Most companies I work with started the same way. They hired an MSP for IT. Then a customer asked about SOC 2 and they hired a compliance consultant. Then they had an incident scare and they hired a security advisor. Three vendors, three invoices, three sets of meetings, and none of them talking to each other.
This is the default model and it's broken.
Where the three-vendor model falls apart
When IT, security, and compliance are run by separate firms, gaps form at the seams.
The MSP deploys a new cloud service and nobody tells the compliance team, so it never gets added to the SOC 2 scope. The compliance consultant writes a policy requiring 24-hour access revocation on termination, but the MSP's offboarding process takes 5 days because they weren't involved in writing the policy. The security advisor recommends MFA on all critical systems, but the MSP pushes back because it creates help desk tickets.
Each vendor optimizes for their own scope. The MSP wants systems running with minimal tickets. The compliance consultant wants clean audit evidence. The security advisor wants strong controls. When those objectives conflict, and they will, nobody has the authority or the context to make the trade-off. The founder gets pulled into every decision, which is exactly what hiring specialists was supposed to prevent.
The other problem is information. Your MSP knows what devices are deployed but doesn't track whether they meet compliance requirements. Your compliance consultant knows what controls are required but doesn't know what's actually configured. Your security advisor recommends changes but can't implement them. Everything passes through the founder as a relay, losing context and urgency at every handoff.
What a unified model looks like
When one team owns IT, security, and compliance together, the entire dynamic changes.
We deploy a device and it's configured to meet compliance requirements from day one. When we write a policy, we write it based on how the IT environment actually works, not how we wish it worked. When we recommend a security control, we implement it ourselves and track the evidence in the GRC platform. When the auditor asks a question, the same team that configured the control answers it.
No handoffs. No relay through the founder. No gaps at the seams.
For a healthcare company, this is especially important. HIPAA touches IT (device encryption, access controls, audit logging), security (risk assessment, incident response, monitoring), and compliance (policies, training, breach notification, BAAs). When three separate vendors own those three areas, HIPAA compliance falls through the cracks because everyone assumes someone else is handling it.
What this actually includes
When we say we manage IT, security, and compliance for a client, here's what that covers:
IT operations. Device management with MDM (enrollment, encryption, patching, remote wipe). Identity and access management (SSO, MFA, provisioning, deprovisioning). Employee onboarding and offboarding with security controls built in. Email administration and security. Cloud infrastructure oversight. Help desk escalation for security-related issues.
Security operations. Endpoint detection and response. 24/7 monitoring through our SOC. Vulnerability management. Penetration test coordination and remediation tracking. Incident response planning and execution. Security awareness training and phishing simulations. Vendor risk management.
Compliance operations. GRC platform management (Drata, Vanta, Rippling). SOC 2, HIPAA, HITRUST, ISO 27001 program management. Audit coordination and evidence preparation. Security questionnaire response. Policy development and maintenance. Risk assessment. Board and investor reporting.
One team. One point of contact. One invoice.
Who this is for
This model works best for companies between 15 and 200 employees that don't have (and don't need) an internal IT or security team. Startups and growth-stage companies where the CTO is currently handling IT on the side. Healthcare and health tech companies where HIPAA makes the stakes higher. SaaS companies entering enterprise sales where security is suddenly a procurement requirement.
If you're currently paying three vendors and coordinating between them yourself, or if you have no coverage at all and you're looking for one partner to handle it, this is what we built for.
What it costs
Monthly retainers start at $2,500 for smaller organizations and scale based on headcount, complexity, and frameworks. For most companies in our sweet spot (20 to 100 employees, one or two compliance frameworks, standard cloud environment), the cost is $4,000 to $8,000 per month.
Compare that to three separate vendors at $3,000 to $5,000 each, plus the founder's time coordinating between them. The unified model is usually cheaper and always more effective.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies, with deep expertise in healthcare and health tech.