Compass IT Compliance Auditor Profile
Compass IT Compliance is a Northeast-based compliance firm specializing in PCI DSS, SOC 2, HITRUST, and HIPAA assessments. Combines compliance auditing with penetration testing and vulnerability management services.
Founded in 2010 in Providence, Rhode Island, Compass IT Compliance serves financial institutions, healthcare organizations, and retailers across New England and nationwide. Their dual capability in both compliance assessment and technical security testing provides clients with comprehensive coverage that addresses both regulatory requirements and real-world security posture.
What Compass IT Compliance Does Well
- PCI QSA + HITRUST assessor — Dual qualification serves companies needing both payment and healthcare security compliance.
- Penetration testing integration — Technical security testing alongside compliance for comprehensive coverage.
- Northeast focus — Strong relationships with New England financial institutions and healthcare organizations.
Engagement Process
- Initial scoping to identify applicable frameworks and assessment boundaries.
- Pre-assessment gap analysis with prioritized remediation recommendations.
- Technical security testing including penetration testing and vulnerability scanning.
- Formal compliance assessment with control testing and evidence review.
- Report delivery with combined compliance and technical security findings.
Pricing Expectations
Compass IT Compliance offers accessible pricing particularly for PCI DSS and HIPAA assessments. PCI DSS assessments start around $15,000, SOC 2 Type II from $20,000, HITRUST validated assessments from $30,000, and HIPAA assessments from $12,000. Their integrated approach combining compliance with penetration testing may deliver cost savings versus engaging separate firms.
Who Should Choose Compass IT Compliance
Compass IT Compliance is a strong choice for New England-based financial institutions, healthcare organizations, and retailers that need PCI DSS, HIPAA, or HITRUST assessments combined with technical security testing. Their dual compliance-and-security approach is particularly valuable for organizations that want comprehensive coverage from a single provider.