GRC software and managed compliance, priced for how you work
CISOGenie is an AI-powered GRC platform for DPDPA, ISO 27001, SOC 2 and 40+ other frameworks. Run it yourself with your own team, or have our experts take you from gap assessment to audit-ready in six weeks, at a fixed price.
Certify: your six weeks
Fixed scope- Week 1
Assess
Kick-off and gap assessment. Agree scope and plan.
- Weeks 2-3
Document
Prepare and approve policies, procedures and risks.
- Weeks 4-5
Implement
Put controls in place while the platform gathers evidence.
- Week 6
Internal audit
Test readiness, close gaps and sign off.
At the end of week 6 you're ready to book your certification audit.
Do you want to run compliance, or have it run for you?
Both options use the same CISOGenie platform, so you can start one way and switch later without losing your documents or evidence.
Expert-guided platform
Compliance management software your team runs
For organisations with an IT, security or compliance team that can own the program day to day.
- Manage frameworks, controls and policies in one place
- Let AI agents collect and validate evidence from your systems
- Track risks, vendors and audit readiness continuously
- Add frameworks as your requirements grow
Starter · Scaler · Enterprise: 2 to 5 frameworks, priced by quote
Expert-managed compliance
Our consultants build and run your program
For organisations without a security team, or without the time to get certified on their own.
- Gap assessment, policies and a full audit-ready document pack
- A consultant one hour a week, plus an internal audit before the real one
- Optional year-round vCISO, pen testing and monitoring
- Platform access included
Certify at a fixed price · Certify & Protect by quote
Explore managed packagesOne compliance management platform runs your whole program
Move from spreadsheets and screenshot folders to a single, continuously updated record of your compliance.
Compliance dashboard
Every requirement mapped and tracked in one place.
Automated evidence collection
Evidence pulled from your systems, not screenshots.
Risk management
A risk register with owners and treatment plans.
Third-party risk management
Track and assess your suppliers' security.
Audit management
Plan audits, record findings and track fixes.
Governance records
Change logs, corrective actions and management reviews.
Managed compliance packages
Two packages take your business from audit-ready to always protected. Both run on the CISOGenie platform and both can be extended from the add-on menu.
Package 1 · 6 weeks to audit-ready
Certify
Get audit-ready for ISO 27001, SOC 2, DPDPA or another framework, with a fixed price and a clear end date.
What we do together
- Gap assessment against your framework
- Policies, procedures and risk assessment
- Controls and evidence set up in the platform
- 1 hour a week of consultant support (6 hours)
What you walk away with
- A complete, audit-ready document pack
- Risk and supplier registers in the platform
- Evidence mapped to every requirement
- Internal audit report and readiness sign-off
Optional add-ons
- 24×7 SOC
- vCISO services
- Additional VAPT
- Phishing drills and custom training
- Consent Manager
- Data classification
Best for: getting certified for a customer or a tender. Includes 5 platform users.
Get a Certify quotePackage 2 · Audit-ready, then secure all year
Certify & Protect
The full six-week Certify engagement, then a security partner that keeps you certified, tested and monitored.
Custom quote
One-time setup, then a monthly subscription · for organisations up to 250 staff
Ongoing vCISO
- Continuous compliance upkeep
- Quarterly compliance and security reviews
- Quarterly security posture report
- Incident response support
Regular testing
- Quarterly AI-assisted VA/PT
- Code scanning in your build pipeline
- Quarterly user access reviews
- Half-yearly phishing drills and staff training
Data, privacy and trust
- Privacy compliance readiness
- Find and classify personal data
- Dark web, attack surface and cloud posture monitoring
- Trust Center to show customers your security
Best for: staying certified and secure year after year. Includes 10 platform users.
Get a Certify & Protect quoteChoose Certify if…
- You need certification for a customer or tender
- You want a fixed price and a clear end date
- Your IT provider handles day-to-day security
- You'd rather pick extras from the menu
Choose Certify & Protect if…
- You need to stay certified year after year
- You want regular penetration testing
- You hold sensitive customer or personal data
- You want a security partner on call
The certification body's audit fee is separate. Start with Certify and upgrade at any time. Your documents and evidence carry over. More than 250 staff or in a regulated sector? Ask about a custom program.
Need help with a specific task, such as a vulnerability assessment, pentest or security awareness training? See our services →
Who does what
We take care of
- Gap assessment, scope and project plan
- Policies, procedures, risk and supplier registers
- Control setup and automated evidence collection
- Internal audit and readiness sign-off
- Year-round upkeep and vCISO support (Certify & Protect)
You'll need
- Someone on your side to own the project
- An hour a week with your consultant
- System access so evidence can be collected
- Your IT team or provider to make technical fixes
- The certification body's audit fee
Want us to do more of the hands-on work? Add extra consultant hours.
Are you an MSSP, MSP or VAR? See our partner program
Extend any plan when you need to
Add these powerful capabilities to any base plan
Managed packages
24×7 SOC
Round-the-clock monitoring backed by threat intelligence, with triage, response and regular reports. The cover of an in-house security operations centre without hiring one.
All plans
vCISO services
Security strategy, board reporting, incident response planning, vendor oversight and audit liaison.
- Security strategy & roadmap
- Board & executive reporting
- Incident response planning
- Vendor risk oversight
- Audit prep & liaison
All plans
Additional VAPT
Extra web, network, API and cloud penetration tests covering OWASP Top 10 and SANS 25, with a re-test included.
- Web app, network, API & cloud VAPT
- OWASP Top 10 & SANS 25 coverage
- Executive summary + remediation roadmap
- Re-test after remediation included
- Findings auto-mapped to risk register
All plans
Phishing drills and custom training
Simulation campaigns plus role-based, branded training tracks with certificates.
- Role-based phishing simulation campaigns
- Risk-based user segmentation
- Role-based training tracks (Dev, Finance, Exec)
- Custom branding & messaging
- Completion certificates for audit evidence
All plans
Consent Manager
Cookie consent, DSAR automation and a consent audit trail for DPDPA, GDPR and CCPA.
- Cookie consent & preference center
- DSAR workflow automation
- Consent audit trail & logging
- Multi-regulation support (GDPR, DPDP, CCPA)
- Onboarding support + monthly actuals
All plans
Data classification
Discover sensitive data, label it, map data flows and report on your data inventory.
- Auto-discovery across cloud & on-prem
- Sensitivity labelling (PII, PHI, financial)
- Data flow mapping & lineage
- Policy-based classification rules
- Compliance-ready data inventory reports
Built to replace manual compliance work
AI agents do the evidence work
Agents collect and validate evidence from your APIs, tools and browsers, so your team stops chasing screenshots.
Risk-led, not checkbox-led
Controls, vendors and dark web exposure feed one risk register, so you fix what matters to the business first.
Software or experts, one platform
Start expert-guided or expert-managed and switch later. Your documents and evidence stay where they are.
Your data stays with you
Evidence is processed inside your environment, and we are SOC 2 and ISO 27001 certified ourselves.
From first call to audit-ready
Discovery call
Your goals, customers and deadlines.
Questions about plans and pricing
Teams in Bengaluru, Austin and Melbourne
