Compass IT Compliance

Compass IT Compliance is a national IT security and compliance consulting firm that helps regulated small and mid-sized organizations protect their data, meet their compliance obligations, and build security programs that hold up over time. Founded in 2010 and headquartered in North Providence, Rhode Island, Compass works as an extension of each client’s internal team rather than a distant outside vendor.

Our services include virtual CISO (vCISO) leadership, penetration testing, SOC 2 auditing, PCI DSS compliance, CMMC readiness, IT risk assessments and audits, incident response planning and tabletop exercises, and AI governance. Clients get the expertise of a full security team without the cost and overhead of building one in-house.

What sets Compass apart is a human-led approach. Our penetration testers manually work each environment instead of handing over an automated scan report, and our audits are built to be supportive rather than adversarial. Every engagement is scoped to the client’s size, industry, and risk level, so the work fits the business instead of forcing one framework onto everyone.

Our managing partners stay closely involved, and clients can reach senior leadership directly. Roughly half of our team are military veterans, bringing a mission-first mindset to how we plan, communicate, and follow through.

Organizations across higher education, financial services, healthcare, retail, technology, and manufacturing rely on Compass to make security and compliance a repeatable, well-run part of the business, and we aim to build their capability over time so they need less hand-holding as their programs mature.