We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

vCISO Services, LLC review

Advisory firm

A US firm offering a subscription virtual CISO, an outsourced head of security, for SOC 2, ISO 27001, PCI DSS and CMMC readiness, plus ISO 42001 AI work.

Relevant if you are a smaller US business preparing for SOC 2, ISO 27001 or CMMC audits

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

vCISO Services scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 2/5
What it publishes about fees 2/5
Knowledge of your sector 3/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 2/5

What vCISO Services offers, and what it publishes

You get an outsourced security lead on a subscription, preparing you for SOC 2, ISO 27001, PCI DSS or CMMC audits. It publishes six dated case studies; one says a wealth-management software client of about 25 staff passed SOC 2 Type 1 and Type 2 with no exceptions at the first attempt.

vCISO Services does not publish a price. It names seven subscription tiers, from Virtual ISO to Diamond, but a sales call is needed for a quote. It names no individual staff certifications, such as CISSP or CISM, only memberships of ISC2, ISSA and InfraGard. It discloses no professional indemnity insurance.

Greg Schaffer, a former CISO, founded it in 2017. It says it only advises, and sets up tools the client owns, such as eramba, rather than selling its own software. It says its readiness work is for internal use, not an outside attestation. Its AI line uses ISO/IEC 42001:2023; the firm says nothing about its own AI use.

Strengths

  • Named founder (Greg Schaffer, President) running a dedicated, veteran-owned vCISO practice continuously since 2017.
  • Six published, dated case studies with concrete outcomes (SOC 2 Type 1/2, PCI-DSS SAQ-D, CMMC L2, NIST-CSF/GRC work), not just marketing claims.
  • Runs a distinct ISO/IEC 42001:2023-based AI-governance service line (Virtual Chief AI Officer) alongside core SOC 2/ISO readiness work.
  • States explicit positioning as second-line-of-defense advisory only, distinct from a diversified MSSP service portfolio.

Things to check

  • No pricing is published for any of the firm's seven subscription tiers (Virtual ISO through Diamond).
  • No individual staff certifications (e.g. CISSP, CISM, CISA, ISO 27001 Lead Auditor) are named anywhere on the site.
  • No professional-indemnity or errors-and-omissions insurance coverage is disclosed on the site.

Common questions

Does vCISO Services publish its prices?

No. It names seven subscription tiers, from Virtual ISO to Diamond, but publishes no fees or minimums for any of them. You need a sales call for a quote.

Does vCISO Services name its staff's certifications?

No. Its about and founder pages cite membership of ISC2, ISSA and InfraGard, but name no individual certifications such as CISSP, CISM, CISA or ISO 27001 Lead Auditor.

Does vCISO Services offer AI governance?

Yes. Its Virtual Chief AI Officer service covers AI management-system development, risk assessment and policy design, built on ISO/IEC 42001:2023. The firm says nothing about its own use of AI tools.

Is vCISO Services a registered company?

Yes. OpenCorporates lists VCISO SERVICES, LLC as an active Tennessee LLC, with a head office matching the firm's own address.

Evidence for each vCISO Services score

Show our working

Notes behind each thing to check

  • No pricing is published for any of the firm's seven subscription tiers (Virtual ISO through Diamond). (The vciso-subscription-services pages name each tier but show no fee ranges or minimums; pricing requires a sales call.)
  • No individual staff certifications (e.g. CISSP, CISM, CISA, ISO 27001 Lead Auditor) are named anywhere on the site. (About and founder pages cite membership in ISC2, ISSA and InfraGard but list no named individual credentials.)
  • No professional-indemnity or errors-and-omissions insurance coverage is disclosed on the site. (The privacy policy and about pages contain no insurance or liability-coverage statement of any kind.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 Case studies show clean SOC 2, PCI-DSS and CMMC readiness outcomes, but no disclosed breach response or regulatory-enforcement defense experience is published.
Qualifications of the people who do the work 2/5 Team is described as members of ISC2, ISSA and InfraGard, but no individual certifications such as CISSP or CISM are named on the site.
What it publishes about fees 2/5 Seven subscription tiers are named on the site but no prices are published; a sales call is required to get a quote.
Knowledge of your sector 3/5 Six public case studies span healthcare RCM, fintech SaaS, manufacturing, education and a credit union, showing broad SMB generalist reach rather than one deep specialism.
Independence from what it sells 4/5 States it works only as second-line-of-defense advisory, unlike a diversified MSSP, and implements client-owned GRC tools such as eramba rather than reselling its own software.
Who carries the risk if the advice is wrong 2/5 No professional-indemnity insurance is disclosed, and the firm states its readiness work is for internal client use, not a third-party attestation.

Sources for vCISO Services

  • vCISO Services, LLC is headquartered at 840 Crescent Centre Drive, Suite 600, Franklin, Tennessee 37067. (840 Crescent Centre Dr Ste 600, Franklin, TN 37067) (vcisoservices.com, checked 20 September 2026)
  • OpenCorporates lists VCISO SERVICES, LLC as an active Tennessee LLC, company number 000915360, head office matching the firm's own website address. (Status: Active; Company No. 000915360) (opencorporates.com, checked 20 September 2026)
  • Founder Greg Schaffer launched vCISO Services in 2017 after leaving a full-time CISO role, citing the Equifax breach as motivation. (Founded 2017 by Greg Schaffer (President)) (vcisoservices.com, checked 20 September 2026)
  • A published case study describes a SaaS wealth-management client (~25 employees) passing both SOC 2 Type 1 and Type 2 audits with no exceptions on the first attempt after the firm's gap analysis and remediation work. (SOC 2 Type 1 & Type 2 passed, zero exceptions) (vcisoservices.com, checked 20 September 2026)

Seeking ISO 42001 certificationFirst DPO or AI policyRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.