# vCISO Services, LLC - **Type:** Advisory firm - **Website:** https://vcisoservices.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US firm offering a subscription virtual CISO, an outsourced head of security, for SOC 2, ISO 27001, PCI DSS and CMMC readiness, plus ISO 42001 AI work. ## vCISO Services scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 Case studies show clean SOC 2, PCI-DSS and CMMC readiness outcomes, but no disclosed breach response or regulatory-enforcement defense experience is published. ### Qualifications of the people who do the work: 2/5 Team is described as members of ISC2, ISSA and InfraGard, but no individual certifications such as CISSP or CISM are named on the site. ### What it publishes about fees: 2/5 Seven subscription tiers are named on the site but no prices are published; a sales call is required to get a quote. ### Knowledge of your sector: 3/5 Six public case studies span healthcare RCM, fintech SaaS, manufacturing, education and a credit union, showing broad SMB generalist reach rather than one deep specialism. ### Independence from what it sells: 4/5 States it works only as second-line-of-defense advisory, unlike a diversified MSSP, and implements client-owned GRC tools such as eramba rather than reselling its own software. ### Who carries the risk if the advice is wrong: 2/5 No professional-indemnity insurance is disclosed, and the firm states its readiness work is for internal client use, not a third-party attestation. ## Sources for vCISO Services Every line carries the page it was read on and the date it was checked. - vCISO Services, LLC is headquartered at 840 Crescent Centre Drive, Suite 600, Franklin, Tennessee 37067. - Source: https://vcisoservices.com/about/ - Checked: 2026-09-20 - OpenCorporates lists VCISO SERVICES, LLC as an active Tennessee LLC, company number 000915360, head office matching the firm's own website address. - Source: https://opencorporates.com/companies/us_tn/000915360 - Checked: 2026-09-20 - Founder Greg Schaffer launched vCISO Services in 2017 after leaving a full-time CISO role, citing the Equifax breach as motivation. - Source: https://vcisoservices.com/from-the-founder/ - Checked: 2026-09-20 - A published case study describes a SaaS wealth-management client (~25 employees) passing both SOC 2 Type 1 and Type 2 audits with no exceptions on the first attempt after the firm's gap analysis and remediation work. - Source: https://vcisoservices.com/case-studies/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Not published - Client results: Published - How it uses AI: Not published ## Strengths - Named founder (Greg Schaffer, President) running a dedicated, veteran-owned vCISO practice continuously since 2017. - Six published, dated case studies with concrete outcomes (SOC 2 Type 1/2, PCI-DSS SAQ-D, CMMC L2, NIST-CSF/GRC work), not just marketing claims. - Runs a distinct ISO/IEC 42001:2023-based AI-governance service line (Virtual Chief AI Officer) alongside core SOC 2/ISO readiness work. - States explicit positioning as second-line-of-defense advisory only, distinct from a diversified MSSP service portfolio. ## Things to check Each one carries the factual basis it rests on. - No pricing is published for any of the firm's seven subscription tiers (Virtual ISO through Diamond). - Basis: The vciso-subscription-services pages name each tier but show no fee ranges or minimums; pricing requires a sales call. - No individual staff certifications (e.g. CISSP, CISM, CISA, ISO 27001 Lead Auditor) are named anywhere on the site. - Basis: About and founder pages cite membership in ISC2, ISSA and InfraGard but list no named individual credentials. - No professional-indemnity or errors-and-omissions insurance coverage is disclosed on the site. - Basis: The privacy policy and about pages contain no insurance or liability-coverage statement of any kind. ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.