Pricing
Pricing: What SecureRoot Work Costs, in Rupees
SecureRoot Risk Advisory LLP publishes indicative bands in rupees for the work buyers ask about most. Every band here is indicative and dated, and becomes a fixed price in writing only after scoping. Where a band would mislead you, we say so and quote after scoping instead.
Get a scoped price
SecureRoot holds ISO/IEC 27001:2022 certificate IN60432E, issued by Staunchly Management & System Services Private Limited. That certificate describes how we run our firm, not your systems.
How to read these tables
Four columns, and two costs that sit outside every row
SecureRoot fee is our work. Third-party fee is money you pay somebody else. The body that certifies or audits you must stay independent of whoever built your controls. We never mark it up and never collect it. Timeline is the span our phases add up to, not a promise against your calendar. What is included lists the deliverables you keep.
Two costs sit outside every row. The first is your own team’s time producing evidence, running access reviews and sitting in auditor interviews. It is usually larger than either fee and shows on no invoice. The second is tooling you choose to buy. Bands are reviewed on the dates given, and the rupee figures are the primary statement.
Why we can publish a band at all. SecureRoot is not a CPA firm, not an accredited ISO certification body, not a QSA and not CERT-In empanelled, so none of those fees is ours to quote, bundle or mark up. The licensed CPA firm, the certification body, the Qualified Security Assessor and an empanelled auditor invoice you directly, which is exactly why the SecureRoot fee column can carry a number. What we are not, in full.
VAPT and penetration testing
Web application, mobile application, API or network and infrastructure penetration test, per surface
Web application · Mobile application · API · Network and infrastructure
- SecureRoot fee
- ₹50,000 to ₹4 lakh, retest included ($500 to $4,200 as of 2 October 2026)
- Third-party fee
- None
- Timeline
- 1 to 3 weeks of testing, plus a retest window after your fixes
- What is included
- Manual, exploit-driven testing of one surface; proof of concept for every finding; findings report; executive summary; remediation guidance; verified retest report; attestation letter
Cloud, thick client, IoT and embedded testing
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- The same deliverable set; the scope drives the price
Secure code review, software composition analysis, configuration and hardening review
Secure code review · Software composition analysis · OS hardening · Active Directory audit · Database and web server configuration · Firewall and perimeter review · Cloud security configuration
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- Reviewed against the standard that applies, with fixes your engineers can act on
Testing is priced per surface. Where you land inside the band is the size of the surface, not a rate card. For a web application it is user roles and endpoints. For a mobile app it is Android, iOS or both. For an API it is endpoints and authentication schemes. For a network it is external or internal, and the host count. The retest is part of the engagement, so there is no second invoice for verifying a fix.
ISO 27001
ISO 27001 certification, total to certificate
- SecureRoot fee
- ₹1.5 lakh to ₹8 lakh (band supplied 18 September 2026; $1,600 to $8,300 as of 2 October 2026) — this is the total: our programme plus the certification body's audit
- Third-party fee
- The accredited certification body's Stage 1 and Stage 2 audit sits inside that total. You contract and pay it directly, priced on audit days
- Timeline
- 3 to 6 months to a first certificate
- What is included
- Gap assessment; risk assessment and treatment; Statement of Applicability; control documentation; implementation support; internal audit and management review; audit support
Annual surveillance
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The certification body's surveillance visit, quoted by them
- Timeline
- Annual
- What is included
- Evidence upkeep and surveillance support
A single office with one product sits near the bottom of that band. A multi-location operation starting from nothing sits near the top. SecureRoot is not an accredited ISO certification body. The certificate comes from the certification body. We cannot both build your ISMS and certify it.
SOC 2
SOC 2 readiness and audit support, Type 1 or Type 2
- SecureRoot fee
- ₹1.5 lakh to ₹4.5 lakh ($1,600 to $4,700 as of 2 October 2026) — the same band for either report
- Third-party fee
- The licensed CPA firm's audit fee, quoted during scoping. Indicative market range from our cost guide: Type 1 ₹2 lakh to ₹5 lakh; Type 2 ₹5 lakh to ₹12 lakh
- Timeline
- Type 1 in 8 to 12 weeks; a first Type 2 in 6 to 9 months, including a three-month observation period
- What is included
- Scope memo and audit roadmap; readiness assessment report; control matrix and remediated control set; automated evidence collection; support through fieldwork
SecureRoot is not a CPA firm and does not issue SOC 2 reports; a licensed CPA firm does. We introduce partner CPA firms during scoping and you contract with them directly. The compliance platform you use, if any, is quoted by its vendor.
DPDP Act
Startup under ten thousand users
- SecureRoot fee
- From ₹1.5 lakh
- Third-party fee
- None
- Timeline
- 13 to 23 weeks for the full programme; under two weeks for a gap assessment alone
- What is included
- Data discovery and flow map; gap assessment against the Act and the Rules; consent and notice framework; data principal rights playbook and breach procedure; retention schedule; readiness report
SME or mid-size company
- SecureRoot fee
- ₹1.5 lakh to ₹8 lakh
- Third-party fee
- None
- Timeline
- 13 to 23 weeks
- What is included
- As above, plus implemented safeguards
Large enterprise with subsidiaries and complex flows
- SecureRoot fee
- ₹15 lakh to ₹60 lakh
- Third-party fee
- None
- Timeline
- Quoted by phase
- What is included
- As above, phased: assessment, then implementation, then ongoing support
Audit or gap assessment only — startup under ten thousand users
- SecureRoot fee
- ₹40,000 to ₹1 lakh
- Third-party fee
- None
- Timeline
- Under two weeks
- What is included
- Data discovery and flow map; gap assessment against the Act and the Rules; findings report with a prioritised remediation plan. Implementation is quoted separately, from the programme tiers above.
Audit or gap assessment only — SME up to five hundred thousand users
- SecureRoot fee
- ₹1 lakh to ₹3 lakh
- Third-party fee
- None
- Timeline
- 3 to 5 weeks
- What is included
- As above, across more systems and processors
Audit or gap assessment only — mid-size, multi-system
- SecureRoot fee
- ₹2.5 lakh to ₹6 lakh
- Third-party fee
- None
- Timeline
- 4 to 6 weeks
- What is included
- As above, plus processor contract review and cross-border transfer mapping
Audit or gap assessment only — large enterprise
- SecureRoot fee
- ₹6 lakh to ₹15 lakh
- Third-party fee
- None
- Timeline
- 6 to 10 weeks
- What is included
- As above, across subsidiaries and group entities
vDPO retainer — startup or light scope
- SecureRoot fee
- ₹30,000 to ₹60,000 a month
- Third-party fee
- None
- Timeline
- Monthly, on a six-month minimum term
- What is included
- Formal DPO appointment and registered point of contact; record of processing activities and data map; rights and consent handling process; breach response plan and notification support; privacy programme report on an agreed cadence
vDPO retainer — SME
- SecureRoot fee
- ₹60,000 to ₹1.2 lakh a month
- Third-party fee
- None
- Timeline
- Monthly, on a six-month minimum term
- What is included
- As above, across more systems and processors
vDPO retainer — mid-size or regulated sector
- SecureRoot fee
- ₹1.2 lakh to ₹2.5 lakh a month
- Third-party fee
- None
- Timeline
- Monthly, on a six-month minimum term
- What is included
- As above, plus regulator liaison and a heavier reporting cadence
vDPO retainer — large or complex data flows
- SecureRoot fee
- From ₹2.5 lakh a month
- Third-party fee
- None
- Timeline
- Monthly, on a six-month minimum term
- What is included
- As above, across subsidiaries, group entities and cross-border transfers
Three things are priced here and they are not alternatives. The first three rows are the full programme, from discovery through implemented safeguards. The next four are an audit or gap assessment on its own, which ends at a findings report. The last four are the vDPO retainer, which is an ongoing role rather than a project: it is billed monthly on a six-month minimum term and is the one row here you can hold after the programme finishes. Starting with the assessment and commissioning implementation afterwards is normal, and the assessment fee is not charged twice if you do. The audit tiers split SME from mid-size where the programme tiers do not, because assessment effort tracks system count closely while implementation effort does not. There is no certifying body under the DPDP Act, so no third-party audit fee exists on either track. The drivers are data volume and the number of systems and processors. Cross-border transfers move the price, and so does how much work you want done for you rather than advised on. We price by phase rather than as one flat fee for “full compliance”.
Virtual CISO
vCISO retainer — startup or light scope
- SecureRoot fee
- ₹35,000 to ₹70,000 a month (band supplied 24 October 2026)
- Third-party fee
- None
- Timeline
- Monthly, on an agreed minimum term
- What is included
- Billed monthly on an agreed minimum term, because the role is ongoing rather than a project; Security posture assessment, a prioritised roadmap and advisory sessions on a set cadence; Suits a startup with one product, a small engineering team and a first enterprise questionnaire to answer
vCISO retainer — SME
- SecureRoot fee
- ₹70,000 to ₹1.4 lakh a month (band supplied 24 October 2026)
- Third-party fee
- None
- Timeline
- Monthly, on an agreed minimum term
- What is included
- Everything in the tier above, across more systems, teams and third parties; Policy and control framework owned and kept current, not handed over once; Board or investor reporting on an agreed rhythm
vCISO retainer — mid-size or regulated sector
- SecureRoot fee
- ₹1.4 lakh to ₹2.8 lakh a month (band supplied 24 October 2026)
- Third-party fee
- None
- Timeline
- Monthly, on an agreed minimum term
- What is included
- Everything above, plus regulator-facing work and a heavier evidence cadence; Sector obligations drive the price: RBI, SEBI and IRDAI expectations are not the same as a SaaS customer's questionnaire; Suits a fintech, NBFC or insurer that must show a named, accountable security owner
vCISO retainer — large or multi-entity
- SecureRoot fee
- From ₹2.8 lakh a month (band supplied 24 October 2026)
- Third-party fee
- None
- Timeline
- Monthly, on an agreed minimum term
- What is included
- Everything above, across subsidiaries, group entities and multiple jurisdictions; Quoted in writing after scoping, because there is no ceiling worth printing
The vCISO retainer is a role rather than a project, so it is billed monthly and held for as long as it is useful. What moves you between tiers is the number of systems and teams, whether a regulator is involved, and how much of the work you want done rather than advised on. A full-time chief information security officer in India is a different order of cost — independent salary surveys put the average base between roughly ₹31 lakh and ₹43 lakh a year — and the vCISO service page sets that comparison out with its sources. Where you genuinely need a full-time owner in the building we will say so, because a retainer is the wrong answer to that problem.
Scoped before quoting
Frameworks we scope before quoting
Two of the thirteen frameworks on our compliance services hub carry a published band, and those two are ISO 27001 and SOC 2. The DPDP Act does not count as published: its tiers above come from our DPDP guides, not from a band on the service page. So eleven of the thirteen are scoped before quoting. That is a deliberate choice, not an evasion. A hosted-payment-page merchant and a service provider preparing a Report on Compliance are different PCI DSS projects. A number covering both would inform nobody.
PCI DSS
- SecureRoot fee
- Scoped against your SAQ type or ROC path, then quoted in writing
- Third-party fee
- QSA fieldwork where a Report on Compliance is needed; ASV quarterly scanning
- Timeline
- 3 to 5 months to a first validation; weeks for a short SAQ
- What is included
- Scope and card data flow diagram; gap assessment report; remediation plan; evidence package; SAQ or Report on Compliance support
HIPAA
- SecureRoot fee
- Scoped against your role as a business associate, then quoted
- Third-party fee
- None required by the rule; a client may demand an independent assessment
- Timeline
- 2 to 4 months
- What is included
- Security risk analysis report; HIPAA policy and procedure set; safeguard remediation plan; business associate agreement templates; breach notification procedure
GDPR
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- Records of processing activities; lawful basis register; data subject rights workflow; DPIA templates; breach response procedure
CCPA
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- Applicability assessment; personal information data map; consumer rights request workflow; updated privacy notices; service provider agreement review
ISO 27701
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The accredited certification body's two-stage audit, paid by you
- Timeline
- 4 to 6 months to a first certificate
- What is included
- Privacy gap assessment report; records of processing activities; PIMS policy set; controller and processor control mapping; certification audit support
ISO 22301
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The accredited certification body's two-stage audit, paid by you
- Timeline
- 4 to 6 months to a first certificate
- What is included
- Business impact analysis report; business continuity plans; exercise and test reports; BCMS policy set; certification audit support
ISO 42001
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The accredited certification body's two-stage audit, paid by you
- Timeline
- 4 to 6 months to a first certificate
- What is included
- AI system inventory; AI impact assessment reports; AI management system policy set; AI control mapping; certification audit support
NEN 7510
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- The accredited certification body's two-stage audit, paid by you
- Timeline
- 4 to 6 months to a first certificate
- What is included
- Gap assessment report; healthcare risk assessment; access logging control design; NEN 7510 policy set; certification audit support
EU AI Act
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- AI system inventory and classification; obligation mapping report; gap assessment and roadmap; technical documentation templates; human oversight design
Third-party risk management
- SecureRoot fee
- Scoped, then quoted in writing
- Third-party fee
- None
- Timeline
- Quoted with the scope
- What is included
- Vendor inventory and risk tiering; assessment questionnaire set; vendor due diligence reports; risk treatment and remediation plan; ongoing monitoring cadence
Managed services
SOC as a service · Virtual CISO · Virtual DPO · Red team · Phishing simulation · Attack surface management · Dark web monitoring · Security awareness training · Digital forensics · Incident response readiness
- SecureRoot fee
- Monthly retainer, scoped to your estate — except the vCISO and the vDPO, whose retainer bands are published in the tables above
- Third-party fee
- Tooling you choose to license
- Timeline
- Monthly, with a notice period
- What is included
- Monitoring, reporting and advisory output agreed in the retainer scope
If your framework is in this table, a scoping call is faster than a form. We ask what is in scope, write it down, and send a fixed price against that written scope.
What you receive
Deliverables you keep, whether or not you continue
A SaaS platform reached SOC 2 Type II on the first attempt, with 0 audit exceptions, audit-ready in 16 weeks. A hospital network covered 94% of DPDP Act obligations across 12 facilities. A lending platform fixed 27 findings and closed 100% of criticals inside its audit window. Read all three in case studies.
- A written scope, agreed before any work starts, that the price is held against.
- For testing: a findings report with proof of concept for every issue, an executive summary for your board, remediation guidance your engineers can act on, a verified retest report, and an attestation letter.
- For compliance: the phase documents listed in the tables above, each one a deliverable you keep whether or not you continue.
- Engineer-to-engineer fix support during remediation, with the person who found the issue explaining the fix.
- Critical findings within three hours of discovery, not at the end of the engagement.
From band to price
How a band becomes a price
- Step 1
Scoping call, 30 to 45 minutes
We ask what systems, how many, which standard, and what deadline.
- Step 2
Written scope
One page: what is in, what is out, what you supply.
- Step 3
Fixed price
Quoted against that scope, in writing, held for the scope as written. Not before.
- Step 4
Change control
If the scope grows, we re-quote the difference rather than issuing a surprise.
Third-party fees are never inside our quote. The certification body, the licensed CPA firm and the QSA invoice you directly. Independence from the people who built your controls is the point.
Plainly
What we are not
SecureRoot is not a CPA firm and does not issue SOC 2 reports; a licensed CPA firm does. SecureRoot is not an accredited ISO certification body; certificates come from the certification body. SecureRoot is not a QSA and signs neither a PCI DSS Report on Compliance nor an Attestation of Compliance; a Qualified Security Assessor does. SecureRoot is not CERT-In empanelled. If your contract or regulator requires a CERT-In empanelled auditor’s report, say so on the scoping call. We will tell you where we fit and where we do not. Our reports are written to be used as audit and customer evidence, and clients do use them that way.
Questions
Before you ask for a quote
Why are some prices published and others not?
Two of the thirteen frameworks on our compliance hub carry a published band, and they are ISO 27001 and SOC 2. ISO 27001 runs ₹1.5 lakh to ₹8 lakh as a total to certificate. SOC 2 runs ₹1.5 lakh to ₹4.5 lakh for readiness and audit support. Penetration testing is a separate practice, banded per surface at ₹50,000 to ₹4 lakh with the retest included. The DPDP Act does not count as published, because its tiers come from our DPDP guides rather than from a band on the service page. The other eleven frameworks are scoped before quoting, because the honest spread is too wide. A hosted-payment-page merchant and a service provider preparing a Report on Compliance both do PCI DSS. Their projects share almost nothing, so one figure would serve neither. We scope first, then quote in writing.
Is the indicative band the price I will pay?
No. An indicative band tells you whether to keep reading; a quote tells you what to pay. The bands here are reviewed on the dates stated beside them, in rupees, with US dollar equivalents reviewed separately. Your price is set after a scoping call of 30 to 45 minutes and a one-page written scope. The scope says what is in, what is out and what you supply. The quote is fixed against that written scope, and we issue it in writing before work starts, never before scoping. If the scope later grows, we re-quote the difference instead of adding it quietly. Two things stay outside every quote. The first is fees paid directly to a certification body, licensed CPA firm or QSA. The second is your own team's time. That second cost appears on no invoice and is usually the larger of the two.
What third-party fees should I budget on top?
It depends on the framework, and we never mark these up or collect them. For ISO 27001 and the other ISO standards, an accredited certification body runs a Stage 1 and Stage 2 audit. It is priced on organisation size and audit days, and annual surveillance visits follow. For ISO 27001 that audit fee sits inside the published total above. For the other standards the body quotes it. For SOC 2, a licensed CPA firm issues the report and invoices you directly. Our cost guide gives an indicative market range for each report. A Type 1 is ₹2 lakh to ₹5 lakh. A Type 2 is ₹5 lakh to ₹12 lakh. For PCI DSS, budget QSA fieldwork where a Report on Compliance is required, plus quarterly ASV scanning. The DPDP Act has no certifying body, so no such fee exists.
Does the price include a retest after we fix things?
For penetration testing, yes. The retest is inside the engagement price, so there is no second invoice for confirming that a fix worked. When you tell us the fixes are in, the engineer who found each finding retests it and records the result. You receive a verified retest report you can hand to an auditor or a customer. A closed finding means fixed and retested, not acknowledged. If a fix does not hold, the finding stays open and we explain why. Compliance engagements work differently, because there is nothing to retest in the same sense. The equivalent is support through the certification body's or CPA firm's fieldwork, which is inside our fee. We also close any nonconformity the auditor raises. Remediation work that turns out larger than the agreed scope is re-quoted before it starts.
How long does each programme take?
Testing is the fastest: one to three weeks for a web application, mobile application, API or network. A retest window follows once your fixes are in. SOC 2 Type 1 takes eight to twelve weeks. A first Type 2 takes six to nine months, because the observation period is usually three months. Fieldwork follows it. ISO 27001 takes three to six months to a first certificate, including the certification body's two-stage audit. DPDP Act readiness runs thirteen to twenty three weeks across six phases. PCI DSS takes three to five months to a first validation. A merchant with a fully outsourced payment page and a short SAQ can finish in weeks. HIPAA readiness for an Indian business associate takes two to four months. What stretches any of these is remediation and how quickly your control owners produce evidence, not the size of the standard. We commit to dates after the gap assessment.
Can you bundle testing and compliance into one price?
Yes, and it is usually cheaper than buying them apart, because a certification programme needs a penetration test as evidence anyway. The same team scopes the ISO 27001, SOC 2 and DPDP Act programmes and runs the testing that evidences them. It works from one control set and one evidence base, on a single timeline. That means one scoping call, one written scope, one fixed price and one accountable team. The test is timed to your audit window and scoped to the systems the auditor will ask about. What cannot be bundled is the independent party. The certification body, the licensed CPA firm or the QSA must stay independent of whoever built the controls. Their fee stays separate and you contract with them directly. Tell us both needs on the scoping call and we will quote the combined programme.
Why did your old pricing page show dollar plans?
The page you may have found in a search result is a legacy URL from our previous website. It advertised monthly plans in US dollars. It no longer reflects how we work, and it has been retired in favour of this page. We do not sell monthly subscription plans for penetration testing. We scope an engagement, quote a fixed price in rupees against a written scope, and include the retest in that price. If a search result or a bookmark still sends you to the old URL, it now redirects here. If you were quoted from that old page, contact us and we will re-scope the work and quote it properly. Our US dollar figures still appear beside the rupee bands for overseas buyers. Rupees are the primary statement.
Tell us what is in scope and we will put a price on it
One scoping call, a one-page written scope, then a fixed price in writing. Nothing is chargeable until you accept that scope.