Ongoing GRC function
Managed GRC
$5,000 / month
Standard initial term of 12 months, subject to the signed agreement
Build, take over, or run your security governance program, with a named advisor managing the work.
DetailsManaged GRC and SOC 2 readiness
Services and pricing
Managed GRC is our ongoing service: we run your security governance program as an outsourced function. Launch Readiness is a focused engagement for a first SOC 2 examination. Each service can be engaged directly; none is a prerequisite for another.
Request an intro callFirst SOC 2
Launch Readiness
$4,500 / month
Generally four to six months
Establish the program and prepare for a first SOC 2 examination.
DetailsStandalone assessment
Readiness Assessment
$7,500 one-time
A review of your current security program, controls, and gaps, with findings and a prioritized roadmap. Available separately from our monthly services.
DetailsExpanded Managed GRC
Scale
From $7,500 / month
Managed GRC with more environments, assurance requests, reporting, or coordination.
DetailsEvery Managed GRC and Launch Readiness engagement begins with an assessment of your existing security program, controls, risks, and documentation. You do not need to purchase the standalone Readiness Assessment before starting either service.
Managed GRC
Managed GRC is an ongoing outsourced GRC function. A named advisor builds the program if you don't have one, takes over an existing program, or runs and improves an established one. SOC 2 is not a prerequisite.
Included operating activities, subject to the engagement scope
- Develop, maintain, and review security policies and procedures.
- Maintain the control set and governance calendar, with monthly reporting to management.
- Run the risk register, document exceptions, and track remediation.
- Coordinate access, vendor, governance, and other recurring reviews, and keep the evidence organized.
- Assess vendors and record review decisions and follow-up.
- Coordinate employee security awareness training using the client's chosen training provider or materials.
- Prepare responses to customer security questionnaires and support agreed customer security calls.
- Manage the compliance program, including preparation for and coordination of audits.
- Coordinate scheduled incident-response tabletop exercises where included.
- Govern the client's own AI systems and implementations, where included in scope.
Planned service allowances
-
Vendor reviews
- Standard allowance
- Up to 12 per year
- Period limit
- No more than 4 per quarter
-
Standard questionnaire units
- Standard allowance
- Up to 24 per year
- Period limit
- No more than 4 per month
-
Customer security calls
- Standard allowance
- Up to 6 per year
- Period limit
- No more than 1 per month
-
Minor program improvements
- Standard allowance
- Up to 4 per year
- Period limit
- No more than 1 per quarter
A standard questionnaire unit refers to a typical customer security questionnaire. Larger or highly customized requests may consume more capacity, as defined in the agreement. Additional systems, frameworks, audits, technical implementation, and legal work are outside the standard service unless expressly included.
Launch Readiness
Launch Readiness is intended for a company preparing for its first SOC 2 examination. We help establish the security program, coordinate implementation work, and prepare the records needed for examination.
Included work, subject to the engagement scope
- Define the relevant systems, services, personnel, data, vendors, and customer commitments.
- Review existing controls, policies, procedures, and evidence.
- Document gaps and maintain a remediation plan with owners and target dates.
- Draft relevant policies and procedures for approval by management.
- Establish risk, exception, evidence, and review processes.
- Coordinate initial critical-vendor reviews and create a starting library of security-questionnaire answers.
- Review evidence before it is organized for the CPA firm.
- Prepare system-description inputs and coordinate agreed examination requests.
- Report progress and unresolved decisions throughout the engagement.
Client responsibilities: Provide accurate system information, staff participation, authorized records, technical remediation, and timely management approvals. The required effort depends on existing controls and the work identified during scoping.
Do we require an assessment first? No. We can scope a Launch engagement directly. The one-time Readiness Assessment is a separate option for customers who want an assessment and roadmap on its own.
Readiness Assessment
The Readiness Assessment is a standalone project for a company that wants to understand its current controls, gaps, and evidence before selecting an implementation approach.
Included work
- Confirm the system and criteria in scope.
- Review relevant policies, governance, controls, and evidence available at the time.
- Identify material gaps and document their supporting observations.
- Prepare a prioritized roadmap and findings walkthrough.
The assessment does not include program implementation, technical remediation, or a SOC 2 examination. Buying it does not obligate the company to purchase another service, and neither Managed GRC nor Launch Readiness requires it.
Scale
Scale is Managed GRC with a larger scope: additional environments, entities, frameworks, request volumes, or reporting and coordination requirements. Scope and price are set after review of the work involved.
Potential expanded activities
- Higher vendor-review and customer-questionnaire volume.
- More frequent or detailed management reporting.
- Additional coordination across systems, teams, entities, or assurance activities.
- Backup-advisor coverage and facilitated exercises where agreed.
Planned capacity reference
-
Vendor reviews
- Planned allowance
- Up to 24 per year
- Period limit
- No more than 8 per quarter
-
Standard questionnaire units
- Planned allowance
- Up to 48 per year
- Period limit
- No more than 8 per month
-
Customer security calls
- Planned allowance
- Up to 12 per year
- Period limit
- No more than 2 per month
-
Facilitated exercises
- Planned allowance
- Up to 2 per year
- Period limit
- —
Limits, frequency, and included work are confirmed in the proposal and signed agreement.
Scope and billing
The signed agreement and statement of work determine the included services, timing, fees, review allowances, changes in scope, and responsibilities. If work is needed beyond the engagement, we discuss and price the change before beginning it.
GetComply does not provide legal advice, penetration testing, specialist engineering, or a CPA examination as part of these standard services. We may identify a need for those services and work with the client to coordinate the relevant provider.
Examination fees are separate and paid directly to the client's independent CPA firm. Customers choose their CPA firm; GetComply does not issue SOC 2 reports or guarantee examination outcomes.
Existing tools
We can work with an existing compliance platform such as Vanta, Drata, Secureframe, or Sprinto where suitable. A platform purchase is not a condition of engagement, and the choice of tools should follow the client's actual requirements.
Questions about scope
Yes. Managed GRC can establish a program, take over an existing one, or run an established one. Neither Launch Readiness nor a Readiness Assessment is required first.
They cover different obligations. Launch addresses an agreed SOC 2 program-build scope for a limited period. Managed GRC is an ongoing function with a schedule of reviews and customer assurance work under defined annual allowances. Neither is priced as unlimited service.
Yes. Examination scope, procedures, timing, and the opinion are determined by the selected independent firm.