firm, narrowing the arm's-length gap between readiness advisor and attestor. (The assurance-team page states Compass Assurance Team is 'an affiliate of Compass IT Compliance' that performs SOC attestation for clients it also readies.)
  • Compass IT Compliance sells an AI Governance advisory service but discloses nothing about its own AI tool use or how client data is handled by any AI tooling in its own service delivery. (The AI Governance service page and site footer contain no AI-use or data-handling disclosure statement of any kind.)
  • No public pricing or rate card exists for SOC 2/ISO readiness work; the SOC service page routes all inquiries to a 'Get a Quote' contact form with no indicative figures, unlike the vCISO page which gives a rough range. (SOC service page requests a quote via contact form and publishes no rate card or price range for readiness work.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 3/5 No adverse litigation, enforcement action, or client data-breach was found in sources checked; the firm advertises incident-response planning but publishes no named case of defending a client through an actual regulatory incident.
Qualifications of the people who do the work 4/5 Firm holds PCI DSS QSA and CMMC RPO accreditation, runs a dedicated AICPA-accredited CPA affiliate for SOC attestation, and has operated since 2010 serving 1,000+ clients.
What it publishes about fees 2/5 SOC 2/ISO readiness pricing is quote-only with no published rate card; only the separate vCISO page gives a rough percentage-and-dollar-range estimate.
Knowledge of your sector 3/5 Serves nine named sectors from financial services to government with dedicated industry pages, a broad generalist spread rather than one named vertical specialism.
Independence from what it sells 3/5 Not a software-license upsell funnel, but SOC attestation is referred in-house to its own AICPA affiliate rather than an unaffiliated CPA firm, narrowing independence.
Who carries the risk if the advice is wrong 2/5 No professional-indemnity insurance disclosure, engagement guarantee, or warranty language was found on any service page reviewed this session.

Sources for Compass IT Compliance

  • Compass IT Compliance LLC is an active Rhode Island domestic limited liability company registered at 2 Asylum Road, North Providence, RI 02904, agent William DePalma (Active; company no. 000557826) (opencorporates.com, checked 20 September 2026)
  • The firm was founded 15 November 2010 by Jerry Hughes and William DePalma and is headquartered in North Providence, Rhode Island (Founded 15 Nov 2010) (compassitc.com, checked 20 September 2026)
  • Compass IT Compliance holds firm-level PCI DSS Qualified Security Assessor (QSA) status and CMMC Registered Provider Organization (RPO) status (QSA + CMMC RPO) (compassitc.com, checked 20 September 2026)
  • SOC 1/2/3 attestation is carried out by Compass Assurance Team, a separate AICPA-accredited CPA firm affiliated with Compass IT Compliance; Compass IT Compliance itself performs the readiness and gap-assessment work (Affiliate CPA firm does attestation) (compassitc.com, checked 20 September 2026)
  • Jeffrey Torrance holds the title SVP of Virtual CISO and Kelly O'Brien holds the title SVP of Risk & Compliance at Compass IT Compliance (Named vCISO and Risk/Compliance practice leads) (compassitc.com, checked 20 September 2026)

PCI DSS Qualified Security Assessor (QSA), firm-level accreditation (compassitc.com/company/certifications, checked 2026-09-20) CMMC Registered Provider Organization (RPO), firm-level accreditation (compassitc.com/company/certifications, checked 2026-09-20)

Seeking ISO 42001 certificationRegulated sectorsFirst DPO or AI policy

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.