CYVELLE PRICING
See the Starting Price. Define the Right Scope.
Review starting prices for our security, audit-readiness and AI governance services. Your written proposal confirms the scope, deliverables, timeline and fee for your organization.
01
Choose Your Starting Point
| Service | Starting price or fee model | Basis | Detail |
|---|---|---|---|
| The Governance Blueprint | From $5,000 | per engagement | Detail |
| SOC Readiness | From $4,500 | per engagement | Detail |
| ISO 27001 Readiness | From $8,000 | per engagement | Detail |
| PCI DSS Readiness | From $4,000 | per engagement | Detail |
| HITRUST Readiness | From $9,000 | per engagement | Detail |
| Virtual CISO | From $3,000 | per month | Detail |
| Third-Party Risk Management | From $6,000 | setup | Detail |
| Vendor Questionnaire Support | From $1,500 | per engagement | Detail |
| ISO 42001 Readiness | From $5,000 | per engagement | Detail |
| EU AI Act Readiness | From $5,000 | per engagement | Detail |
| HIPAA Readiness | From $3,500 | per engagement | Detail |
| CMMC Level 2 Gap Assessment | From US$5,000 | one agreed assessment boundary | Detail |
| Incident Planning | Fixed fee confirmed after scoping. | scoped proposal | Detail |
| Cybersecurity Maturity Assessment | Fixed fee confirmed after scoping. | scoped proposal | Detail |
| Audit and Certification Coordination | Fixed fee confirmed after scoping. | scoped proposal | Detail |
| Cloud Security Consulting | Fixed fee confirmed after scoping. | scoped proposal | Detail |
| NIST AI RMF Alignment | Fixed fee confirmed after scoping. | scoped proposal | Detail |
| Security for Startups | Selected service and its approved terms | routing pathway | Detail |
02
THE GOVERNANCE BLUEPRINT
IT Security & Governance Audit Pricing
| Included | Essentials | Comprehensive | Enterprise |
|---|---|---|---|
| Starting price (From) | $5,000 | $9,500 | $15,000 |
| Organization size | Up to 50 employees | Up to 500 employees | 500+ employees |
| Frameworks | One agreed framework | Multiple frameworks | Multiple frameworks across the organization |
| Environments | Cloud or on-premises | Cloud and on-premises | Hybrid and multiple environments |
| Assessment focus | Core security and governance controls | Cloud, secure development and DevSecOps controls | Expanded infrastructure, development and third-party risk controls |
| Reports | Executive risk summary and remediation priorities | Executive summary, detailed findings and remediation roadmap | Executive summary, detailed findings, roadmap and leadership reporting |
| Walkthrough | One 30-minute report walkthrough | Executive readout and 2 consulting sessions | Executive readout and 4 consulting sessions |
| Follow-up | 30 days of follow-up access via email | 30 days of follow-up Q&A | 30 days of follow-up support |
| Delivery | 2 weeks | 4 weeks | 8 weeks |
Final scope and fixed fee are agreed before work begins.
Essentials: 2 weeks from kickoff for the agreed scope, subject to evidence and stakeholder availability. Follow-up support covers report clarification; implementation is separately scoped.
Essentials support: One 30-minute report walkthrough and 30 days of follow-up access via email for questions about the report. Implementation work and new assessments are excluded.
03
SOC 2 READINESS
| Readiness Assessment | Most Popular Full Readiness + Implementation |
|---|---|
| From $4,500 per engagement | From $12,000 per engagement |
| SOC 2 gap analysis Control mapping Policy templates Remediation roadmap Evidence requirements guide Report walkthrough |
Everything in Readiness Assessment, plus: Control implementation Policy development Evidence collection setup Auditor coordination Mock audit Participation in all auditor calls |
| A complete SOC 2 gap assessment and prioritized readiness roadmap. | End-to-end support to close readiness gaps, implement controls and prepare for your SOC 2 audit. |
| 1 week | 9–13 weeks to audit readiness |
| 30 days of follow-up access | 30 days of follow-up access |
| Get Your SOC Readiness Roadmap → | Get Your SOC Readiness Roadmap → |
Receive a fixed-price proposal within 24 hours of your free strategy call, with the scope and fee agreed upfront.
The SOC 2 audit is conducted by an independent CPA firm and billed separately. We help you select your auditor, compare proposals and negotiate fees on your behalf.
Independent audit fees vary by report type, scope and complexity. We help you compare CPA proposals and negotiate fees.
04
ISO 27001 Readiness
| ISO 27001 Readiness Review | Most Popular ISO 27001 Implementation & Audit Readiness |
ISO 27001 & SOC 2 Integrated Readiness |
|---|---|---|
| From $8,000 | From $20,000 | From $30,000 |
| Review against all ISO 27001:2022 requirements and 93 Annex A controls Detailed findings with prioritized remediation actions Draft Statement of Applicability ISMS documentation and evidence plan Readiness timeline based on your assessment Certification-body recommendations Management readout and 30 days of follow-up access |
All deliverables in the ISO 27001 Readiness Review, plus: Complete ISMS policies, procedures and required documentation Risk assessment methodology and assessment execution Implementation guidance and remediation ownership Internal audit planning and execution Management review facilitation Stage 1 and Stage 2 audit preparation Certification-body coordination and participation in auditor calls 30 days of follow-up access |
Everything in ISO 27001 Implementation & Audit Readiness SOC 2 readiness aligned to your required report One control framework mapped to both standards A shared evidence collection process Progress tracking across both frameworks Coordinated certification-body and CPA audit scheduling Participation in certification-body and CPA calls 30 days of follow-up access |
| Know where you stand and what it will take to become audit-ready, with your assessment and prioritized roadmap delivered within 2 weeks. | Build your ISMS, put security controls into practice and become audit-ready in 12–20 weeks, with support through both certification audit stages. | Prepare for ISO 27001 and SOC 2 together, using shared controls and evidence to reduce duplicated work and support enterprise customer requirements. |
| Within 2 weeks | 12–20 weeks | 16–24 weeks |
| Book a Free ISO 27001 Strategy Call | Book a Free ISO 27001 Strategy Call | Book a Free ISO 27001 Strategy Call |
05
PCI DSS Readiness
| Scoping and Gap Assessment | Most Popular Full PCI DSS Readiness Program |
|---|---|
| From $4,000 | From $12,000 |
| Payment-data mapping; scope-reduction review; merchant or service-provider classification and SAQ or ROC route review. Review all 12 requirements for applicability; assess controls and evidence; deliver prioritized findings and a remediation roadmap. Evidence guidance and a readiness readout. Testing needs identified in the roadmap. |
Everything in Scoping and Gap Assessment, with a coordinated readiness plan through assessment preparation. Gap assessment plus remediation guidance, progress review, and segmentation and encryption guidance. Evidence preparation; SAQ or ROC and corresponding AOC preparation support; assessment handoff planning. Penetration testing coordination. |
| Confirmed in your proposal | 12 weeks |
| 30 days of follow-up access and complimentary refinements to the agreed readiness report. | 30 days of follow-up access and complimentary refinements to the agreed readiness report. |
06
HITRUST Readiness
| Criteria | Essentials e1 |
Comprehensive i1 |
Enterprise r2 |
|---|---|---|---|
| Starting price | From $9,000 per engagement | From $37,000 per engagement | From $60,000 per engagement |
| Delivery | 8 weeks | 12 weeks | 16 weeks |
| Scope | Assessment selection and scoping memo; MyCSF scoping; ownership map; implementation-focused gap register with relevant policy and procedure review; evidence structure and reuse map; roadmap and findings walkthrough. 30 days of follow-up access; 1 call. Assessor-question and evidence-request support. |
Core scoping, ownership, gap register, evidence and roadmap outputs; implementation scoring for the selected i1 baseline; policy and procedure gap drafting guidance; inherited-control review; corrective-action plan; external-assessor preparation and management readout. 30 days of follow-up access; 2 calls. Assessor-question and evidence-request support. |
Core readiness outputs with full scoping-factor analysis and tailored requirement selection; applicable maturity review, including measured and managed where targeted; evidence design across the selected scope; SOC 2, ISO 27001 and PCI DSS mapping; support through validated assessment and HITRUST quality assurance; leadership readout. 30 days of follow-up access; 4 calls. |
07
Virtual CISO
| Foundation | Most Popular Program |
Leadership |
|---|---|---|
| From $3,000/month | From $5,000/month | From $9,000/month |
| Initial priorities and roadmap; oversight for one framework or customer program; core policies; questionnaire support; audit guidance; monthly reporting; decision log | All deliverables in Foundation, plus: multi-framework program; full policy lifecycle; audit management and auditor liaison; vendor risk oversight; incident planning; awareness guidance; risk-register reporting | All deliverables in Program, plus: multi-entity program; quarterly board pack and session; budget planning; regulatory exam support; M&A and investor due diligence; tabletop exercises; ownership across business units |
| 20–75 people; a first program | 75–250 people; multiple frameworks | 250–500 people; regulated or multi-entity operations |
| Monthly leadership call; email and chat access | Bi-weekly calls; monthly leadership review | Weekly calls; monthly leadership review; quarterly board session |
| Fixed monthly pricing, with no lock-in or annual commitment. Cancel with 30 days’ notice. A first-month opt-out lets you keep all deliverables. | Fixed monthly pricing, with no lock-in or annual commitment. Cancel with 30 days’ notice. A first-month opt-out lets you keep all deliverables. | Fixed monthly pricing, with no lock-in or annual commitment. Cancel with 30 days’ notice. A first-month opt-out lets you keep all deliverables. |
| Discuss Virtual CISO Support → | Discuss Virtual CISO Support → | Discuss Virtual CISO Support → |
08
Third-Party Risk Management
| Essentials | Most Popular Comprehensive |
|---|---|
| From $6,000 setup | From $10,000 setup |
| Vendor inventory and tiering criteria · Up to 10 scoped vendor reviews · Due-diligence standard by tier · SOC report review framework (template) · Risk scoring model and register · Program document · Management readout · 30 days of follow-up access, 1 call | Everything in Essentials, with up to 25 vendor reviews · SOC report review applied to assessed vendors at the agreed depth · Remediation tracking and acceptance authority · Contract risk review support and clause library by tier · TPRM platform selection · Reporting template and management review readout · 30 days of follow-up, 2 calls |
| 4 weeks | 6 weeks |
| Up to 10 vendors | Up to 25 vendors |
| Discuss Third-Party Risk Management | Discuss Third-Party Risk Management |
09
Vendor Security Questionnaire Support
| Essentials | Most Popular Comprehensive |
|---|---|
| From $1,500 per engagement | From $2,500 per engagement |
| Questionnaire response and supporting evidence | Everything in Essentials, plus the additional deliverables below |
| Delivery in 1 week | Delivery in 2 weeks |
| 1 questionnaire, up to 150 questions | 1 questionnaire, up to 300 questions |
| Response tracker and evidence mapping | Reusable response library for SIG, CAIQ and common custom formats |
| Gap or exception register and recommended remediation | Organized evidence index |
| Internal approval workflow | Briefing for your customer’s follow-up security call |
| 30 days of follow-up access with 1 call | 30 days of follow-up access with 2 calls total |
| Discuss Your Security Questionnaire | Discuss Your Security Questionnaire |
10
ISO 42001 Readiness
| Readiness Assessment | Most Popular Full Readiness Program |
|---|---|
| From $5,000 per engagement | From $15,000 per engagement |
| • Agreed AI inventory and scope • Readiness findings • Prioritized roadmap • Management readout • Findings and recommendations for the documentation needed • Prioritized actions and recommended responsibilities • Readiness findings to inform your next steps |
Everything in the Readiness Assessment, plus: • Scoped AIMS policies, processes and supporting records • Implementation guidance • Hands-on governance support • Coordination of technical expertise • Included internal audit • Certification preparation • External-assessor collaboration, including support with assessor questions and evidence requests. |
| Assessment and roadmap Understand your current position and plan the work ahead 4–6 weeks for the Readiness Assessment 30 days of follow-up access Complex scopes quoted after scoping |
Build on the assessment and prepare for certification 16–24 weeks to readiness for the agreed scope 30 days of follow-up access Complex scopes quoted after scoping |
11
EU AI Act Readiness
| Entry Assessment | Most Popular Full Readiness |
|---|---|
| From $5,000 per engagement | From $12,000 per engagement |
| AI inventory and exposure memo Classification register Source-linked obligations map Governance gap register Prioritized roadmap Management readout |
Everything in Entry Assessment, plus… Governance documentation Assigned controls Oversight arrangements Evidence reviews |
| One entity, up to 3 AI systems | Up to 5 AI systems |
| 4 weeks for the stated assessment deliverables | 6 weeks for the stated governance deliverables |
| 30 days of follow-up access | 30 days of follow-up access |
Delivery periods cover the stated assessment and governance deliverables, subject to evidence and stakeholder availability. They do not represent completion of every technical remediation or conformity activity.
EU AI Act responsibilities and separately scoped work
Formal legal opinions, EU representation, conformity assessments, technical testing, model validation and technical system changes are outside this readiness scope. We do not issue regulatory approval or guarantee legal compliance. Your counsel confirms legal interpretations and your organization retains its operator responsibilities.
12
HIPAA Readiness
| Criteria | Security risk analysis and readiness review | Most Popular Full HIPAA Readiness Program |
|---|---|---|
| Starting price | From $3,500 | From $10,000 |
| Included | Includes ePHI scope and data-flow review, security risk analysis, evidence gaps, a prioritized remediation roadmap and management readout. | Everything in Security risk analysis and readiness review, plus tailored Security, Privacy and Breach Notification policies; implementation guidance and evidence review; training support and breach-response planning; BAA coordination; and a final readiness review. |
| Delivery | 3 weeks for the scoped assessment and roadmap | 12 weeks for the scoped readiness program |
| Follow-up access | 30 days for questions about agreed deliverables | 30 days for questions about agreed deliverables |
HIPAA scope and responsibility details
The assessment schedule and any remediation support are agreed separately. Engineering changes, policy implementation, training delivery, BAA drafting or negotiation, technical testing and incident-response operations need explicit responsibility, scope and acceptance criteria. A completed assessment does not mean those activities have been performed.
Control implementation, technical testing, workforce training and legal review of BAAs are separately defined rather than promised in every review. BAA coordination does not include legal drafting or approval.
These boundaries preserve included policy development, implementation guidance, evidence review, training support, breach-response planning and BAA coordination in the Full Readiness program. The written proposal or statement of work records specific responsibilities and acceptance criteria.
13
CMMC Level 2 Gap Assessment
| Scope | Details |
|---|---|
| Starting price | From US$5,000. Final fee confirmed after scoping. |
| Boundary | One agreed assessment boundary |
| Included | Existing-evidence and SSP review; draft SPRS worksheet; remediation/POA&M register; management walkthrough |
| Excluded | New SSP or policy creation; technical remediation; additional assessment boundaries; certification fees |
| Delivery | Confirmed after delivery effort and scope are validated. No fixed turnaround promised. |
14
NIST AI RMF Alignment
Model testing, red teaming, statistical validation, legal opinions and technical control implementation need appropriate specialist scope and authorization. A framework assessment does not turn absent technical evidence into a positive evaluation result.
Specialized evaluations are separately scoped.
Specialist evaluation and technical changes follow separately agreed responsibilities and schedules.
What Shapes the Final Fee?
Scope and boundaries. The number of entities, systems and environments changes the evidence and coordination required.
Assessment depth. Reviewing existing evidence, developing a management system and supporting implementation are different scopes of work.
Frameworks and shared evidence. The proposal identifies the requirements in scope and where existing evidence is reusable. Do not promise a universal percentage saving from control overlap.
Internal readiness. Available records, control ownership and access influence the work plan.
Deadlines and dependencies. Customer dates, stakeholder availability and independent assessor schedules must be reflected in a realistic engagement plan.
Know What Your Proposal Covers
Your proposal identifies the work we will perform, the deliverables you receive, your team's responsibilities and any separately arranged services. Review independent audit or certification fees, technical testing, platforms and implementation support against the relevant service scope rather than assuming they are included.
Pricing Questions
Vendor security questionnaire support: When are we invoiced? Your written proposal specifies payment milestones and response review points.
Third-party risk management: When are we invoiced? Your fixed-price proposal sets out the payment schedule, so you know what to expect before work begins.
Why do the prices start with “From”?
The displayed amount is the starting price for the stated engagement or tier. Your fee is confirmed after the relevant systems, deliverables and requirements are scoped.
What happens during the first consultation?
We discuss your business requirements, current challenges and deadlines, then identify an appropriate starting point. The written proposal confirms the agreed work and fee.
Is the consultation free?
Yes. The initial 30-minute consultation is free, with no obligation to proceed.
Are independent audit and certification fees included?
Review the relevant service scope and written proposal. Fees charged by an independent CPA firm, certification body or external assessor are separate unless an expressly agreed arrangement states otherwise.
When is payment due?
Payment terms for other engagements are confirmed in the written proposal.
What happens if our scope changes?
Changes to agreed work, timing or fee are documented before the additional work proceeds, following the engagement terms.
How should we choose a starting scope?
Start with the decision you need to make: an overview of your gaps, preparation for a specific assurance requirement, an evidence-backed questionnaire response or continuing security leadership. Compare the relevant service's deliverables and engagement basis as well as its starting amount. A lower starting price alone does not establish that two offers cover the same work.
Should we choose a project or monthly leadership?
A defined assessment or readiness project addresses an agreed set of deliverables. Monthly leadership addresses recurring program responsibilities under an agreed scope and cadence. Compare the work, capacity, minimum commitment and responsibilities in the relevant proposal. Team size alone does not determine which arrangement fits, and a monthly fee is not directly comparable with a one-time project fee.
How soon can an engagement begin?
Bring the required date and the systems, evidence and people involved to the consultation. The proposal confirms the start and delivery plan for the selected scope, including dependencies on your team and any independent assessor. Check the timing for the particular service and tier.
How do we confirm the billing basis?
Check the stated unit alongside the starting amount, then review the fee, payment schedule and change process in the proposal. A per-engagement starting amount and a recurring monthly fee describe different commitments.
Does readiness cover every security service we might need?
Identify continuous monitoring, incident response, hands-on technical testing and independent audit or certification as separate requirements when discussing your scope. Confirm who provides each required service, what is included in the proposal and which arrangements your organization needs to make. An assessment or readiness fee should not be treated as evidence that all of those requirements are covered.
Discuss Your Scope & Pricing
Choose the Scope Your Business Needs.
Bring your customer requirement, upcoming audit or security concern to a 30-minute consultation. We will discuss the starting point and the work required.
Free 30-minute consultation. No obligation.