Ongoing GRC function
Managed GRC
$5,000 / month
Standard initial term of 12 months, subject to the signed agreement
An ongoing GRC function run by a named advisor. Starts with or without an existing program.
About Managed GRCManaged GRC for growing software companies
We run your security governance program.
GetComply is an outsourced governance, risk, and compliance function. A named advisor maintains your security policies, risk register, recurring reviews, evidence, vendor assessments, and customer security responses, and prepares for audits when you need them.
What GetComply handles
Policies and governance
Draft and maintain security policies and procedures, document approvals, and keep governance records current.
Risk and remediation
Maintain the risk register, document exceptions, prepare treatment options for management, and track remediation.
Recurring reviews and evidence
Coordinate access, vendor, and governance reviews, review the supporting evidence, and keep records of completed activities.
Vendor risk
Review the vendors that handle your data or support your service, document risk decisions, and follow up on identified issues.
Customer assurance
Prepare responses to customer security questionnaires and support agreed customer security calls.
Compliance and audits
Manage the compliance program and prepare for and coordinate audits.
Security awareness
Coordinate security awareness training for your employees.
AI governance
Where included in scope, govern the AI systems and implementations your company adopts.
Why companies use an outsourced GRC function
Governance work accumulates as a company grows, and it often falls on a founder, CTO, or another employee who already has a full-time job. A company may need that capacity without hiring a full-time GRC employee.
GetComply assigns an advisor who operates your agreed program and keeps its recurring activities on schedule.
Services and pricing
First SOC 2
Launch Readiness
$4,500 / month
Generally planned over four to six months
A focused engagement for a first SOC 2 examination.
About SOC 2 readinessStandalone assessment
Readiness Assessment
$7,500 one-time
A review of your current security program, controls, and gaps, with findings and a prioritized roadmap. Available separately from our monthly services.
Service detailsExpanded Managed GRC
Scale
From $7,500 / month
Managed GRC with a larger scope, quoted after scoping.
Service detailsCommon questions
No. Managed GRC works whether you hold a SOC 2 report, are pursuing one, or have no certification plans. The same governance work supports customer questionnaires, contracts, and vendor reviews.
No. An independent CPA firm conducts the examination and issues the report. GetComply prepares and operates the program.
No. You can start Managed GRC or Launch Readiness directly once a workable scope is agreed.
Client management. We prepare information and recommendations; management approves policies and decides how risks are handled.
Discuss your requirements
Tell us what your customers ask for, which systems are involved, and who handles security governance today.