// One roster, four kinds of work
What kind of lead would you receive?
GRC Migrate matches on four kinds of work: audit, vCISO and advisory, implementation and readiness, and penetration testing. Front is the fit; turn a card for the shape of a lead in that lane. The mix is directional, not a promise of volume: we are early, and we would rather say so than quote a number we can’t stand behind.
Attestation
Audit firms
SOC 2 and ISO 27001 attestation for buyers who already know their scope.
A lead in your lane usually looks like
- A SaaS company that used our tools to map its own scope and now needs an independent attestation.
- Framework, scope, and timeline captured on a qualification call.
- Consent to the introduction confirmed before you see it.
- Delivered as a written brief, not a cold name.
Advisory
vCISO and advisory
Fractional security leadership for teams standing up or running a program.
A lead in your lane usually looks like
- A first-time buyer under deal pressure who needs someone to own the program.
- The trigger, stakeholders, and stakes captured before the brief.
- A right-sized engagement, with the retainer conversation naturally after.
- Exclusive to you: one lead, one firm, routed on fit.
Readiness
Implementation and readiness
Platform implementation, evidence, and audit-readiness work.
A lead in your lane usually looks like
- A stalled implementation: bought the platform, never got audit-ready.
- Or a platform switch that needs a clean finish line.
- Quantified scope from the buyer’s own assessment where we have it.
- Priceable before your first call.
Offensive
Penetration testing
Pen tests that satisfy a framework or a customer’s security review.
A lead in your lane usually looks like
- A buyer whose SOC 2, or a customer’s security review, calls for a test.
- The framework, timeline, and stakes captured on the call.
- Consented, exclusive, and scoped before it reaches you.
- Accept or pass on the full brief; passing is always free.
// Why the leads are clean
Why are these leads cleaner than a directory’s?
Because GRC Migrate takes no platform money and ranks nothing, buyers arrive already trusting the source. That trust is exactly why the introductions you get are better qualified than a pay-to-play directory can send: the person on the other end came to an independent source, not an ad they were routed through for a fee.
Our side is simple: a flat fee, paid only when a firm accepts an introduction. Never a commission. Nothing from the platforms, in either direction. Terms and the current fee are set on a call, while the numbers are being finalized.
How does GRC Migrate make money?
How we make money, completely: two ways. Service partners we’ve vetted pay us a flat referral fee only when they accept an introduction; the fee is disclosed and never varies with what you buy. And buyers can engage us for a paid review of an existing engagement, like the vCISO Audit; quote reviews on this site are free. That’s all of it. What we will never do: take money from the platforms and software vendors we cover, in any form; charge a firm to be listed; sell placement or rankings; or sell the data. The rollups are public and free, and contributing earns access money can’t buy.
This disclosure is one of the principles the whole site is held to, enforced in code.
// The bar
What does a vetted badge require?
A directory listing is a compiled fact about a firm and asserts no relationship; nothing on any listing page is ranked, and no firm pays to appear. A vetted badge is different. It renders only for a signed partner: the firm accepted our referral terms, the operator completed and dated its vetting call, and every check below passed. It always names its track, and it links back to the standard it was vetted under.
A vetted badge is worth carrying because it is not given out. It renders only after you accept the referral terms and the operator completes and dates a vetting call, and only while every check still holds. Read the exact standard for your track, disqualifiers and all, before you decide it is worth your time.
Vetted auditor
The auditor track: attestation work, under our referral terms and a dated vetting call. Everything we verify and every absolute disqualifier is written out in How we vet auditors.
Vetted readiness partner
The readiness track: readiness, vCISO, or penetration-testing work, under the same terms and dated call. The full standard is How we vet readiness partners.
Introductions to vetted partners are time-sensitive: no response within one business day is a pass, and the lead may be routed elsewhere.
// Early on purpose
Why is the roster so small?
Because a firm GRC Migrate introduces is a firm it vouches for, the roster is small on purpose: we would rather add slowly than pad a list. We are early, and building carefully. Founding partners shape the standard while it is still being set. We won’t dress that up with perks we haven’t decided on. What we can say plainly is that it is early, the seat is real, and the terms are a conversation.
// Talk it through
What happens on a call?
Thirty minutes on how briefs arrive, what your lane would look like, and where the terms land. No commitment either direction.