Pricing
These are starting prices. After a 30-minute call, and an assessment where one is needed, we confirm a fixed price in writing before any work starts.
Monthly plans
Essentials
Day-to-day IT, run well.
$125
per user per month
$1,500 monthly minimum
- Help desk on business days, 9am to 6pm Eastern
- Microsoft 365 or Google Workspace administration
- Laptop and phone management, patching, and encryption
- New-hire setup and same-day offboarding
- Multi-factor authentication and single sign-on
- Backup of email, files, and calendars
Secure
IT with a security program built in.
$175
per user per month
$3,000 monthly minimum
- Everything in Essentials
- Endpoint detection and response, monitored around the clock
- Suspicious sign-in alerts and email phishing filtering
- Phishing simulations and staff security training
- Written security policies and an annual risk assessment
- Quarterly hardening review
- Security questionnaires, up to two per quarter
Compliance
Stay SOC 2 or ISO 27001 ready all year.
$250
per user per month
$5,000 monthly minimum
- Everything in Secure
- SOC 2 or ISO 27001 upkeep: evidence collection and control monitoring
- Quarterly access reviews and annual policy reviews
- Vendor security reviews
- Auditor coordination and support during each annual audit
- Security questionnaires, up to one per month
- A monthly security review with your named lead
Enterprise
For larger or more complex organizations.
Custom
Priced to your scope
- Everything in Compliance
- SOC 2 and ISO 27001 run together
- Several entities, offices, or cloud environments
- Fractional CISO time for board, investor, and customer meetings
- Contract terms and response times agreed with you
Compliance keeps you audit-ready after your first SOC 2 or ISO 27001. Getting there the first time is a project, priced below.
À la carte
One-time projects and advisory work, with or without a monthly plan.
| Service | Starting price | Notes |
|---|---|---|
| SOC 2 readiness and implementation | Type 1 from $9,500 | Type 2 program from $15,000 |
| ISO 27001 readiness and implementation | From $12,000 | Certification audit billed separately |
| Security advisory (vCISO) | From $2,500 per month | About 8 hours a month. $5,500 for about 16 hours. |
| Security assessment | From $2,500 | Fixed fee |
| SOC 2 or ISO 27001 upkeep | From $1,500 per month | About 6 hours a month. Included in the Compliance plan and in security advisory. |
SOC 2 and ISO 27001 prices cover our work only. Audit fees, compliance software, and penetration tests are paid to those vendors directly. The SOC 2 page shows a full first-year budget.
What changes the price
- Number of people and devices
- Regulatory exposure: SEC or FINRA oversight, payments, banks as customers
- How many SaaS tools and cloud accounts you run
- How much cleanup your environment needs before we can run it
- Which frameworks and how much of the business are in scope
- Deadlines, such as a customer who needs a SOC 2 report this quarter
Terms
- Twelve-month agreements are billed at list price.
- Month to month is list price plus 10%, with 60 days notice to cancel.
- Onboarding is one month of fees, at least $2,500. On a twelve-month agreement it is credited back on your second invoice.
- Hardware, software licenses, and projects are quoted separately.
- In-person meetings in New York City are free. Onsite work is billed hourly.
When we're the wrong fit
- You need the SOC 2 audit itself. Only a licensed CPA firm can issue the report. We prepare you for it and work with your auditor.
- You need someone onsite outside the New York City area. Everywhere else, our work is remote.
- You need 24/7 help desk support. Our help desk runs on business days, 9am to 6pm Eastern.
Talk to us
Tell us what's driving it: a customer deadline, a questionnaire, an exam, or IT that has outgrown whoever handles it now. A first call takes 30 minutes, and you'll leave knowing whether we're a fit and roughly what it costs.
Book a 30-minute callor send a message, or email contact@birchny.com.