How we vet readiness partners

This page is the standard. Every “Vetted readiness partner” badge on this site links here, and everything the badge asserts is defined here. A directory listing asserts none of this: listings are compiled facts from public sources, no firm pays to appear, and nothing is ranked.

What the badge asserts. The firm accepted our referral terms, the operator completed and dated its vetting call, every check below passed, and its signed track is readiness: readiness, vCISO, or penetration-testing consultancy work.

What we verify, before any badge renders:

• Current professional liability insurance, confirmed by certificate.
• A named practitioner. The person who will do your work, by name, before any introduction.
• A documented client engagement, with a named client contact and a standing right to call that contact.
• Scope and fee in writing. The firm puts what it will do and what it will cost on paper before work starts.
• Full disclosure of platform commissions and reseller arrangements. Readiness firms often earn commissions for platform referrals. That can be legitimate, but it must be disclosed to us in full, because you cannot weigh advice without knowing who pays for it.

Absolute disqualifiers. Any one of these ends the conversation:

• Claiming or implying it can perform the audit. A readiness firm prepares you for an audit; it cannot sign one. If the firm is a licensed CPA firm, the auditor standard and its independence rule apply instead: it cannot prepare your controls and sign your opinion.
• Refusing to disclose platform commissions or reseller arrangements.
• Refusing to name the practitioner.
• No professional liability insurance.
• Refusing to put scope and fee in writing.

What vetting is not. We do not audit a firm’s work product. We do not assess engagement quality. We do not guarantee the outcome of your subsequent audit. Vetting verifies that a firm is what it says it is and commits to the practices above; it is not an endorsement of any particular engagement, and we will not pretend otherwise.

If a check lapses, the badge is removed and the firm reverts to a plain listing. We never display an expired or negative status. The absence of a badge is not an accusation. Checks are re-verified at least annually and whenever an underlying credential expires.

Corrections. Any firm, vetted or listed, can request a correction to its compiled facts at hello@grcmigrate.com. We review correction requests within two business days, and every published fact stays traceable to its source.

The response standard. Introductions to vetted partners are time-sensitive: no response within one business day is a pass, and the lead may be routed elsewhere.

Where the money is. No firm pays to be listed. Vetted partners pay a flat referral fee only when they accept an introduction, and nothing else, ever. An introduction from a platform partner team earns a conversation, never a badge, a listing, or a referred buyer. No platform participates in vetting, listing, or lead routing, and no platform is compensated.

The principles behind every standard on this site are published in one place, at grcmigrate.com/principles.