# Compass IT Compliance, LLC - **Type:** Advisory firm - **Website:** https://www.compassitc.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US security and compliance consultancy that prepares organisations for SOC 2, PCI DSS and CMMC, with SOC reports issued by an affiliated CPA firm. ## Compass IT Compliance scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 No adverse litigation, enforcement action, or client data-breach was found in sources checked; the firm advertises incident-response planning but publishes no named case of defending a client through an actual regulatory incident. ### Qualifications of the people who do the work: 4/5 Firm holds PCI DSS QSA and CMMC RPO accreditation, runs a dedicated AICPA-accredited CPA affiliate for SOC attestation, and has operated since 2010 serving 1,000+ clients. ### What it publishes about fees: 2/5 SOC 2/ISO readiness pricing is quote-only with no published rate card; only the separate vCISO page gives a rough percentage-and-dollar-range estimate. ### Knowledge of your sector: 3/5 Serves nine named sectors from financial services to government with dedicated industry pages, a broad generalist spread rather than one named vertical specialism. ### Independence from what it sells: 3/5 Not a software-license upsell funnel, but SOC attestation is referred in-house to its own AICPA affiliate rather than an unaffiliated CPA firm, narrowing independence. ### Who carries the risk if the advice is wrong: 2/5 No professional-indemnity insurance disclosure, engagement guarantee, or warranty language was found on any service page reviewed this session. ## Sources for Compass IT Compliance Every line carries the page it was read on and the date it was checked. - Compass IT Compliance LLC is an active Rhode Island domestic limited liability company registered at 2 Asylum Road, North Providence, RI 02904, agent William DePalma - Source: https://opencorporates.com/companies/us_ri/000557826 - Checked: 2026-09-20 - The firm was founded 15 November 2010 by Jerry Hughes and William DePalma and is headquartered in North Providence, Rhode Island - Source: https://www.compassitc.com/company/press/10-year-anniversary - Checked: 2026-09-20 - Compass IT Compliance holds firm-level PCI DSS Qualified Security Assessor (QSA) status and CMMC Registered Provider Organization (RPO) status - Source: https://www.compassitc.com/company/certifications - Checked: 2026-09-20 - SOC 1/2/3 attestation is carried out by Compass Assurance Team, a separate AICPA-accredited CPA firm affiliated with Compass IT Compliance; Compass IT Compliance itself performs the readiness and gap-assessment work - Source: https://www.compassitc.com/assurance-team - Checked: 2026-09-20 - Jeffrey Torrance holds the title SVP of Virtual CISO and Kelly O'Brien holds the title SVP of Risk & Compliance at Compass IT Compliance - Source: https://www.compassitc.com/company/team - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Published - Client results: Not published - How it uses AI: Not published ## Strengths - Structurally separates readiness consulting from attestation: SOC reports are issued by Compass Assurance Team, its own AICPA-accredited CPA affiliate, rather than the readiness advisor self-attesting. - Holds firm-level PCI DSS QSA and CMMC RPO accreditation and has traded since November 2010 (14+ years), serving 1,000+ clients across nine named sectors. - Names actual practice leads with dedicated service pages: Jeffrey Torrance (SVP of Virtual CISO) and Kelly O'Brien (SVP of Risk & Compliance), spanning SOC, ISO 27002, HIPAA, NIST, GLBA, CJIS and GDPR. - Founder-led continuity: co-founders Jerry Hughes and William DePalma remain in leadership 14+ years after founding, per the company's own 10-year anniversary press material. ## Things to check Each one carries the factual basis it rests on. - Compass IT Compliance prepares clients for SOC 2 readiness and then routes the actual attestation to its own affiliate, Compass Assurance Team, rather than an unaffiliated CPA firm, narrowing the arm's-length gap between readiness advisor and attestor. - Basis: The assurance-team page states Compass Assurance Team is 'an affiliate of Compass IT Compliance' that performs SOC attestation for clients it also readies. - Compass IT Compliance sells an AI Governance advisory service but discloses nothing about its own AI tool use or how client data is handled by any AI tooling in its own service delivery. - Basis: The AI Governance service page and site footer contain no AI-use or data-handling disclosure statement of any kind. - No public pricing or rate card exists for SOC 2/ISO readiness work; the SOC service page routes all inquiries to a 'Get a Quote' contact form with no indicative figures, unlike the vCISO page which gives a rough range. - Basis: SOC service page requests a quote via contact form and publishes no rate card or price range for readiness work. ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.