year-round compliance operations

Compliance maintenance plan

Stay audit-ready between audits — continuously, not just in the eight weeks before renewal. Regulatory change implementation is NOT included. Monitoring and alerting is included. Implementation is scoped as a change order.

The program does not collapse after the audit

Most compliance programs hit a cliff after the SOC 2 report drops. Evidence stops collecting, policies go unreviewed, and by the next audit cycle you are starting over. The compliance maintenance plan prevents that cliff — keeping evidence current, controls active, and the program functional year-round.

Important: Regulatory change implementation (new rules, framework revisions, new frameworks) is NOT included. Monitoring and alerting is included. Implementation is scoped and quoted as a change order.

Pricing tiers

Starter

$1,600–$2,200

per month · ~5 hrs/month strictly capped · Onboard: 1–2 weeks post-audit

Overage: $185/hr · Hour cap strictly enforced

Monthly GRC platform evidence review (flag failing or expired controls)
Quarterly policy review flag (editorial only — not rewrite)
Annual risk register refresh support
Audit renewal preparation checklist (1 month prior)
GRC platform monitoring (Drata or Vanta)
Compliance calendar management (key dates, renewal milestones)

Growth · Most popular

$2,200–$3,700

per month · ~8 hrs/month · Onboard: 1 week

Overage: $195/hr · Regulatory change orders typically $1.5K–$6K depending on scope

Everything in Starter
Monthly GRC platform health report (control pass/fail rates, trend)
Policy maintenance (up to 3 editorial updates/month — not regulatory rewrites)
Vendor risk register monthly update (up to 10 vendors)
Security awareness training cadence oversight
Pre-audit evidence package preparation (60-day window before audit)
Quarterly compliance program status report

Professional

$3,700–$5,800

per month · ~12 hrs/month · Annual audit prep sprint included · Onboard: 1 week

Overage: $195/hr · Pen test vendor cost separate

Everything in Growth
Multi-framework maintenance (up to 2 frameworks)
Monthly security metrics dashboard update
Exception and deviation management and tracking
Annual policy library review and refresh (editorial only — regulatory rewrites separate)
Full pre-audit sprint (8-week intensive prep cycle — included annually)
Penetration test coordination (annual, included — test vendor cost separate)
1 tabletop exercise per year (standard scenario, included)

Enterprise

$5,800–$9,500+

per month · ~18 hrs/month · Full audit lifecycle included · Onboard: 3–5 days

Overage: $225/hr · Typical annual regulatory change budget: $5K–$20K

Everything in Professional
Multi-framework maintenance (3+ frameworks)
Continuous control monitoring (automated + manual review)
Monthly executive compliance dashboard
Board-level compliance reporting (quarterly)
Full audit lifecycle management (evidence, auditor coordination, management responses)
Compliance program maturity scoring (annual benchmark)

Highest-maturity combination

Combine vCISO Scale with Compliance Maintenance + MSSP Security Operations for the highest-maturity, fully managed security program available

The highest-maturity program: vCISO Scale + compliance maintenance + MSSP Security Operations.

We set up the ongoing maintenance program at the same time as the initial engagement — so the post-audit cliff never happens.