Insight Assurance

Who is Insight Assurance?

Insight Assurance is a Tampa, Florida-based audit and compliance firm founded in 2020 by former Big 4 professionals, with a team of roughly 50-75 staff delivering SOC, ISO, PCI, HITRUST, and related attestation work to clients described on its own site as ranging from fast-growing startups to Fortune 100 companies.

It positions itself as a Big 4-caliber alternative for SaaS, cloud, and technology companies that need a credentialed audit without a large regional firm’s overhead or timeline.

The firm was co-founded by CEO Jesus Jimenez (CPA, CISA, ISO Lead Auditor, QSA, CMMC-RP) and CFO Felipe Saboya (CPA, CIS LA), alongside COO Craig Saldanha (CISA, CISM, CRISC, CIS LI). Its leadership bench includes a dedicated Senior Director of SOC Services (Chris Collins) and a Managing Director of Audit Services (K. Adam Glover, CISA/CISM/CRISC/CDPSE), plus named practice leads for PCI and penetration testing (Aaron Getchius, PCI QSA) and ISO (Mario Vlieg, who also serves as General Manager for the firm’s Panama operation). A separate EMEA Market Lead (Paige Hamilton) reflects the firm’s stated reach across North America, Europe, and APAC.

What credentials does Insight Assurance actually hold?

Insight Assurance is a licensed CPA firm that issues SOC reports directly rather than operating as a readiness-only shop or reselling another firm’s opinion — its own SOC examinations page states plainly that “the report itself is the deliverable, and its credibility depends on the independence and accreditation of the firm that conducts it.” This is the foundational answer to

whether a buyer’s customers will treat the report as defensible: it is issued under AICPA attestation standards (SSAE 18) by a CPA firm, not a compliance consultancy operating adjacent to one.

Insight Assurance is enrolled in the AICPA Peer Review Program, the profession’s mandatory independent quality check for CPA firms performing attest work. Its most recent peer review is dated December 27, 2023, covering the period January 1, 2022 through December 31, 2022; the rating is not publicly disclosed in the AICPA’s public-file search. Buyers who want to confirm enrollment status or pull the underlying report can search the firm directly at the AICPA Peer Review public file search.

Beyond the CPA license and peer review, the firm’s credibility case rests on named practitioner credentials across the team — CISA, CISM, CRISC, PCI QSA, ISO 27001 Lead Auditor, and CMMC-RP designations recur across the leadership roster — and on a stated Big 4 pedigree for its founders and senior staff.

What SOC reports does Insight Assurance issue?

Insight Assurance runs the full SOC portfolio — SOC 1 (Type I and Type II), SOC 2 (Type I and Type II), and SOC 3 — through a dedicated SOC Examinations practice with its own Senior Director.

SOC 2 is framed on the firm’s site as the standard “most commonly requested of Software as a Service (SaaS) companies, cloud vendors, and technology firms,” while SOC 1 is scoped for organizations whose services touch a client’s financial reporting (payroll processors, claims administrators, billing platforms, fund administrators).

On its own FAQ, the firm states a SOC 2 Type I evaluates control design at a single point in time and is typically the entry report for a first-time SOC buyer, while a Type II evaluates operating effectiveness over a monitoring window the firm puts at six to 12 months (with most first-time clients completing a Type II nine to 12 months after starting preparation). SOC 3 is offered only alongside a completed SOC 2 Type II, as a condensed public-facing version without the sensitive operational detail of the full report. The firm also explicitly distinguishes its audit role from the compliance-automation platforms its clients often use for evidence collection: “the SOC report itself must be issued by an independent, licensed CPA firm. The platform and the auditor serve different functions.”

Which frameworks does Insight Assurance cover?

Independently listed credentials are Cyber AB authorized C3PAO (member C3PAO-58527) and IAS-accredited ISO certification on IAF CertSearch, with active ISO/IEC 27001:2022, ISO/IEC 27701:2019, and ISO/IEC 42001:2023. The official FedRAMP Marketplace lists Insight as assessor 203355, accredited September 16, 2025, with no completed assessments and no highest-assessed class as of August 20, 2026. That confirms 3PAO status, but not a High or Moderate delivery record.

Insight’s site also lists PCI DSS (named QSA on staff), HITRUST, GDPR, HIPAA/HITECH, CSA STAR, CCPA/CPRA, and NIST CSF. Breadth is the pitch; confirm bench depth on any framework outside SOC before assuming parity with a specialist.

Does Insight Assurance also sell penetration testing?

Insight Assurance also sells third-party penetration testing as a standalone service — web application, API (including OWASP API Security Top 10 methodology), mobile, network, wireless, physical/facility, and static/dynamic code testing — led by a named Senior Director of PCI & Pentesting.

Because Insight Assurance offers both penetration testing and SOC 2 attestation, buyers should scope the two separately rather than assume a single bundled engagement is the cleanest path. Under AICPA independence rules, a CPA firm that performs a client’s penetration test and then evaluates that same environment as part of the client’s SOC 2 audit can create a self-review consideration, since the test becomes part of the control environment the audit is assessing. If you engage Insight Assurance for SOC 2, it is worth confirming on the first call whether the same team or a separate one would handle any accompanying pen test — or whether to source the test from a different provider entirely.

Which GRC platforms does Insight Assurance work with?

Insight Assurance maintains partnerships with the major compliance-automation platforms rather than pushing a proprietary tool: Vanta, Drata, and Secureframe are listed as technology partners on its dedicated partners page, alongside Carbide, TrustCloud, OneTrust, Hyperproof, and Ostendio.

The firm also lists a set of service partners — including Workstreet, Rhymetec, Eden Data, and Cognisys — for clients that want readiness or vCISO support alongside the audit itself.

How much does an Insight Assurance SOC 2 audit cost?

Insight Assurance does not publish rate cards. Based on our research into comparable specialist CPA firms serving SaaS and cloud clients of similar size, our estimated range for a SOC 2 Type I is roughly $12,000-$25,000, and for a SOC 2 Type II roughly $20,000-$45,000.

These are our directional estimates, not numbers confirmed by Insight Assurance, and actual pricing will depend on headcount, cloud footprint, number of trust services criteria in scope, and prior audit history. For a firm-specific number, request a quote and we will route your scope to Insight Assurance for a ballpark.

How long does an Insight Assurance SOC 2 audit take?

Insight Assurance’s own FAQ states a SOC 2 Type I typically completes in four to eight weeks once the audit period begins, which is broadly consistent with our estimated 3-6 week fieldwork-to-report window.

A Type II requires an observation period the firm puts at six to 12 months before the audit itself can be finalized — most first-time clients complete their first Type II nine to 12 months after starting preparation, once readiness work and the monitoring window are both accounted for. Buyers should plan around the observation period, not just the audit fieldwork, when setting a deadline tied to a customer or investor commitment.

Who is Insight Assurance a good fit for?

Best fit for: - SaaS, cloud, and technology companies that want a licensed CPA firm with a stated Big 4 pedigree at a smaller-firm price point - Buyers already using Vanta, Drata, Secureframe, Carbide, TrustCloud, OneTrust, Hyperproof, or Ostendio who want an auditor with an existing partnership on that platform - Companies whose compliance roadmap may expand beyond SOC 2

into ISO 27001, PCI DSS, HITRUST, FedRAMP, or CMMC, where one firm covering multiple frameworks avoids a second vendor relationship later - Global or distributed organizations that want an auditor with a stated presence across North America, Europe, and APAC

Not a fit — look elsewhere if:

• You want penetration testing and SOC 2 handled by fully independent firms without needing to raise the separation question yourself
• You need firm-published, fixed-rate pricing rather than a scoping call
• You are prioritizing a Big 4 or Top-25 firm name specifically for investor or SEC-facing optics rather than practitioner-level Big 4 experience

When should a buyer shortlist Insight Assurance?

For buyers who want pentesting kept structurally separate from the SOC signer, raise that on the first call. Independently listed CMMC and ISO credentials plus a FedRAMP Marketplace 3PAO listing are the growth case; zero completed Marketplace assessments is the federal-experience constraint. Estimated Type I $12,000–$25,000 and Type II $20,000–$45,000 remain our directional ranges, not firm-confirmed prices.