Tier
Fundamentals has the published starting price; advanced third-party risk, access reviews, SSO and SCIM, and custom integrations are Complete features. Defense is a separate track for CMMC.
Pricing guide
Secureframe pricing: what it actually costs
Secureframe publishes a starting price for its entry tier and quotes the rest. This guide sets out what it publishes, what moves a quote, the figures on the public record, and the costs outside any licence.
Secureframe is the one vendor in this group that publishes a figure: its Fundamentals tier starts at $7,500 a year, while Complete and Defense are quoted. Each tier includes one compliance framework, with more available to add. The procurement platform Vendr reports a median of $20,000 a year across Secureframe purchases it has data on, and the audit is a separate cost — Secureframe's support pages say it depends on the auditor.
Last checked against Secureframe's public pages on .
What Secureframe publishes
Secureframe's pricing page lists three tiers. Fundamentals carries a published starting price; Complete and Defense say to get a quote. The page does not state what the price scales with.
Every tier includes one compliance framework, with the note that additional quantities can be added. Usage limits differ by tier: AI questionnaire answers and Trust Center document requests are capped on Fundamentals and much higher or unlimited on Complete.
| Tier | How Secureframe describes it |
|---|---|
| Fundamentals | Infrastructure monitoring, custom frameworks, controls and tests, evidence collection, personnel, risk and policy management, and a Trust Center. 100 AI questionnaire answers and 15 Trust Center document requests a year. |
| Complete | Everything in Fundamentals plus advanced third-party risk, risk management, user access reviews, Trust Center and questionnaire automation, SSO and SCIM, and custom integrations. 15,000 AI questionnaire answers a year. |
| Defense | Aimed at CMMC: SPRS score tracking, SSP and POA&M, a managed CUI enclave and managed virtual desktops. |
The figures on the record
Every figure on this page, with who published it and the date we read it. Third-party procurement figures describe other buyers' contracts, not a quote for yours; audit estimates are the audit firm's fee, not the platform's.
$7,500 a year (starting price)
Secureframe's published starting price for its Fundamentals tier. Complete and Defense are quoted on request.
Source: Secureframe, observed
$20,000 a year (median)
Vendr's median annual contract value for Secureframe, with a reported range of $7,733 to $32,575. Vendr does not state a sample size on the page, which it says was last updated in February 2026.
Source: Vendr, observed
What moves the bill
The variables a Secureframe quote is built from, as Secureframe describes them.
Number of frameworks
Each tier includes one compliance framework, and Secureframe notes that additional quantities can be added. Every standard after the first is a line to price.
Questionnaire and Trust Center usage
Fundamentals includes 100 AI questionnaire answers and 15 Trust Center document requests a year. A team fielding many security reviews will hit those limits and should price Complete.
Workspaces
Secureframe's tier comparison lists workspaces as an add-on on Complete — relevant if you run separate programmes for several entities or products.
Costs outside the licence
The platform fee is rarely the whole cost of a compliance programme. Budget for these whichever platform you choose.
The audit itself
Secureframe's pricing page includes access to its Audit Partner Network, and its support FAQ says the cost depends on the auditor. Budget the audit firm's fee as a separate contract.
Penetration testing
Most SOC 2 and ISO 27001 programmes commission at least one external penetration test a year, and enterprise buyers increasingly ask for the summary. It is a separate engagement unless a quote explicitly bundles it.
Your team's time
Someone owns the programme: writing and approving policies, closing control gaps, answering the auditor and keeping evidence current between audits. Automation shrinks that work but does not remove it, and it is usually the largest cost that never appears on an invoice.
Switching later
Evidence collected from your own systems can be re-collected by another platform; policies, risk registers and audit history need exporting. Ask how exports work before you sign, because the cost of leaving is part of the cost of joining.
Questions to put in the quote request
Which frameworks are included at the price quoted, and what does each additional framework cost?
What headcount, entity or connected-system limits does the quote assume, and what happens when we cross them?
Which line items are add-ons — questionnaire automation, trust center, vendor risk, access reviews, AI features?
Is the audit included? If so, which firm, which report types, and how many audit cycles?
What is the renewal cap, and is it in the order form?
Where is our data hosted by default, and is an EU region included or extra?
Can we export policies, evidence and audit history in a usable format if we leave?
How Noru is priced
Noru does not publish a price list either, and there is no self-serve sign-up. Every deployment includes the platform — one control library mapped across 30+ frameworks, continuous evidence from 20+ integrations, Cortex AI grounded in your programme, EU data residency, role-based access control, a DPA and an SLA — and you license the capability packages your obligations require on top.
Each package is priced per deployment by the scope it governs: Compliance & Audit by the frameworks in scope and the size of your workforce, Privacy Automation by the systems connected and the processing activities in scope, AI Governance by the AI systems under governance, and Third-Party & Supply Chain Risk by the vendors under management. You get a written quote after a demo that itemises each one.
Noru is not an audit firm. Your auditor's fee is a separate contract whichever platform you pick; Noru's job is to have the evidence collected and mapped before the auditor asks for it.
Noru vs Secureframe: the full comparison · How Noru pricing works
How much does Secureframe cost?
Secureframe publishes a starting price of $7,500 a year for its Fundamentals tier and quotes Complete and Defense. Vendr reports a median of $20,000 a year across Secureframe purchases it has data on, with a range of $7,733 to $32,575.
Does Secureframe charge for additional frameworks?
Each Secureframe tier includes one compliance framework, and its pricing page notes that additional quantities can be added. The page does not state the price per framework, so ask for it in the quote.
Does Secureframe's price include the audit?
Secureframe's pricing includes access to its Audit Partner Network, and its support FAQ says the cost depends on the auditor — so the audit firm's fee sits outside the subscription.
Is Noru cheaper than Secureframe?
Noru does not publish a price list, so there is no figure to set against Secureframe's starting price. Noru licenses the platform plus the capability packages your obligations require, priced per deployment by the scope you run. Book a demo for a written quote and compare it with Secureframe's.
Primary sources
Every claim about Secureframe on this page comes from the public pages below, last checked on . Competitor products and prices change — if something here is out of date, tell us and we will correct it.
Get a written quote to compare
We walk the platform against your obligations, agree the packages and scope, and send a written quote — or tell you Noru isn't the right fit.