Simple pricing for GRC consultants
Run your entire vCISO and compliance practice from one platform — without managing every client through spreadsheets.
Founding Partner
For vCISOs, MSPs, and compliance consultants who want to shape the product alongside us.
Locked in for 12 months. No per-seat multipliers.
Then a gradual step-up — not a cliff: $349/mo in year 2, then the standard Consultant rate ($499/mo). Stay on annual billing and your founding rate stays locked.
What you get
- Up to 10 client workspaces
- Risk register with 5×5 heat maps & cost-benefit analysis
- BIA & continuity planning
- Compliance tracking (SOC 2, ISO 27001, NIST CSF 2.0, HITRUST, HIPAA)
- Reusable industry templates
- White-label assessment reports
- AI-assisted risk scoring & BCP playbook generation
- Natural-language data queries
- Direct founder onboarding call
- Product roadmap input
What we ask in return
- A 30-minute feedback call each month
- Permission to use an anonymized case study
- A testimonial after demonstrated value
- At least one active client implementation
GRC Foundation Sprint
Don't have time to configure everything yourself? We'll set up a client workspace and deliver a complete initial assessment in two weeks.
Delivered in 2 weeks
- Initial risk assessment
- Populated risk register
- One framework gap assessment (SOC 2, ISO 27001, etc.)
- BIA for five critical processes
- Executive remediation roadmap
- NovaGRC workspace fully configured
- 90 days of platform access included
Self-service plans
Prefer to get started on your own? Pick a plan and go.
Starter
For individuals exploring risk management
- Risk Register with 5×5 heat maps
- Business Impact Analysis
- Business Continuity Planning
- Compliance tracking (SOC 2, ISO 27001)
- Up to 3 team members
- Multi-factor authentication (MFA)
- PDF & CSV exports
- 25 AI actions / month
Pro
Best for internal GRC teams securing one organization
- Everything in Starter, plus:
- AI-assisted risk assessment
- AI-generated BCP playbooks
- Natural-language data queries
- Cost-benefit analysis (SLE/ARO/ROSI)
- NIST CSF 2.0, HITRUST & HIPAA
- Full assessment reports
- Unlimited team members
- Workspace branding
- 100 AI actions / month
Consultant
Best for vCISOs & MSPs managing up to 10 clients
Annual: $4,990/yr (save $998)
- Everything in Pro, plus:
- Up to 10 client workspaces
- White-label assessment reports
- Reusable industry templates
- AI-assisted risk scoring & BCP playbook generation
- Cross-framework control mapping
- No per-seat multipliers
- Email support (next business day)
- 250 AI actions / month
Practice
Best for established practices managing up to 25 clients
Annual: $8,990/yr (save $1,798)
- Everything in Consultant, plus:
- Up to 25 client workspaces
- Priority onboarding for new client workspaces
- Priority email support (same business day)
- 500 AI actions / month
Enterprise
Best for regulated industries & large practices
- Everything in Practice, plus:
- Single Sign-On (Google SSO)
- Custom compliance frameworks
- Custom AI workflows
- Advanced audit trails
- Dedicated account manager (4-hour SLA)
- 99.9% uptime SLA
- Unlimited workspaces
- Unlimited AI actions
Common questions
Who is NovaGRC built for?
Independent vCISOs, cybersecurity consulting firms, MSPs building vCISO services, and ISO/SOC 2 compliance consultants managing 5–30 clients. If you’re currently running client GRC work from spreadsheets, NovaGRC replaces that with separate client workspaces, linked records, and white-label reporting.
What does the Founding Partner program include?
$199/month (locked for 12 months) with up to 10 client workspaces, all platform features including AI, direct founder onboarding, and product roadmap input. We’re selecting 10 partners who will help shape the product in exchange for monthly feedback and an eventual testimonial. After the 10 founding spots fill, the same feature set is available as our Consultant plan at $499/month. Founding partners step up gradually rather than facing a cliff: $199/month for the first 12 months, $349/month in year 2, then the standard $499/month — and if you stay on annual billing, your founding rate stays locked.
What’s the difference between Pro, Consultant, and Practice?
Pro ($199/user/month, no minimum) is priced per seat and designed for an internal GRC team securing a single organization. Consultant ($499/month flat) adds up to 10 client workspaces, white-label reporting, and reusable templates — built for vCISOs and MSPs managing multiple clients from one account. Practice ($899/month flat) extends that to 25 client workspaces with same-business-day priority support — for established practices that have outgrown 10 clients but don’t need Enterprise. All three include AI features; the monthly AI allowance scales with the plan (100 / 250 / 500 actions).
What’s the GRC Foundation Sprint?
A $2,500 one-time engagement where we configure a client workspace, run an initial risk assessment, complete one framework gap assessment, build BIA for five critical processes, and deliver an executive remediation roadmap — all in two weeks.
What compliance frameworks do you support?
SOC 2 Type II, ISO 27001, ISO 27002, NIST CSF 2.0, HITRUST CSF, and HIPAA out of the box. Enterprise workspaces can also define custom frameworks with custom controls, plus cross-framework control mapping.
How is my data protected?
Data is encrypted at rest and in transit. We support MFA, role-based access controls, per-area permission granularity, session timeout policies, and IP allowlisting. The platform is built and supported by CISSP-certified security professionals.
Can I white-label reports for my clients?
Yes. Upload your logo to each client workspace and every generated report — NIST SP 800-30 assessments, executive dashboards, treatment plans, ROSI analysis — carries your branding, not ours.
How long is the free trial?
14 days on any paid plan, no credit card required. At the end of the trial you choose a plan or drop to the free Starter tier — nothing is charged automatically.
Do you offer annual billing?
Yes. Consultant and Practice are available on annual billing at roughly two months free: Consultant is $4,990/year (vs. $5,988 monthly) and Practice is $8,990/year (vs. $10,788 monthly). Enterprise contracts are billed annually by default. Contact us to switch to annual billing at any time.
What are AI actions and how do the limits work?
An AI action is any use of NovaGRC’s built-in AI features: risk scoring, BCP playbook generation, natural-language data queries, company research, or workflow runs. Each plan includes a monthly allowance (Starter 25, Pro 100, Consultant 250, Practice 500, Enterprise unlimited). This is a soft cap — if you hit your limit, AI features still work and you’ll see a notice suggesting an upgrade. We won’t cut you off mid-assessment.