Transparent, predictable pricing
No hidden fees. Start with a free trial, upgrade when you're ready.
Prices are for businesses and exclude VAT, which is added at checkout. Subscriptions renew yearly at the standard price until you cancel. See our Terms of Service.
Always Free
- 30-question cross-framework readiness assessment
- Maps to CE, ISO 27001, CAF, and DORA simultaneously, plus an indicative Defence Cyber Certification (DCC) line
- Prioritised gap analysis and roadmap
- Seven questions on Defence Cyber Certification Level 0
- Scored the same way as the full DCC Readiness Assessment
- No account needed; answers stay in your browser
- Carries over into the full assessment
- Cyber Essentials, CAF, DORA, ISO 27001, ISO 42001, AI Governance, CRMA, NIST CSF 2.0, CIS Controls v8.1, NIS2 Directive, SOC 2 Readiness, UK GDPR
- The full report for every assessment
- One Phronesis AI analysis run per assessment
- Sector benchmarking
- PDF, JSON, and share export restricted during trial
Assessment Products
Annual billing only. New subscribers save 17% in year one across every product on this page.
- 12 compliance frameworks — CE, CAF, DORA, ISO 27001, ISO 42001, AI Governance, CRMA, NIST CSF 2.0, CIS Controls v8.1, NIS2 Directive, SOC 2 Readiness, UK GDPR
- ISO 42001 certification readiness: your next audit, likely findings and a Statement of Applicability
- Phronesis AI analysis (3 runs/month, shared across all your assessments) + generous daily chat allowance
- Evidence Vault, Audit Pack & AI Policy Generator (20 templates)
- Remediation Tracker & Risk Scenarios
- Risk management for ISO 27001, ISO 42001 and the CAF — risk register, method, RACI, business assets, Statement of Applicability and AI impact assessments, with or without an assessment
- Compliance Passport & Peer Benchmarking
- Full PDF, JSON & share, and shared gaps across your frameworks
- Everything in Solo
- Shared scores across all 12 frameworks
- Collaborative drafts with cross-device sync
- Team Remediation Tracker with shared assignments
- Activity log & team admin controls
- Owner + up to 10 additional seats (11 people) — larger teams: contact us
- Cyber Essentials v3.3 assessment
- Single Phronesis AI analysis
- CE Plus readiness preview via M365 signals
- 30-day read access + PDF export
Risk Operations
The Assessment Bundle and the Third Party Risk Hub on one subscription, for £1,988 a year less than buying both (£13,978). Annual billing; new subscribers save 17% in year one. Already have one of them? Contact us to switch and we’ll credit what’s left of your current year.
- Everything in Solo — all 12 compliance frameworks, Phronesis AI analysis, Evidence Vault, Audit Pack, Policy Generator and risk management
- The Third Party Risk Hub for up to 200 suppliers — questionnaires, Risk Purview scans and portfolio risk tracking
- £1,988 a year less than the Bundle (£2,988) and the Third Party Risk Hub (£10,990) bought separately
- Add any specialist assessment — PE Due Diligence, SOC Maturity, CMMC + FedRAMP, HIPAA, DCC — at the add-on price (not included)
- Everything in Risk Operations
- Every person gets the Assessment Bundle, with shared scores, drafts and remediation
- One shared supplier portfolio (up to 200 suppliers), with owner, admin, editor and viewer roles
- Owner + up to 10 additional seats (11 people) — larger teams: contact us
Specialist Assessments
For PE firms, SOC teams, defence contractors, cloud service providers and US healthcare entities. Buy any of them on its own, or add it to the Assessment Bundle for less. Annual billing; new subscribers save 17% in year one.
- 14-theme IASME-aligned assessment (70 questions)
- IASME tier badge and RAG deal risk rating
- 100-day remediation plan with cost band
- Phronesis AI deal analysis
- Repeatable analysis runs, 3 a month
- 7-domain capability assessment (70 questions)
- SOC type filtering (Enterprise, SMB, MSSP)
- Includes the full SOC-CMM assessment: 667 importance-weighted questions, 5 domains, 27 aspects, scored as the SOC-CMM tool does
- Practitioner evidence capture
- Phronesis AI analysis
- Repeatable analysis runs, 3 a month
- All 110 NIST SP 800-171 Rev 2 practices (14 families)
- Your SPRS score and the CMMC status your answers qualify for
- What to meet before the assessment, and what can go on a POA&M
- Plain-English guidance alongside official NIST wording
- Phronesis AI analysis
- Repeatable analysis runs, 3 a month
- All 323 NIST SP 800-53 Rev 5 Moderate baseline controls (18 families)
- Plain-English guidance alongside official NIST wording
- Suggested answers from a finalised CMMC run (shared controls)
- Phronesis AI analysis
- Repeatable analysis runs, 3 a month
- 47 questions across Administrative, Physical & Technical Safeguards
- Required vs. Addressable specifications scored correctly
- With the Assessment Bundle: suggested answers from a finalised NIST CSF 2.0 run
- Phronesis AI analysis
- Repeatable analysis runs, 3 a month
- Defence Cyber Certification (Def Stan 05-138) readiness, Level 0 to Level 3
- 149 controls; you answer only the questions your target level asks
- Scope checks built in, and with the Assessment Bundle a check of your Cyber Essentials result
- Phronesis AI analysis
- Repeatable analysis runs, 3 a month
Third Party Risk Hub
Supplier questionnaire distribution, Risk Purview external verification, and portfolio risk tracking. Annual billing; new subscribers save 17% in year one.
- Up to 200 suppliers
- Questionnaire distribution with email delivery
- Risk Purview passive scans (attack surface, breach intel, SSL/DNS hygiene, corporate register)
- Weekly automated re-scans with drift alerts
- Custom questions — author up to 100 bespoke scorable questions, append up to 100 per send
- Phronesis Portfolio Risk Analysis — AI-generated narrative report across your full supplier portfolio, covering aggregate risk posture, critical gaps, and prioritised remediation guidance
- Trend sparklines and contradiction detection
- Add the Assessment Bundle for £1,000 a year more with Risk Operations
- Unlimited suppliers
- Everything in Third Party Risk Hub
- Daily automated rescans across your full supplier estate
- Priority CVE triage & SOC alerting — critical findings surfaced to your security team in real time, not just weekly re-scan summaries
- Higher frequency breach intelligence — more frequent credential and data breach monitoring with SOC alerting
- Dedicated processing infrastructure
- SLA-backed response times
| Feature | Third Party Risk | Enterprise |
|---|---|---|
| Suppliers managed | Up to 200 | Unlimited |
| Questionnaire distribution & email delivery | ✓ | ✓ |
| Risk Purview passive scans (breach intel, SSL/DNS, attack surface, Companies House) | ✓ | ✓ |
| Automated rescans & drift alerts | Weekly | Daily |
| Trend sparklines & contradiction detection | ✓ | ✓ |
| Phronesis Portfolio Risk Analysis Report | ✓ | ✓ |
| Custom scorable questions (up to 100 authored, 100 per send) | ✓ | ✓ |
| Priority CVE triage & real-time SOC alerting | — | ✓ |
| Higher frequency breach intelligence & SOC alerting | — | ✓ |
| Dedicated infrastructure & SLA | — | ✓ |
Feature Comparison
| Feature | Free Trial | CE One-Shot | Solo | Team |
|---|---|---|---|---|
| Compliance Readiness Assessment | ✓ | ✓ | ✓ | ✓ |
| Cyber Essentials Assessment | ✓ | ✓ | ✓ | ✓ |
| CAF, DORA, ISO 27001, ISO 42001, AI Governance, CRMA, NIST CSF 2.0, CIS Controls v8.1, NIS2 Directive, SOC 2 Readiness, UK GDPR | ✓ | — | ✓ | ✓ |
| Full assessment report | ✓ | ✓ | ✓ | ✓ |
| Phronesis AI Analysis | 1 run per assessment | 1 run | 3 / month | 3 / month |
| PDF / JSON Export | — | ✓ | ✓ | ✓ |
| Share Results | — | ✓ | ✓ | ✓ |
| Sector Benchmarking | ✓ | ✓ | ✓ | ✓ |
| Shared gaps across your frameworks | — | — | ✓ | ✓ |
| AI Policy Generator | — | — | ✓ | ✓ |
| Evidence Vault | — | — | ✓ | ✓ |
| Audit Pack | — | — | ✓ | ✓ |
| Remediation Tracker | — | — | ✓ | ✓ |
| Risk management: risk register, method, RACI, business assets, Statement of Applicability and AI impact assessments (no assessment needed first) | — | — | ✓ | ✓ |
| Risk Scenarios | ✓ | ✓ | ✓ | ✓ |
| Multi-user team access | — | — | — | ✓ |
| Result Access Duration | 7 days | 30 days | Unlimited | Unlimited |
Frequently Asked Questions
How does Team pricing work?
The Team plan starts at £2,480 in year one (£2,988/year standard from year two), which covers the account owner (one seat). Each additional team member costs £685 in year one (£828/year standard from year two), for up to 10 additional seats (11 people total). All prices are billed annually. All team members share the same assessment portfolio and there is no minimum beyond the included base seat. Need a bigger team? Contact us for pricing beyond 11 seats.
Can I upgrade from a free trial to a paid plan?
Yes. Your assessment data is preserved when you upgrade. Contact us and we'll activate your subscription immediately.
How many Phronesis AI analysis runs do I get on the free trial?
One run per assessment — so you can sample Phronesis across all twelve frameworks (Cyber Essentials, CAF, DORA, ISO 27001, ISO 42001, AI Governance, CRMA, NIST CSF 2.0, CIS Controls v8.1, NIS2 Directive, SOC 2 Readiness, UK GDPR). This matches the CE One-Shot product (one run per purchase). Subscribe to the Assessment Bundle for 3 analysis runs per month, shared across all your assessments — re-run whichever framework you need, whenever you need it, up to your monthly allowance. This monthly allowance resets every calendar month regardless of your annual billing date.
Do I have to run an assessment before I can use risk management?
No. Your risk register, risk method, RACI, business assets and Statement of Applicability can all be set up and approved before any assessment, for your organisation or, on an MSP plan, for each client. Many ISMS managers and vCISOs start there and run the ISO 27001, ISO 42001 or CAF assessment once the management system has taken shape; the assessment then builds on what’s recorded. Risk management comes with the Assessment Bundle (Solo and Team), Risk Operations, every specialist assessment and the MSP plans. It uses no Phronesis analysis, so it never counts against your allowance.
What happens when my CE One-Shot expires?
After the 30-day read-only window, your results are no longer accessible. You can purchase another one-shot or upgrade to the Assessment Bundle for ongoing access.
How does the 17% year-one discount work, and what happens at renewal?
Every annual subscription on this page (Assessment Bundle Solo/Team, PE Due Diligence, SOC Maturity, CMMC + FedRAMP, HIPAA, DCC Readiness, and Third Party Risk Hub) is discounted 17% for your first 12 months. From your second year onward, your subscription renews automatically at the standard annual price shown on each card — there's no separate step or price increase beyond returning to standard pricing, and we'll email you before your first renewal so there are no surprises.
Is there a contract or commitment period?
Subscriptions (Assessment Bundle, PE Due Diligence, SOC Maturity, CMMC + FedRAMP, HIPAA, DCC Readiness, Third Party Risk) are billed annually and can be cancelled at any time — cancelling stops the next renewal but does not refund the current year. CE One-Shot is a single payment with no recurring commitment.
Do you offer discounts for multiple products?
Yes. Contact us to discuss bundled pricing if you need both assessments and Third Party Risk Hub access.
Questions? Talk to us.
Our team can help you choose the right plan and get set up.
Contact Us