Help centre
When the Independent Assessor Comes In, and Who Contracts Them
You contract the independent assessor directly: the licensed CPA firm for a SOC 2 report, the accredited certification body for an ISO certificate, the QSA for a PCI DSS Report on Compliance. SecureRoot introduces partner CPA firms during SOC 2 scoping and introduces the certification bodies it works with, then prepares you, handles the assessor's evidence requests and helps close what they raise. SecureRoot never issues the report or certificate, and it never collects or marks up the assessor's fee, because the assessor has to stay independent of whoever built your controls.
About this help article
Written by SecureRoot Risk Advisory LLP.
Why
Why the assessor is a separate contract
An assessor that designed your controls would be auditing its own work. SOC reports are issued by CPAs under professional standards the AICPA sets, ISO certificates by accredited certification bodies, and Reports on Compliance by Qualified Security Assessors, and each must stay independent of the firm that built the programme. That is why the assessor's fee is never inside SecureRoot's quote, and why the assessor cannot be bundled into one price with readiness work.
SOC 2
SOC 2: the licensed CPA firm
- 01
Introduced at scoping
In the first phase, SecureRoot introduces its partner CPA firms, India-based practices and international firms that audit Indian SaaS companies remotely, and aligns on timeline. You choose one and contract with it directly, so its fee and timetable are known before you commit.
- 02
Fieldwork after readiness
For a Type 1, fieldwork follows once controls are designed and in place; for a Type 2, after the observation window. SecureRoot handles the auditor's requests and prepares your control owners for walkthroughs. Your management signs the assertion.
- 03
Fee
SecureRoot's readiness band is ₹1.5 lakh to ₹4.5 lakh, the same for either report. The CPA firm's fee is separate and quoted during scoping; the indicative market range in SecureRoot's cost guide is ₹2 lakh to ₹5 lakh for a Type 1 and ₹5 lakh to ₹12 lakh for a Type 2.
ISO standards
ISO/IEC 27001 and other ISO standards: the certification body
- 01
Chosen during the programme
SecureRoot introduces the certification bodies it works with; you choose one and contract with it directly. Audit fees vary between accredited bodies and rise with organisation size.
- 02
Stage 1 and Stage 2, after the internal audit
The certification body runs its Stage 1 and Stage 2 audits once the internal audit and management review are done. SecureRoot supports you through both, closes any nonconformity the auditor raises, and helps you sustain the system across annual surveillance visits.
- 03
Fee
For ISO/IEC 27001, SecureRoot's published figure of ₹1.5 lakh to ₹8 lakh is a total to certificate that counts the certification body's audit, but the body invoices you directly. For ISO/IEC 27701, ISO 22301, ISO/IEC 42001 and other ISO standards, the body quotes its own fee.
PCI DSS
PCI DSS: the QSA, where your level needs one
Your acquiring bank or the card brands set your level. If it calls for a Report on Compliance, a QSA completes it and you sign the Attestation of Compliance with them; if a self-assessment questionnaire applies, your own officer signs it and no assessor is needed. SecureRoot scopes, remediates, builds the evidence package and supports QSA fieldwork, but signs neither document. The QSA's fee and quarterly ASV scans sit outside SecureRoot's fee.
No assessor
Where there is no assessor to contract
- DPDP Act: there is no DPDP certificate and no accredited certifying body, so no such fee exists.
- HIPAA: there is no HIPAA certification to buy.
- Penetration testing: SecureRoot's own report, verified retest report and attestation letter are the deliverables. Where a tender or instrument names a CERT-In empanelled auditor, that auditor signs; SecureRoot is not empanelled.
Scope boundaries
What this does not cover
- SecureRoot is not a CPA firm, an accredited certification body or a QSA, and does not issue SOC 2 reports, ISO certificates, Reports on Compliance or Attestations of Compliance.
- The assessor's fee, timetable, sampling and opinion are set by the assessor, not by SecureRoot.
- Readiness support does not guarantee a report without exceptions, a certificate or a compliant validation.
Primary Sources
Where the Figures on This Page Come From
Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.
- System and Organization Controls: SOC Suite of Services
AICPA and CIMA · Link checked 2026-11-13
- 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022)
AICPA and CIMA · Link checked 2026-11-13
Related
Services and help that go with this
- Who can sign your security report
Which body qualifies each signatory.
- Planning a combined SOC 2 and ISO 27001 programme
Running two assessors on one control set.
- Your responsibilities in SOC 2 readiness
What your team supplies in each phase.
- SOC 2 readiness and audit support
The six phases, from scoping to fieldwork.
- ISO 27001 certification services
Through Stage 1, Stage 2 and surveillance.
- PCI DSS compliance
SAQ or Report on Compliance preparation.
- Pricing
Published bands and the third-party fees outside them.
Know the assessor's part before you commit
On the scoping call SecureRoot sets out which assessor your requirement needs, when they come in, and which fees are theirs rather than ours.