What drives compliance costs

Nobody publishes a single "compliance price" because there isn't one: the fee depends on the framework, your scope, and how ready you are. This page explains the cost drivers so you can budget honestly. For framework-specific figures with cited sources, each directory below publishes its own cost guide.

The six cost drivers

1. Framework. A self-assessment and a full third-party assessment are different products with different price tags. Know which one your customer, contract, or regulator actually requires before budgeting.
2. Scope. Entities, systems, locations, and data types in scope. Narrow, well-defined scope is the single biggest lever on the fee.
3. Readiness. Controls already operating cost far less to assess than controls that must be built during the engagement. Most first-timers need a readiness or gap phase first.
4. Observation period. Some reports require months of operating evidence (a Type 2, for example). That time is not free — it is staff time, tooling, and auditor attention.
5. Firm type. Boutique specialists, mid-market firms, and Big-Firm practices price differently and fit different buyers. Our directories group providers so you compare like with like.
6. Tooling. Evidence-collection and GRC platforms are a real line item in year one, separate from the audit or assessment fee.

Source-labeled figures by framework

Every network directory publishes its own cost guide with figures labeled by source. Start with yours:

• soc2type2.com — SOC 2 cost figures and estimator
• soc1certification.com — SOC 1 cost figures and estimator
• pcidsscompanies.com — PCI DSS cost figures and estimator
• pcidsscertification.com — PCI DSS cost figures and estimator
• pciaccreditation.com — PCI DSS cost figures and estimator
• pcianddss.com — PCI DSS cost figures and estimator
• pcicompliancecertification.com — PCI DSS cost figures and estimator
• cmmicertification.com — CMMC cost figures and estimator
• hipaahippa.com — HIPAA cost figures and estimator
• bsicertification.com — ISO 27001 cost figures and estimator
• cisacompliance.com — CISA-aligned security cost figures and estimator
• csfcompliance.com — NIST CSF cost figures and estimator
• nistframework.com — NIST cost figures and estimator
• glpcompliance.com — GLP cost figures and estimator
• openaicertifications.com — AI / ISO 42001 cost figures and estimator

Budget rule of thumb

Plan for the engagement fee plus a readiness phase plus tooling plus your own staff time — the last one is the line item buyers most often forget, and it is usually the largest. Year two is typically much cheaper once controls and tooling are in place.