vCISO and Managed GRC Pricing | Steadfast Partners

WAY TO START

Platform Health Check

$2,500 fixed

Two week review of your GRC platform with a 60 day plan to green and a tier recommendation. Credited to month one of any tier. Free for partner referrals.

WAY TO START

Security Program Assessment

$7,500 to $15,000 fixed

Roadmap, risk register and a board summary. The natural entry point for vCISO.

FIXED FEE

vGRC Build

Scoped after a Health Check

The plumbing between your compliance platform and your real systems. An evidence repo you own, drift alerts with owners, deletion you can prove.

Moves the price: systems to connect, data stores to map, deletion engineering.

MANAGED GRC

Essentials

From $3,500 / month

Your compliance operations manager. One framework, one platform, readiness included from day one.

Moves the price: over 100 staff or a second framework.

MANAGED GRC

Professional

From $6,000 / month

Everything in Essentials, plus multiple frameworks from one control set and customer audits handled.

Moves the price: a third framework, headcount, more than two customer audits a year.

FLAGSHIP

vCISO

From $10,000 / month

A named senior security leader inside your company, with a Managed GRC tier included.

Moves the price: Professional underneath, more than one customer audit a quarter, board and fundraise cadence, M&A activity.

Quoted on the call: HITRUST r2, FedRAMP, enterprise GRC tools, and platform subscriptions bundled on one SOW.

Questions

Straight answers.

Why publish prices?: Most firms in this space do not. Publishing makes referrals easier and tells you before the call whether we fit. If a lower priced option is what you need right now, we will say so.
Is readiness a separate project?: No. One monthly price from day one through the audit and beyond.
Which platform?: Drata is where we run deepest, and we are a partner and reseller, so the subscription and the service can land on one SOW. Already on Vanta or Secureframe? We take over that instance.
Who does the audit?: Your auditor of choice, independent of us. We prepare you, liaise with the auditor, and work findings before the draft report. Partner pricing is passed through where we have it.
Who do we actually work with?: A senior vCISO leads every engagement, and a named compliance operations manager runs Managed GRC, with senior review in month one.

Published starting prices. Fixed once scoped.