Short answer
Secureframe is the one vendor of seven that publishes a price (Fundamentals, starting at $7,500/year). Drata publishes the clearest limits (up to 50 FTEs and one pre-mapped framework on Foundation), Vanta and Sprinto publish questionnaire allowances, and Scytale publishes what its bundles contain, including consulting and a pen test. Scrut and Thoropass publish no plans.
By The Cost Desk, Compliance Pricing · Published 2026-09-29 · Prices and plans as published on vendor pages, read 2026-09-29.
| Vendor | Published price | Plans published | Entry plan | Stated limits | Questionnaires per year | Expert services | Audit path | Integrations stated | Source |
|---|---|---|---|---|---|---|---|---|---|
| Secureframe | Starting at $7,500/year | 3 | Fundamentals | 1 compliance framework | Not published | Audit partner network access | Access to the Secureframe Audit Partner Network is listed on Fundamentals. | 300+ integrations | Secureframe pricing page |
| Sprinto | Not published | 2 | Foundation | AI security questionnaire automation: 20 per year; Support 24x5, standard email and in-app | 20 (Foundation) | 24x5 email and in-app support | Foundation lists audit management, Sprinto network auditor access and bring your own auditor (BYOA). | 300+ integrations (pricing page) | Sprinto pricing page |
| Scytale | Not published | 5 | Build Starter | 1 framework | Not published | Consulting bundled in Build DFY and Build Stronger | Built-In Audit with partner auditors, run from an audit hub. | 100+ on its integrations page (the home page says 150+) | Scytale pricing page |
| Vanta | Not published | 4 | Essentials | One framework; Questionnaire Automation: 25 per year; Questionnaires: 144 per year | 25 (Plus), 144 (Professional) | Via expert partners | Sells an Audit product; its startup page cites 26k audits completed with AICPA-peer reviewed auditors (vendor figure). Audit inclusion by plan is not published. | 400+ tools | Vanta pricing page |
| Drata | Not published | 3 | Compliance Automation Foundation | Up to 50 FTEs; 1 pre-mapped framework: SOC 2, ISO 27001, Cyber Essentials, HIPAA or GDPR | Not published | Via partners | Auditors are part of the partner network. Audit inclusion by plan is not published. | Not published (the integrations page says "hundreds of tools") | Drata plans page |
| Thoropass | Not published | 0 | No plan published | Not published | Not published | In-house auditor support | Automation and audit from the same company; the audit and assessment offering is led by an audit partner. | Not published (integrations are described as vetted and approved by auditors) | Thoropass pricing URL |
| Scrut | Not published | 0 | No plan published | Not published | Not published | Not tied to a plan | Offers an Internal Auditor agent. An external audit path is not described in the material we reviewed. | 150+ integrations (in the Evidence Collector description) | Scrut website (no pricing page published) |
The pricing page shows Fundamentals at "Starting at $7,500/year" and lists Complete and Defense as quote-based plans.
RECEIPT NO. CP-2609-SEC
READ 2026-09-29
PLAN: Fundamentals
RECEIPT NO. CP-2609-SEC
READ 2026-09-29
PLAN: Complete
RECEIPT NO. CP-2609-SEC
READ 2026-09-29
PLAN: Defense
We list only the items recorded for each tier on the vendor's pricing page, read 2026-09-29. A tier may include more than shown here; check the vendor page.
The pricing page describes Foundation in detail and a Growth tier above it. No prices are shown.
RECEIPT NO. CP-2609-SPR
READ 2026-09-29
PLAN: Foundation
SEGMENT: For startups on their first certification
RECEIPT NO. CP-2609-SPR
READ 2026-09-29
PLAN: Growth
We list only the items recorded for each tier on the vendor's pricing page, read 2026-09-29. A tier may include more than shown here; check the vendor page.
The pricing page names three startup bundles and two security-team plans and lists what each bundle contains. No prices are shown; every plan leads to Get a demo.
RECEIPT NO. CP-2609-SCY
READ 2026-09-29
PLAN: Build Starter
SEGMENT: Startup bundles
RECEIPT NO. CP-2609-SCY
READ 2026-09-29
PLAN: Build DFY (Done for you)
SEGMENT: Startup bundles
Vendor label: Most popular
RECEIPT NO. CP-2609-SCY
READ 2026-09-29
PLAN: Build Stronger
SEGMENT: Startup bundles
RECEIPT NO. CP-2609-SCY
READ 2026-09-29
PLAN: Scale
SEGMENT: Security teams
RECEIPT NO. CP-2609-SCY
READ 2026-09-29
PLAN: Enterprise
SEGMENT: Security teams
We list only the items recorded for each tier on the vendor's pricing page, read 2026-09-29. A tier may include more than shown here; check the vendor page.
The pricing page lists four tiers (Essentials, Plus, Professional, Enterprise) with inclusions and questionnaire allowances. No prices are shown; buyers request a demo to get personalized pricing.
RECEIPT NO. CP-2609-VAN
READ 2026-09-29
PLAN: Essentials
RECEIPT NO. CP-2609-VAN
READ 2026-09-29
PLAN: Plus
RECEIPT NO. CP-2609-VAN
READ 2026-09-29
PLAN: Professional
Vendor label: Most popular
RECEIPT NO. CP-2609-VAN
READ 2026-09-29
PLAN: Enterprise
We list only the items recorded for each tier on the vendor's pricing page, read 2026-09-29. A tier may include more than shown here; check the vendor page.
The plans page lists Compliance Automation Foundation, GRC Advanced and GRC Enterprise with inclusions and a 50 FTE cap on Foundation. No prices are shown.
RECEIPT NO. CP-2609-DRA
READ 2026-09-29
PLAN: Compliance Automation Foundation
RECEIPT NO. CP-2609-DRA
READ 2026-09-29
PLAN: GRC Advanced
RECEIPT NO. CP-2609-DRA
READ 2026-09-29
PLAN: GRC Enterprise
We list only the items recorded for each tier on the vendor's pricing page, read 2026-09-29. A tier may include more than shown here; check the vendor page.
The /pricing URL shows no prices and no plan list; it redirects to home page content.
RECEIPT NO. CP-2609-THO
READ 2026-09-29
PLAN: No plan published
Not published
We list only the items recorded for each tier on the vendor's pricing page, read 2026-09-29. A tier may include more than shown here; check the vendor page.
The pricing URL returned "Page Not Found" on 2026-09-29. No plans or prices are published. The site offers a Compliance Cost Calculator.
RECEIPT NO. CP-2609-SCR
READ 2026-09-29
PLAN: No plan published
Not published
We list only the items recorded for each tier on the vendor's pricing page, read 2026-09-29. A tier may include more than shown here; check the vendor page.
Price clarity score (editorial assessment, 0 to 10). It measures how much a buyer can learn about cost and plan contents before a sales call, and how much service a published plan bundles. It is not a rating of product quality.
| Rank | Vendor | Pricing transparency (25%) | Entry plan contents (20%) | Stated plan limits (10%) | Expert services in a plan (20%) | Questionnaire allowance (10%) | Audit and pen test path (15%) | Weighted total |
|---|---|---|---|---|---|---|---|---|
| 1 | Secureframe | 9WhyThe one vendor in this census with a published number: Fundamentals starting at $7,500/year. Complete and Defense are quote-based. Secureframe pricing page | 7WhyFundamentals lists one framework, 300+ native integrations, monitoring, evidence, personnel, risk and policy management, Trust Center and audit partner access. Secureframe pricing page | 6WhyStates one compliance framework on Fundamentals; no other limits are published. Secureframe pricing page | 4WhyFundamentals lists access to the Audit Partner Network; no consulting service is listed in a plan. Secureframe pricing page | 4WhyQuestionnaire automation is listed on Complete; no annual count is published. Secureframe pricing page | 6WhyFundamentals includes access to the Audit Partner Network; pen testing is not listed in a plan. Secureframe pricing page | 6.35 |
| 2 | Sprinto | 5 | 9WhyFoundation lists 25+ frameworks out of the box, audit management, auditor access, BYOA, policies, training, risk tools, 20 questionnaires per year and a trust center. Sprinto pricing page | 7WhyStates 20 AI security questionnaires per year and 24x5 email and in-app support on Foundation. Sprinto pricing page | 4WhyFoundation lists 24x5 support and network auditor access; no consulting service is listed in a plan. Sprinto pricing page | 7 | 7WhyFoundation lists audit management, network auditor access and bring your own auditor; pen testing is not listed. Sprinto pricing page | 6.30 |
| 3 | Scytale | 4WhyNames five plans and lists what the three startup bundles contain, but publishes no price; every plan ends in Get a demo. Scytale pricing page | 5WhyBuild Starter lists the Build Platform Plan, one framework and add-ons; consulting and pen testing sit in the bundles above it. Scytale pricing page | 5WhyStates one framework on Build Starter; no headcount, questionnaire or support-hour limits are published. Scytale pricing page | 9WhyBuild DFY bundles LaunchReady Consulting and a black-box web app pen test; Scytale describes a dedicated compliance expert with weekly meetings who manages audit readiness. Scytale pricing page, Scytale compliance experts page | 4WhyOffers AI security questionnaires with expert review; no annual allowance is published. Scytale AI security questionnaires page | 8WhyBuilt-In Audit with partner auditors, and pen testing runs inside the platform and is bundled in Build DFY and Build Stronger. Scytale audit management page, Scytale penetration testing page, Scytale pricing page | 5.90 |
| 4 | Vanta | 5WhyLists four tiers with inclusions and questionnaire caps; no price, pricing is personalized after a demo. Vanta pricing page | 6WhyEssentials lists one framework, Vanta AI Agent, automated evidence, Trust Center and access to expert partners. Vanta pricing page | 8WhyStates one framework on Essentials and 25 or 144 questionnaires per year on Plus and Professional. Vanta pricing page | 5WhyEssentials includes access to expert partners; services are delivered by partners such as vCISOs, MSPs and MSSPs. Vanta pricing page, Vanta service providers page | 8 | 5WhySells an Audit product and cites 26k audits with AICPA-peer reviewed auditors (vendor figure); plan inclusion and pen testing are not listed. Vanta home page, Vanta startups page | 5.80 |
| 5 | Drata | 5WhyLists three plans with a headcount cap and framework rules; no price, the page offers Get Personalized Pricing. Drata plans page | 6WhyFoundation lists one pre-mapped framework, pre-built integrations, Trust Center Standard and AI Questionnaire Assistance Standard. Drata plans page | 9WhyStates up to 50 FTEs and one pre-mapped framework chosen from five named frameworks on Foundation, with add-ons named. Drata plans page | 4WhyServices come through a partner network (1300+ partners including vCISOs); no service is listed inside a plan. Drata partners page, Drata plans page | 5WhyFoundation includes AI Questionnaire Assistance Standard; no annual count is published. Drata plans page | 4WhyAuditors are part of the partner network; neither audit nor pen testing is listed in a plan. Drata partners page, Drata plans page | 5.25 |
| 6 | Thoropass | 1 | 1 | 1 | 6WhyDescribes an auditor-led model with in-house auditor support; plan inclusion is not published. Thoropass home page | 1 | 9WhyAutomation and audit come from one company, with pen testing and vulnerability scanning on the platform; plan pricing is not published. Thoropass home page | 3.20 |
| 7 | Scrut | 2WhyThe pricing URL returned Page Not Found on 2026-09-29; no plans or prices are published, though the site offers a Compliance Cost Calculator. Scrut website (no pricing page published), Scrut home page | 1 | 1 | 3WhyThe startup page mentions expert guidance and a playbook; no service is tied to a published plan. Scrut startups page | 1 | 3WhyOffers an Internal Auditor agent; external audit and pen test paths are not described in the material reviewed. Scrut home page | 1.95 |
On this price transparency ranking, Scytale ranks 3 of 7 (it ranks 1 on what the price buys) and scores lower than at least one rival on 5 of 6 criteria.
The ISO/IEC 27001:2022 standard itself (Edition 3, published 2022-10, 19 pages) is sold by ISO for CHF 155. Buying the standard does not include software, consulting or a certification audit.
Source: ISO/IEC 27001:2022 page, iso.org · read 2026-09-29
Sprinto's Foundation plan lists the most inclusions of any entry plan in this census, including audit management, auditor access, a trust center and 20 AI security questionnaires per year. It publishes no price.
Drata is the one vendor here that publishes a headcount cap: Compliance Automation Foundation covers up to 50 FTEs. The others do not publish headcount limits.
Scytale lists a pen test in its Build DFY (web app, black box) and Build Stronger (gray box) bundles, and Thoropass runs pen testing on its platform. The other pricing pages we read do not list one.