Consider a data center with three prospective customers: a bank, a hospital, and a government agency. Each wants reassurance about security. Each may ask for a different kind of evidence. The servers have not changed. The questions have multiplied. Somewhere, a compliance manager must translate the same business into several institutional dialects. That translation problem is where Schellman earns its living.
The useful bits / 30 seconds
- The work: independent audits, certifications, and security testing.
- The appeal: coordinate overlapping evidence across several standards.
- The purchase: a scoped, fixed-fee professional engagement.
- The catch: shared evidence still has to meet each requirement.
01 / THE CUSTOMER’S PROBLEMThree audits. One explanation.
Iron Mountain encountered a version of this problem while expanding its data center colocation business. Its customers wanted facilities suitable for regulated industries. The company needed assessments addressing federal security requirements, ISO 27001, and payment card security. It selected Schellman, whose combination of assessment credentials let one provider cover the different demands. The work involved identifying common controls and preserving the requirements peculiar to each assessment.
“Schellman understood our business model right away.”
Jennifer Bertelli / Iron Mountain Data Centers’ Compliance Manager
The attractive detail is almost comically mundane: fewer introductions. Iron Mountain’s compliance manager described the advantage of working with an auditor who already understood the business, rather than explaining it three times. Schellman’s case study reports five months for ISO 27001 certification and one month for the PCI assessment. Those are this client’s results, supported by existing practices and dedicated resources, rather than a universal delivery promise.
02 / THE SPECIALIST’S BETA narrow beginning, a wide remit
Chris Schellman founded the business in 2002. It began with two people and SAS 70 examinations, a predecessor to today’s service-organization reporting landscape. The firm expanded around the demand for independent evidence. Today, its menu includes SOC examinations, ISO certification, PCI validation, FedRAMP assessments, HITRUST work, privacy assessments, and penetration testing. Schellman’s website says it issues more than 2,000 SOC reports annually.
Its customers include cloud providers, data centers, financial businesses, payment companies, and healthcare organizations. These are businesses whose customers need reasons to entrust them with consequential information. SOC 1 examines controls relevant to financial reporting; SOC 2 addresses specified trust-services criteria. FedRAMP assessments support federal cloud authorization. Penetration tests investigate vulnerabilities. The deliverables answer different questions, even when the underlying systems overlap.
The market offers several routes to that evidence. Specialist firms such as A-LIGN and Coalfire compete for assessment work; large accounting firms also maintain technology assurance practices. Schellman positions itself around its concentration on IT compliance, access to experienced principals, and breadth of assessment capabilities. The useful comparison is the actual engagement: credentials, scope, staffing, deliverables, and the amount of coordination a client must supply.
03 / THE ECONOMICSThe bill starts with the boundary
Schellman sells professional assessment work through fixed-fee engagements. Its pricing explanation starts with customer commitments, scope, and timing. A single application and a sprawling environment require different amounts of work. The firm uses scoping discussions and experience from prior projects to estimate the effort. Its distinction is predictability around an agreed assignment, with experienced assessors doing the work.
For buyers, the first economy is choosing the correct deliverable. A readiness assessment helps identify gaps; it does not provide the assurance of a completed examination. A SOC Type 1 addresses a point in time. Type 2 also examines operating effectiveness over a period. Buying the wrong report can leave a customer’s original request unanswered, however tidy the procurement exercise looked.
There is an internal bill as well. Someone must retrieve records, explain exceptions, and show that controls operated as described. Coordinating assessments can reduce repeated requests, but the client still owns its systems and remediation. A buyer comparing proposals should count those hours alongside the quoted fee. An inexpensive assessment becomes less attractive when it leaves the team repeating work.
04 / THE CREDIBILITY TESTWho checks the checker?
The single-assessor idea has legal fine print. Schellman is a brand shared by separately owned entities: Schellman & Company, LLC, the licensed CPA firm providing attest services, and Schellman Compliance, LLC, which provides nonattest cybersecurity and compliance services. Avani Desai leads Schellman Compliance. That distinction matters when a buyer asks who actually signs the report.
Its partner network includes compliance platforms and advisory firms, but Schellman says it pays and receives no referral fees. Independence constrains how these relationships operate. The firm also submitted itself to another kind of assessment: B Lab records its B Corp certification from June 2024, with a score of 82.5. Published values emphasize people, openness, and continual improvement. Here, the assessor has paperwork of its own.
Investors have taken notice. Lightyear Capital invested in 2021. In March 2026, Schellman announced an investment from Goldman Sachs Alternatives, with Lightyear to remain a minority investor. The announcement specified an expected second-quarter close. The stated plan was further growth while retaining an independent, expert-led model. That makes the quality of the assessment work central to the investment story.
05 / THE NEXT QUESTIONNow the machines need receipts
AI gives the old assurance problem a new vocabulary. In September 2024, Schellman announced that it had become the first ANAB-accredited ISO 42001 certification body. The standard concerns an AI management system: how an organization governs its use and development of AI. Schellman also offers AIUC-1 services and AI security assessments. A management-system certificate has a defined scope; it cannot promise that every generated answer will be safe or correct.
In September 2026, Desai cited company research showing 74% of organizations believed they could pass an AI compliance audit, while 27% described their governance as mature. The gap is suggestive, though neither number is an independently observed audit result. It illustrates the market Schellman wants to serve: organizations that need to turn confidence into evidence another party can inspect.
06 / THE MOVE TO COPYStart with the buyer’s question
The practical lesson travels beyond Schellman. Ask the customer which report or certification it needs. Define the systems and period covered. Identify evidence that can serve several requirements, then assign owners to the remaining gaps. Shared work helps when scopes overlap. It offers less relief when systems, requirements, or evidence differ. Software can organize documents; qualified assessors still have to evaluate them. Schellman occupies that consequential interval between a company saying “trust us” and a customer deciding it can.