Pricing
Pricing: What SecureRoot Work Costs, in Rupees
SecureRoot Risk Advisory LLP publishes indicative bands in rupees for the work buyers ask about most. Every band here is indicative and dated, and becomes a fixed price in writing only after scoping. Where a band would mislead you, we say so and quote after scoping instead.
Get a scoped price
SecureRoot holds ISO/IEC 27001:2022 certificate IN60432E, issued by Staunchly Management & System Services Private Limited. That certificate describes how we run our firm, not your systems.
How to read these tables
Four columns, and two costs that sit outside every row
SecureRoot fee is our work. Third-party fee is money you pay somebody else. The body that certifies or audits you must stay independent of whoever built your controls. We never mark it up and never collect it. Timeline is the span our phases add up to, not a promise against your calendar. What is included lists the deliverables you keep.
Two costs sit outside every row. The first is your own team’s time producing evidence, running access reviews and sitting in auditor interviews. It is usually larger than either fee and shows on no invoice. The second is tooling you choose to buy. Bands are reviewed on the dates given, and the rupee figures are the primary statement.
VAPT and penetration testing
Web application, mobile application, API or network and infrastructure penetration test, per surface
Web application · Mobile application · API · Network and infrastructure
- SecureRoot fee
- ₹50,000 to ₹4 lakh, retest included ($500 to $4,200 as of 2 October 2026)
- Third-party fee
- None
- Timeline
- 1 to 3 weeks of testing, plus a retest window after your fixes
- What is included
- Manual, exploit-driven testing of one surface; proof of concept for every finding; findings report; executive summary; remediation guidance; verified retest report; attestation letter
Cloud, thick client, IoT and embedded testing
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- The same deliverable set; the scope drives the price
Secure code review, software composition analysis, configuration and hardening review
Secure code review · Software composition analysis · OS hardening · Active Directory audit · Database and web server configuration · Firewall and perimeter review · Cloud security configuration
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- Reviewed against the standard that applies, with fixes your engineers can act on
Testing is priced per surface. Where you land inside the band is the size of the surface, not a rate card. For a web application it is user roles and endpoints. For a mobile app it is Android, iOS or both. For an API it is endpoints and authentication schemes. For a network it is external or internal, and the host count. The retest is part of the engagement, so there is no second invoice for verifying a fix.
ISO 27001
ISO 27001 certification, total to certificate
- SecureRoot fee
- ₹1.5 lakh to ₹8 lakh (band supplied 18 September 2026; $1,600 to $8,300 as of 2 October 2026) — this is the total: our programme plus the certification body's audit
- Third-party fee
- The accredited certification body's Stage 1 and Stage 2 audit sits inside that total. You contract and pay it directly, priced on audit days
- Timeline
- 3 to 6 months to a first certificate
- What is included
- Gap assessment; risk assessment and treatment; Statement of Applicability; control documentation; implementation support; internal audit and management review; audit support
Annual surveillance
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The certification body's surveillance visit, quoted by them
- Timeline
- Annual
- What is included
- Evidence upkeep and surveillance support
A single office with one product sits near the bottom of that band. A multi-location operation starting from nothing sits near the top. SecureRoot is not an accredited ISO certification body. The certificate comes from the certification body. We cannot both build your ISMS and certify it.
SOC 2
SOC 2 readiness and audit support, Type 1 or Type 2
- SecureRoot fee
- ₹1.5 lakh to ₹4.5 lakh ($1,600 to $4,700 as of 2 October 2026) — the same band for either report
- Third-party fee
- The licensed CPA firm's audit fee, quoted during scoping. Indicative market range from our cost guide: Type 1 ₹2 lakh to ₹5 lakh; Type 2 ₹5 lakh to ₹12 lakh
- Timeline
- Type 1 in 8 to 12 weeks; a first Type 2 in 6 to 9 months, including a three-month observation period
- What is included
- Scope memo and audit roadmap; readiness assessment report; control matrix and remediated control set; automated evidence collection; support through fieldwork
SecureRoot is not a CPA firm and does not issue SOC 2 reports; a licensed CPA firm does. We introduce partner CPA firms during scoping and you contract with them directly. The compliance platform you use, if any, is quoted by its vendor.
DPDP Act
Startup under ten thousand users
- SecureRoot fee
- Under ₹50,000 a year
- Third-party fee
- None
- Timeline
- 13 to 23 weeks for the full programme; shorter for a gap assessment alone
- What is included
- Data discovery and flow map; gap assessment against the Act and the Rules; consent and notice framework; data principal rights playbook and breach procedure; retention schedule; readiness report
SME or mid-size company
- SecureRoot fee
- ₹1.5 lakh to ₹8 lakh
- Third-party fee
- None
- Timeline
- 13 to 23 weeks
- What is included
- As above, plus implemented safeguards
Large enterprise with subsidiaries and complex flows
- SecureRoot fee
- ₹15 lakh to ₹60 lakh
- Third-party fee
- None
- Timeline
- Quoted by phase
- What is included
- As above, phased: assessment, then implementation, then ongoing support
There is no certifying body under the DPDP Act, so no third-party audit fee exists. The drivers are data volume and the number of systems and processors. Cross-border transfers move the price, and so does how much work you want done for you rather than advised on. We price by phase rather than as one flat fee for “full compliance”.
Scoped before quoting
Frameworks we scope before quoting
Two of the thirteen frameworks on our compliance services hub carry a published band, and those two are ISO 27001 and SOC 2. The DPDP Act does not count as published: its tiers above come from our DPDP guides, not from a band on the service page. So eleven of the thirteen are scoped before quoting. That is a deliberate choice, not an evasion. A hosted-payment-page merchant and a service provider preparing a Report on Compliance are different PCI DSS projects. A number covering both would inform nobody.
PCI DSS
- SecureRoot fee
- Scoped against your SAQ type or ROC path, then quoted in writing
- Third-party fee
- QSA fieldwork where a Report on Compliance is needed; ASV quarterly scanning
- Timeline
- 3 to 5 months to a first validation; weeks for a short SAQ
- What is included
- Scope and card data flow diagram; gap assessment report; remediation plan; evidence package; SAQ or Report on Compliance support
HIPAA
- SecureRoot fee
- Scoped against your role as a business associate, then quoted
- Third-party fee
- None required by the rule; a client may demand an independent assessment
- Timeline
- 2 to 4 months
- What is included
- Security risk analysis report; HIPAA policy and procedure set; safeguard remediation plan; business associate agreement templates; breach notification procedure
GDPR
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- Records of processing activities; lawful basis register; data subject rights workflow; DPIA templates; breach response procedure
CCPA
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- Applicability assessment; personal information data map; consumer rights request workflow; updated privacy notices; service provider agreement review
ISO 27701
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The accredited certification body's two-stage audit, paid by you
- Timeline
- 4 to 6 months to a first certificate
- What is included
- Privacy gap assessment report; records of processing activities; PIMS policy set; controller and processor control mapping; certification audit support
ISO 22301
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The accredited certification body's two-stage audit, paid by you
- Timeline
- 4 to 6 months to a first certificate
- What is included
- Business impact analysis report; business continuity plans; exercise and test reports; BCMS policy set; certification audit support
ISO 42001
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The accredited certification body's two-stage audit, paid by you
- Timeline
- 4 to 6 months to a first certificate
- What is included
- AI system inventory; AI impact assessment reports; AI management system policy set; AI control mapping; certification audit support
NEN 7510
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The accredited certification body's two-stage audit, paid by you
- Timeline
- 4 to 6 months to a first certificate
- What is included
- Gap assessment report; healthcare risk assessment; access logging control design; NEN 7510 policy set; certification audit support
EU AI Act
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- AI system inventory and classification; obligation mapping report; gap assessment and roadmap; technical documentation templates; human oversight design
Third-party risk management
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- Vendor inventory and risk tiering; assessment questionnaire set; vendor due diligence reports; risk treatment and remediation plan; ongoing monitoring cadence
Managed services
SOC as a service · Virtual CISO · Virtual DPO · Red team · Phishing simulation · Attack surface management · Dark web monitoring · Security awareness training · Digital forensics
- SecureRoot fee
- Monthly retainer, scoped to your estate
- Third-party fee
- Tooling you choose to license
- Timeline
- Monthly, with a notice period
- What is included
- Monitoring, reporting and advisory output agreed in the retainer scope
If your framework is in this table, a scoping call is faster than a form. We ask what is in scope, write it down, and send a fixed price against that written scope.
What you receive
Deliverables you keep, whether or not you continue
A SaaS platform reached SOC 2 Type II on the first attempt, with 0 audit exceptions, audit-ready in 16 weeks. A hospital network covered 94% of DPDP Act obligations across 12 facilities. A lending platform fixed 27 findings and closed 100% of criticals inside its audit window. Read all three in case studies.
- A written scope, agreed before any work starts, that the price is held against.
- For testing: a findings report with proof of concept for every issue, an executive summary for your board, remediation guidance your engineers can act on, a verified retest report, and an attestation letter.
- For compliance: the phase documents listed in the tables above, each one a deliverable you keep whether or not you continue.
- Engineer-to-engineer fix support during remediation, with the person who found the issue explaining the fix.
- Critical findings within three hours of discovery, not at the end of the engagement.
From band to price
How a band becomes a price
- Step 1
Scoping call, 30 to 45 minutes
We ask what systems, how many, which standard, and what deadline.
- Step 2
Written scope
One page: what is in, what is out, what you supply.
- Step 3
Fixed price
Quoted against that scope, in writing, held for the scope as written. Not before.
- Step 4
Change control
If the scope grows, we re-quote the difference rather than issuing a surprise.
Third-party fees are never inside our quote. The certification body, the licensed CPA firm and the QSA invoice you directly. Independence from the people who built your controls is the point.
Plainly
What we are not
SecureRoot is not a CPA firm and does not issue SOC 2 reports; a licensed CPA firm does. SecureRoot is not an accredited ISO certification body; certificates come from the certification body. SecureRoot is not CERT-In empanelled. If your contract or regulator requires a CERT-In empanelled auditor’s report, say so on the scoping call. We will tell you where we fit and where we do not. Our reports are written to be used as audit and customer evidence, and clients do use them that way.
Questions
Before you ask for a quote
Why are some prices published and others not?
Two of the thirteen frameworks on our compliance hub carry a published band, and they are ISO 27001 and SOC 2. ISO 27001 runs ₹1.5 lakh to ₹8 lakh as a total to certificate. SOC 2 runs ₹1.5 lakh to ₹4.5 lakh for readiness and audit support. Penetration testing is a separate practice, banded per surface at ₹50,000 to ₹4 lakh with the retest included. The DPDP Act does not count as published, because its tiers come from our DPDP guides rather than from a band on the service page. The other eleven frameworks are scoped before quoting, because the honest spread is too wide. A hosted-payment-page merchant and a service provider preparing a Report on Compliance both do PCI DSS. Their projects share almost nothing, so one figure would serve neither. We scope first, then quote in writing.
Is the indicative band the price I will pay?
No. An indicative band tells you whether to keep reading; a quote tells you what to pay. The bands here are reviewed on the dates stated beside them, in rupees, with US dollar equivalents reviewed separately. Your price is set after a scoping call of 30 to 45 minutes and a one-page written scope. The scope says what is in, what is out and what you supply. The quote is fixed against that written scope, and we issue it in writing before work starts, never before scoping. If the scope later grows, we re-quote the difference instead of adding it quietly. Two things stay outside every quote. The first is fees paid directly to a certification body, licensed CPA firm or QSA. The second is your own team's time. That second cost appears on no invoice and is usually the larger of the two.
What third-party fees should I budget on top?
It depends on the framework, and we never mark these up or collect them. For ISO 27001 and the other ISO standards, an accredited certification body runs a Stage 1 and Stage 2 audit. It is priced on organisation size and audit days, and annual surveillance visits follow. For ISO 27001 that audit fee sits inside the published total above. For the other standards the body quotes it. For SOC 2, a licensed CPA firm issues the report and invoices you directly. Our cost guide gives an indicative market range for each report. A Type 1 is ₹2 lakh to ₹5 lakh. A Type 2 is ₹5 lakh to ₹12 lakh. For PCI DSS, budget QSA fieldwork where a Report on Compliance is required, plus quarterly ASV scanning. The DPDP Act has no certifying body, so no such fee exists.
Does the price include a retest after we fix things?
For penetration testing, yes. The retest is inside the engagement price, so there is no second invoice for confirming that a fix worked. When you tell us the fixes are in, the engineer who found each finding retests it and records the result. You receive a verified retest report you can hand to an auditor or a customer. A closed finding means fixed and retested, not acknowledged. If a fix does not hold, the finding stays open and we explain why. Compliance engagements work differently, because there is nothing to retest in the same sense. The equivalent is support through the certification body's or CPA firm's fieldwork, which is inside our fee. We also close any nonconformity the auditor raises. Remediation work that turns out larger than the agreed scope is re-quoted before it starts.
How long does each programme take?
Testing is the fastest: one to three weeks for a web application, mobile application, API or network. A retest window follows once your fixes are in. SOC 2 Type 1 takes eight to twelve weeks. A first Type 2 takes six to nine months, because the observation period is usually three months. Fieldwork follows it. ISO 27001 takes three to six months to a first certificate, including the certification body's two-stage audit. DPDP Act readiness runs thirteen to twenty three weeks across six phases. PCI DSS takes three to five months to a first validation. A merchant with a fully outsourced payment page and a short SAQ can finish in weeks. HIPAA readiness for an Indian business associate takes two to four months. What stretches any of these is remediation and how quickly your control owners produce evidence, not the size of the standard. We commit to dates after the gap assessment.
Can you bundle testing and compliance into one price?
Yes, and it is usually cheaper than buying them apart, because a certification programme needs a penetration test as evidence anyway. The same team scopes the ISO 27001, SOC 2 and DPDP Act programmes and runs the testing that evidences them. It works from one control set and one evidence base, on a single timeline. That means one scoping call, one written scope, one fixed price and one accountable team. The test is timed to your audit window and scoped to the systems the auditor will ask about. What cannot be bundled is the independent party. The certification body, the licensed CPA firm or the QSA must stay independent of whoever built the controls. Their fee stays separate and you contract with them directly. Tell us both needs on the scoping call and we will quote the combined programme.
Why did your old pricing page show dollar plans?
The page you may have found in a search result is a legacy URL from our previous website. It advertised monthly plans in US dollars. It no longer reflects how we work, and it has been retired in favour of this page. We do not sell monthly subscription plans for penetration testing. We scope an engagement, quote a fixed price in rupees against a written scope, and include the retest in that price. If a search result or a bookmark still sends you to the old URL, it now redirects here. If you were quoted from that old page, contact us and we will re-scope the work and quote it properly. Our US dollar figures still appear beside the rupee bands for overseas buyers. Rupees are the primary statement.
Tell us what is in scope and we will put a price on it
One scoping call, a one-page written scope, then a fixed price in writing. Nothing is chargeable until you accept that scope.