CYBERNEZA™ logo
How we work

Every engagement is scoped to your situation

We don't publish fixed price tables because no two companies start from the same place. Instead, we scope every engagement to your environment, timeline, and goals — then give you a fixed-fee proposal so you know exactly what you're investing before we start. Most clients invest significantly less than working with a traditional consulting firm.

Founder-led delivery, backed by a trusted network of independent partners when a project needs specialized work.

Start here

Vanta Kickstart

Already have Vanta (or just bought it) and stuck? Kickstart is a fixed-scope sprint to get your instance configured correctly and deliver a clear roadmap to audit readiness.

Fixed fee · 5–10 business days

  • Review of current Vanta environment (or license provisioning if new)
  • Core integration setup (Google Workspace, AWS/Azure, GitHub, HRIS)
  • Analysis of failing tests and misconfigurations
  • Control gap review aligned to SOC 2 scope
  • Prioritized remediation roadmap
  • Fixed-fee proposal for full readiness engagement (if needed)

If we don't believe you need a full readiness engagement, we'll tell you.

Get a Kickstart quote →

SOC 2 Readiness & Audit Coordination

We help you design, document, and operationalize controls, support tool setup and configuration, and coordinate with your chosen auditor to reach audit-ready status for SOC 2 Type I or Type II.

What's included

  • Gap assessment and prioritized remediation roadmap
  • Vanta configuration and integration setup
  • Custom policies written for your business
  • Evidence preparation and workflow setup
  • Audit coordination and communication support

Typical timeline: 2–4 months depending on starting point and internal capacity. Audit fees are separate and paid directly to your auditor.

ISO 27001 Readiness (ISMS Support)

We guide you through building an Information Security Management System (ISMS), supporting implementation and adoption of required controls, and preparing documentation for ISO 27001 certification readiness.

What's included

  • ISMS scope definition and gap analysis
  • Risk assessment and treatment planning
  • Control implementation guidance and documentation
  • Internal audit preparation support
  • Certification body coordination

Typical timeline: 3–5 months depending on scope and existing controls. Certification audit fees are separate and paid directly to your certification body.

Ongoing Compliance Support

After reaching audit-ready, many teams benefit from continued guidance for control maintenance, evidence collection, policy updates, and preparation for surveillance or recertification audits.

Flexible monthly retainer

  • Continuous control monitoring and alert review
  • Policy updates and evidence collection
  • Preparation for annual re-audits
  • Ad-hoc security guidance and questionnaire support

Typical arrangement: Scope and investment based on your needs. Can be adjusted or paused at any time.

Our approach

How pricing works

Fixed-fee, scoped to you

Every engagement starts with a scoping conversation. We learn about your environment, your goals, and your timeline — then present a fixed-fee proposal with a clearly defined scope. No hourly billing surprises. No scope creep. You know what you're investing before we start.

Most clients find that working with Cyberneza costs significantly less than a traditional consulting engagement — and moves faster, because you work directly with a senior consultant from day one.

What factors affect your quote

  • Your target framework (SOC 2, ISO 27001, or both)
  • Current state of your security program and existing controls
  • Team size and environment complexity
  • Your timeline and any hard deadlines (customer deals, procurement requirements)
  • Whether you already have Vanta or need it provisioned

What's Included

  • Gap assessment and readiness planning
  • Policy and procedure templates tailored to your environment
  • Control implementation guidance and evidence preparation
  • Tool setup support (e.g., Vanta implementation) and evidence workflow guidance
  • Audit coordination and auditor communication support
  • Async support via email and scheduled working sessions

What's Not Included

  • Providing audit or certification services
  • Audit or certification body fees (paid separately by you)
  • Third-party tool subscriptions (Vanta, security software, etc.)
  • Penetration testing or vulnerability assessments
  • Legal review of contracts or NDAs
  • On-site or full-time embedded consulting

Independence & Audit Integrity

Cyberneza does not perform audits or issue certifications. We prepare your organization for independent third-party audits by helping you build, document, and maintain effective controls. You will engage and pay your auditor or certification body separately.

Introductions to the right auditor

When you're ready for the audit itself, we'll introduce you to one or more audit firms we trust — chosen to fit your stage, budget, and framework. You're never locked in: if you already have an auditor or want to evaluate options yourself, we work with whomever you choose.

We don't take referral fees from auditors. AICPA independence rules wouldn't allow it on attest engagements anyway, which means our incentive is to introduce you to the firm that actually fits — not the one that would pay the largest commission.

The handoff is straightforward: we share what we've built (controls, evidence, policies) so the auditor can move quickly, and we stay involved during the audit window to answer questions and respond to evidence requests on your behalf. Audit fees are paid directly to your auditor and are separate from our engagement fee.

Get a quote in 24 hours

Schedule a scoping call to talk through your current state, target framework, and timeline. We'll follow up with a tailored proposal — typically within one business day.

Schedule a scoping call Contact us