Observed 4 October 2026 · every figure links to its source
What ISO 27001 compliance software costs
Most vendors in this category will not tell you. Of those that will, almost all charge by headcount, so the number you are quoted at twenty people is not the number you pay at two hundred. There are three structures, and the one you pick matters more than the sticker.
- StandardOS
- €249/mo excl. VAT, flat per organization, every feature, unlimited people, the 27 frameworks on the registry included; 7-day free trial, no card.
- Published elsewhere
- 6 of the 10 vendors read print a figure: Cyberday €320/mo to €1,790/mo; episki from US$7,500/yr; Strike Graph US$10,000/yr to US$35,000/yr; Hicomply £5,300/yr to £10,600/yr; ComplyJet US$7,999/yr to US$11,999/yr; LowerPlane US$4,995/yr to US$15,995/yr.
- Not published
- Vanta, Drata, Comp AI: a form or a call where the number should be. SecureSlate: the pricing page no longer exists.
- What moves the price
- Headcount at Cyberday, ComplyJet; the tier, the frameworks or the modules at episki, Strike Graph, Hicomply, ComplyJet, LowerPlane; nothing at StandardOS.
| Vendor | Published price | Shape | What moves it | Frameworks | Source, read on |
|---|---|---|---|---|---|
| StandardOS | €249/mo | Flat | nothing | 27 on one model, every one included: 27001, CRA, NIS2, DORA, 42001, AI Act, 9001, MR, GDPR, DA, 27701, EAA, 14001, PLD, RED, GPSR, NIS2 IR, RoHS, REACH, WEEE, PPWR, WB, BAT, Pay, EUDR, EED, CER. 12 integrations, 6 languages, no published reference customers. | /pricing4 October 2026 |
| Cyberday | €320/mo to €1,790/mo | Banded by headcount | headcount | 30+ ISO 42001: Not on the pricing page | their page4 October 2026 |
| Vanta | No figure. The button reads "Get personalized pricing". | On request | not stated | not stated ISO 42001: Listed; no separate price | their page4 October 2026 |
| Drata | No figure. The button reads "Get Started". | On request | not stated | not stated ISO 42001: Listed; no separate price | their page4 October 2026 |
| Comp AI | No figure. The button reads "Book my pricing call". "a flat rate would overcharge simple programs and undercharge complex ones" | On request | not stated | 12+ ISO 42001: Listed; no separate price | their page4 October 2026 |
| SecureSlate | The pricing page and the homepage now redirect to a domain-for-sale listing. | Gone | not stated | not stated ISO 42001: Not on the pricing page | their page4 October 2026 |
| episki | from US$7,500/yr | Tiered | modules | 16 ISO 42001: Add-on: +$6,000/year (AI Governance module) | their page4 October 2026 |
| Strike Graph | US$10,000/yr to US$35,000/yr | Tiered | tier, frameworks | 20+ ISO 42001: Add-on: Tier 2 framework, $3-5K/yr | their page4 October 2026 |
| Hicomply | £5,300/yr to £10,600/yr | Tiered | tier, frameworks | 9 ISO 42001: Listed; no separate price | their page4 October 2026 |
| ComplyJet | US$7,999/yr to US$11,999/yr | Tiered | frameworks, headcount | 25+ ISO 42001: Listed; no separate price | their page4 October 2026 |
| LowerPlane | US$4,995/yr to US$15,995/yr | Tiered | frameworks | 5 ISO 42001: Not on the pricing page | their page4 October 2026 |
5 → 0
Drata's own comparison of the category, published 3 September 2026, lists 5 products and prints a figure for none of them. their page
4 October 2026
Every figure re-read on this day. Next check: 2 January 2027. If a page has changed since, tell us and we correct it.
1 · No published price
The largest vendors put a form where the number should be. Checked on 4 October 2026:
- · Vanta, four tiers (Essentials, Plus, Professional, Enterprise). No figure on any of them. Every button reads "Get personalized pricing".
- · Drata, two platforms × three tiers. No figure on any of them. "Get Personalized Pricing", "Contact Sales".
We are not going to guess at what they charge. Third-party estimates circulate widely and they are estimates; repeating someone else's number as if it were a fact is the habit this page argues against. What is checkable is that the number is not published, and you can confirm that in about ten seconds by opening either link.
This is not an oversight on their part. A published number constrains what a salesperson can quote the next customer, and at enterprise scale that flexibility is worth more than the convenience it costs you.
2 · Published, banded by headcount
Several vendors do publish, including Cyberday, Strike Graph, Hicomply, ComplyJet, LowerPlane and episki. Publishing a price is no longer unusual, and we do not claim it is. What they nearly all share is that the price climbs with the number of people you employ, or with each framework you add.
Cyberday publishes the clearest example: 6 bands by employee count, €320/mo to €1,790/mo, read off their own pricing page on 4 October 2026. At the first band it is €320/mo against our €249/mo; the difference is what happens next. Hire past a band and the bill moves, whether or not the new people ever open the tool.
3 · Published, flat
€249/mo excl. VAT, flat per organization, every feature, unlimited people, the 27 frameworks on the registry included. It does not change when you hire.
That matters most where headcount and users are different numbers. A 400-person manufacturer with thirty people who will ever log in is paying a 400-person price on a banded plan for 370 people who will not. Same for logistics, healthcare, retail and energy: anywhere the workforce is larger than the office.
What this page is not telling you
It compares one thing: how the price behaves. It is not a feature comparison, and you should be suspicious of ours if we wrote one, because vendors grade their own homework and always pass.
Cyberday in particular covers far more frameworks than we do, and if you need TISAX or a sector scheme we do not hold, that is a real reason to choose them over us. We cover the 27 frameworks on the registry, every one included, and the honest version of our pitch is that we would rather do those properly than a longer list adequately. Whether that is the right trade is your call, not ours.
What we will not do is claim to be the only vendor publishing a price. That was true once and is not now, and you would find out in twenty minutes.
The software is the smaller number
Whatever you pay for tooling, the certification body's audit fee is a separate company you pay directly, and it is usually larger. Nobody publishes that either, but the auditor days are fixed by ISO/IEC 27006, so you can work it out before anyone quotes you.
Every competitor figure here was read from that vendor's own public pricing page on 4 October 2026 and nothing is quoted that we did not read ourselves. Prices change and pages move. If something here is out of date or wrong, tell us and we will correct it, because a comparison that decays quietly is worth less than none.