Simple pricing for GRC consultants
Run your entire vCISO and compliance practice from one platform — without managing every client through spreadsheets.
Founding Partner
For vCISOs, MSPs, and compliance consultants who want to shape the product alongside us.
Locked in for 12 months. No per-seat multipliers.
Then a gradual step-up — not a cliff: $349/mo in year 2, then the standard Consultant rate ($499/mo). Stay on annual billing and your founding rate stays locked.
What you get
- Up to 10 client workspaces
- Risk register with 5×5 heat maps & cost-benefit analysis
- BIA & continuity planning
- Compliance tracking (SOC 2, ISO 27001, NIST CSF 2.0, HITRUST, HIPAA + AI governance)
- Reusable industry templates & shared template library
- White-label assessment reports
- First client report wizard (spreadsheet → board report)
- Client evidence requests — no client login needed
- Per-workspace public trust page
- AI-assisted risk scoring & BCP playbook generation
- Natural-language data queries
- Guided onboarding for your first client
- Product roadmap input
What we ask in return
- Short monthly feedback (email or survey)
- Permission to use an anonymized case study
- A testimonial after demonstrated value
- At least one active client implementation
GRC Foundation Sprint
Don't have time to configure everything yourself? We'll set up a client workspace and deliver a complete initial assessment in two weeks.
Delivered in 2 weeks
- Initial risk assessment
- Populated risk register
- One framework gap assessment (SOC 2, ISO 27001, etc.)
- BIA for five critical processes
- Executive remediation roadmap
- NovaGRC workspace fully configured
- 90 days of platform access included
Self-service plans
Prefer to get started on your own? Pick a plan and go.
Starter
For individuals exploring risk management
- Risk Register with 5×5 heat maps
- Business Impact Analysis
- Business Continuity Planning
- Compliance tracking — all 9 frameworks incl. AI governance
- Up to 3 team members
- Guided spreadsheet import & first-report wizard
- MFA + sign in with Google
- PDF & CSV exports
- 25 AI actions / month
Pro
Best for internal GRC teams securing one organization
- Everything in Starter, plus:
- AI-assisted risk assessment
- AI-generated BCP playbooks
- Natural-language data queries
- Cost-benefit analysis (SLE/ARO/ROSI)
- Full assessment reports
- Unlimited team members
- Workspace branding
- Unlimited AI (fair use)
Consultant
Best for vCISOs & MSPs managing up to 10 clients
Annual: $4,990/yr (save $998)
- Everything in Pro, plus:
- Up to 10 client workspaces
- White-label assessment reports
- Reusable industry templates & shared template library
- Client evidence requests — no client login needed
- Per-workspace public trust page
- Cross-framework control mapping
- No per-seat multipliers
- Email support (next business day)
- Unlimited AI (fair use)
Common questions
Who is NovaGRC built for?
Independent vCISOs, cybersecurity consulting firms, MSPs building vCISO services, and ISO/SOC 2 compliance consultants managing 5–30 clients. If you’re currently running client GRC work from spreadsheets, NovaGRC replaces that with separate client workspaces, linked records, and white-label reporting.
What does the Founding Partner program include?
$199/month (locked for 12 months) with up to 10 client workspaces, all platform features including AI, guided onboarding, and product roadmap input. We’re selecting 10 partners who will help shape the product in exchange for monthly feedback and an eventual testimonial. After the 10 founding spots fill, the same feature set is available as our Consultant plan at $499/month. Founding partners step up gradually rather than facing a cliff: $199/month for the first 12 months, $349/month in year 2, then the standard $499/month — and if you stay on annual billing, your founding rate stays locked.
What’s the difference between Pro, Consultant, and Practice?
Pro ($199/user/month, no minimum) is priced per seat and designed for an internal GRC team securing a single organization. Consultant ($499/month flat) adds up to 10 client workspaces, white-label reporting, and reusable templates — built for vCISOs and MSPs managing multiple clients from one account. Practice ($899/month flat) extends that to 25 client workspaces with same-business-day priority support — for established practices that have outgrown 10 clients but don’t need Enterprise. All three include unlimited AI (fair use) — you never count actions or pay overages.
What’s the GRC Foundation Sprint?
A $2,500 one-time engagement where we configure a client workspace, run an initial risk assessment, complete one framework gap assessment, build BIA for five critical processes, and deliver an executive remediation roadmap — all in two weeks.
What compliance frameworks do you support?
Nine frameworks out of the box: SOC 2 Type II, ISO 27001, ISO 27002, NIST CSF 2.0, HITRUST CSF, HIPAA, plus AI governance frameworks — ISO 42001, NIST AI RMF, and EU AI Act. Enterprise workspaces can also define custom frameworks with custom controls, plus cross-framework control mapping.
How is my data protected?
Data is encrypted at rest and in transit. We support MFA, role-based access controls, per-area permission granularity, session timeout policies, and IP allowlisting. The platform is built and supported by CISSP-certified security professionals.
Can I white-label reports for my clients?
Yes. Upload your logo to each client workspace and every generated report — NIST SP 800-30 assessments, executive dashboards, treatment plans, ROSI analysis — carries your branding, not ours.
How long is the free trial?
14 days on any paid plan, no credit card required. At the end of the trial you choose a plan or drop to the free Starter tier — nothing is charged automatically.
Do you offer annual billing?
Yes. Consultant and Practice are available on annual billing at roughly two months free: Consultant is $4,990/year (vs. $5,988 monthly) and Practice is $8,990/year (vs. $10,788 monthly). Enterprise contracts are billed annually by default. Contact us to switch to annual billing at any time.
Is AI usage limited?
Every paid plan (Pro, Consultant, Practice, Enterprise) includes unlimited AI under a simple fair-use policy — risk scoring, BCP playbook generation, natural-language queries, company research and workflow runs, with no meters, no overages and no upgrade nags. The free Starter plan includes 25 AI actions a month as a soft cap: AI keeps working past it and you’ll just see a notice.