Add the frameworks you need. Only those.
$20,000/year including one framework. Each additional framework is $3,000/year. For companies under $5M revenue or 50 staff. The SOC 2 Type I, Security-only bundle includes the independent auditor fee. Type II audits, additional audit criteria, and other certification fees are quoted separately. Enterprise pricing is custom. The SOC 2 Type I, Security-only bundle is $20,000/year total, including the $3,000 independent auditor fee. Sythe coordinates preparation and the audit through the platform. The independent auditor performs the audit and issues the report. Type II audits and additional criteria are quoted separately.
New to startup compliance?
The Startup Compliance Atlas explains what applies, how controls and evidence work, and where to start with SOC 2 and other requirements.
Five frameworks, one programme.
Each framework has its own page - what it actually requires, how we run it, what it costs, and the questions everyone asks on the first call.
+ $3,000 / yr add-on
- 01SOC 2AICPA TSC 2017 (rev. 2022)The enterprise deal that stalled in vendor security review.Supports a signed Type II report
- 02ISO 27001ISO/IEC 27001:2022The international buyer who will not accept a US-only report.Supports an accredited certificate
- 03HIPAA45 CFR Parts 160, 162 & 164The health system that will not sign until your BAA holds up.Supports a defensible compliance program
- 04PCI DSSPCI DSS v4.0.1The acquirer or processor that just asked for your AOC.Supports a signed Attestation of Compliance
- 05GDPRRegulation (EU) 2016/679The EU customer whose DPA review is holding up signature.Supports demonstrable accountability
- Something elseWe run frameworks beyond these five, plus customer security questionnaires and your own internal control set. Ask on the call.NIST CSF - CMMC - custom control setsAsk about a framework (opens Google Calendar in a new tab)
Not sure which one your buyers are actually asking for? That is the first thing we work out on the call - and we will tell you when the answer is "none yet."