Stack Cost AI

Governance Risk And Complianceenterprise stack.

For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.

GRC Platform / Compliance Automation Hub

Pricing & free-tier limitsVanta Starter $1,000/mo ($12k/yr) for ≤25 employees + 5 frameworks, SOC 2/ISO 27001/GDPR/HIPAA included. Growth $2,000/mo for ≤100 employees. Drata Starter $833/mo ($10k/yr) 50 controls. OpenComply OSS free self-hosted. Free tier: demo only, no prod free. Overage: $100/mo per extra 10 employees, $150/mo per extra framework.

Policy Management & Documentation

Pricing & free-tier limitsConfluence Free ≤10 users, Standard $6.05/user/mo (2026) ($5.16/mo annual), Premium $11.55/user/mo. Notion Free 2 guests + 10 pages, Plus $10/user/mo ($8 annual). Drata Policy Builder free 10 policies. GitHub public/private repos free unlimited. Overage: Confluence storage $2.50/GB over 250GB.

Risk Register & Risk Assessment

Pricing & free-tier limitsSimpleRisk Community free OSS self-hosted unlimited risks, support $2,500/yr. Jira Cloud Free ≤10 users, Standard $8.15/user/mo. LogicGate $30k/yr ($2,500/mo) base 10 users + 5 workflows, $200/user/mo over. ServiceNow GRC $50k/yr ($4,167/mo) starter, $150k/yr enterprise. Free tier: SimpleRisk fully free.

Control Framework Mapping (SOC2/ISO27001/NIST/PCI-DSS)

Pricing & free-tier limitsComplianceAsCode & OpenControl OSS free unlimited mappings. Tugboat Logic Essentials $15k/yr ($1,250/mo) 1 framework. Vanta $12k/yr ($1,000/mo) includes 3 frameworks auto-mapped, $200/mo per extra framework. AuditBoard CrossComply $20k/yr ($1,667/mo) includes 10 frameworks crosswalk. NIST OLIR mappings free. Free tier: OSS fully free.

Audit Management & Evidence Collection

Pricing & free-tier limitsDrata $833/mo ($10k/yr) starter 50 automated tests/controls. Vanta $1,000/mo ($12k/yr) 200 automated tests + 300 integrations. AuditBoard $1,667/mo ($20k/yr) starter 10 audits, $2,917/mo pro unlimited. Free trial Vanta/Drata 14 days no free prod. Overage: $2/test/mo over quota, evidence storage S3 ~$0.023/GB/mo.

Third-Party Risk Management (TPRM) / Vendor Monitoring

Pricing & free-tier limitsUpGuard Free: 50 companies monitored, 5 risk assessments/mo, 20 Trust Exchange shares. Starter $500/mo ($6k/yr) 100 companies + 25 assessments. SecurityScorecard Professional $2,500/mo ($30k/yr) 150 vendors, Portfolio $7k/mo. BitSight Starter $2,083/mo ($25k/yr) 200 vendors, Enterprise $5k/mo. Overage: UpGuard $5/company/mo, SecurityScorecard $15/vendor/mo.

Secrets Management for Compliance (Audit of secrets)

Pricing & free-tier limitsVault OSS & OpenBao free self-hosted unlimited secrets. Infisical Free 3 projects + 10 users + 50 secrets, Starter $15/mo flat + $3/member/mo, Growth $50/mo base. HCP Vault Standard $0.03/secret version/mo + $0.121/hr cluster ~ $90/mo. Vault Enterprise $1,500/mo ($18k/yr) starter 25k secrets. Free tier: Vault OSS fully free, disk cost $20/TB/mo.

Security Awareness Training Platform

Pricing & free-tier limitsKnowBe4 Free Phish Alert Button + free phish test 1x 100 users. Small Business $20/user/yr min 25 seats ($500/yr), Enterprise $35/user/yr min 100 seats. Hoxhunt Express $15/user/yr min 50 seats ($750/yr), Enterprise $30/user/yr. Free tier: templated slides free. Overage: $2/user/mo for extra training.

Vulnerability & Risk Prioritization (for GRC context)

Pricing & free-tier limitsGreenbone Community OSS free self-hosted 50k+ CVEs, unlimited scans disk ~$50/mo. Nessus Pro $4,390/yr ($366/mo) 1 scanner 32 IPs concurrent, $6,990/yr unlimited scanners. Tenable.io Enterprise $2,500/mo ($30k/yr) 1000 assets, $4k/mo 5000 assets. Rapid7 InsightVM $2,000/mo 500 assets. Overage: $0.50/asset/mo over quota.

Data Privacy & Subject Rights (DSAR) Management

Pricing & free-tier limitsOsano Free 1 domain ≤5k visitors/mo DSAR inbox. Starter $199/mo includes 25k visitors + 100 DSAR/yr, Growth $499/mo 100k visitors. Transcend Free 50 DSAR/mo, Plus $1,000/mo 200 DSAR. OneTrust Privacy $2,500/mo ($30k/yr) base 1 domain + 100 DSAR/yr, Enterprise $4,167/mo 500 DSAR/yr. Overage: $10/DSAR over, $0.50/1k visitors over.

Asset Inventory & Classification (GRC)

Pricing & free-tier limitsSnipe-IT & Open-AudIT OSS free self-hosted unlimited assets disk ~$20/mo. Lansweeper Free 100 assets, Starter $995/yr ($83/mo) 2000 assets, Pro $3,995/yr. JupiterOne Free 100 assets + 10 queries/day, Pro $1,200/mo ($14.4k/yr) 5000 assets unlimited queries. ServiceNow CMDB included in GRC $50k/yr. Overage: J1 $0.15/asset/mo, Lansweeper $0.40/asset/mo.

Business Continuity / Disaster Recovery (BCP/DR) Planning

Pricing & free-tier limitsOpenBCP & CISA Tool free templates. Cutover Free trial 14 days, Starter $2,000/mo ($24k/yr) 10 runbooks, Pro $4k/mo. Fusion $36k/yr ($3k/mo) 10 continuity plans + 25 users, Enterprise $72k/yr 50 plans. ServiceNow BCM add-on $12k/yr ($1k/mo). Free tier: manual docs free. Overage: $250/plan/mo.

Vendor Security Questionnaire Automation

Pricing & free-tier limitsCAIQ Lite free PDF download. Conveyor Free 25 auto-answered questionnaires/yr, Lite $250/mo ($3k/yr) 100 QAs, Pro $833/mo ($10k/yr) unlimited + AI. Responsive $1,250/mo ($15k/yr) 5 users. Vanta Vendor Risk Q automation $500/mo add-on $6k/yr. Overage: $25/questionnaire over, $2/query AI auto-fill over.

Compliance Ticketing / Issue Remediation Tracking

Pricing & free-tier limitsJira Cloud Free ≤10 users unlimited projects, Standard $8.15/user/mo annual, Premium $16/user/mo, Enterprise $25/user/mo. Linear Free 250 issues. ServiceNow GRC Issues included in GRC $50k/yr module. JSM Premium $48/agent/mo. Free tier Jira Free fully usable. Overage: Automation $0.50/1k rule runs over 500/mo free.

Identity Governance & Access Reviews

Pricing & free-tier limitsOpenIAM & MidPoint OSS free self-hosted unlimited IDs. ConductorOne Free ≤50 identities + 5 apps, Growth $500/mo ($6k/yr) ≤500 IDs 50 apps, Enterprise $2,500/mo ($30k/yr) 5000 IDs. Okta Identity Governance $5/user/mo ($60/user/yr) add-on min 100 users, $7/user/mo enterprise. SailPoint $120k/yr ($10k/mo) starter 500 IDs, Enterprise $250k/yr. Overage: $0.30/identity/mo.

Log Retention & Audit Trail Storage (Compliance Logs)

Pricing & free-tier limitsWazuh + MinIO OSS free unlimited retention self-hosted disk $20/TB/mo electric only. S3 Standard $0.023/GB/mo, IA $0.0125/GB/mo, Glacier Instant $0.004/GB/mo, Glacier Deep $0.00099/GB/mo. CloudTrail first trail free, mgmt logs free, data events $0.10/100k events. Splunk compliance log $5k/mo base 30GB/day ret 1 yr, $10k/mo 100GB/day 7yr. Datadog Compliance $1.70/GB ingested + $0.10/GB/mo retained 1yr. Overage S3 pay as you go.

Questionnaire / RFP Security Response Library

Pricing & free-tier limitsNotion template free. Loopio Free 5 response library entries + 2 users, Starter $500/mo ($6k/yr) 10 users 100 entries, Growth $1k/mo 500 entries. Responsive $1,250/mo ($15k/yr) 5 users 1k entries, Enterprise $2,917/mo unlimited. Vanta Trust Center $500/mo standard unlimited views, $1k/mo advanced. SafeBase Free 50 views/mo, $750/mo Growth. Overage: $1.50/entry/mo.

Pen Test & Audit Finding Tracker

Pricing & free-tier limitsDefectDojo OSS free self-hosted unlimited findings + integrations (Nessus/Burp). DefectDojo Pro $12k/yr ($1k/mo) SSO+RBAC+support. PlexTrac Entry $18k/yr ($1.5k/mo) 50 reports, Pro $30k/yr ($2.5k/mo) unlimited. Drata findings tracker included $833/mo. HackerOne Pentest platform fee $30k/yr ($2.5k/mo) + $15k per pentest. Free tier: DefectDojo OSS fully free.

Data Mapping & Retention Policy Enforcement

Pricing & free-tier limitsDataHub & ODD OSS free self-hosted unlimited sources connectors ~$100/mo compute. Osano Discovery Free trial 30 days, Starter $299/mo 50k records 10 sources, Growth $599/mo 250k records 50 sources. OneTrust Mapping $2,500/mo ($30k/yr) base 25 sources + 1M records, Enterprise $4,167/mo 100 sources. Collibra $100k/yr ($8,333/mo) enterprise. Overage: OneTrust $100/source/mo, $0.10/1k records over.

GRC Workflow Automation (No-Code Policy Workflows)

Pricing & free-tier limitsn8n OSS free self-hosted unlimited workflows. n8n Cloud Free 5k execs/mo, Starter $24/mo 2.5k execs, Pro $60/mo 10k execs, Enterprise $240/mo 50k. Temporal Cloud Free 5k actions/mo. LogicGate $30k/yr ($2.5k/mo) base 10k wf runs/mo + 10 users, Enterprise $90k/yr $7.5k/mo 100k runs. ServiceNow Workflow $50k/yr ($4,167/mo). Overage: $0.50/100 runs over.

Framework Crosswalk & Gap Analysis

Pricing & free-tier limitsNIST OLIR crosswalks SOC2↔ISO27001↔NIST800-53 free PDFs. Tugboat Logic crosswalk included in $15k/yr plan 5 frameworks mapped. Vanta Crosswalk add-on $200/mo ($2.4k/yr) unlimited maps. AuditBoard CrossComply $1,667/mo ($20k/yr) 10 frameworks, $3k/mo enterprise 25 frameworks gap analytics. Free tier: manual spreadsheet free. Overage: $100/framework/mo.

Continuous Control Monitoring

Pricing & free-tier limitsScoutSuite & Prowler OSS free unlimited accounts, 350+ CIS checks. Drata $10k/yr ($833/mo) 50 controls continuous, Growth $20k/yr 150 controls. Vanta $12k/yr ($1k/mo) 200 controls + 300 integrations continuous. Wiz Compliance $35k/yr ($2,917/mo) 1000 workloads. Lacework compliance now Fortinet $30k/yr. Overage: $2/control/mo, $0.20/integration/mo.

Third-Party Attestation Collection (SOC2/ISO from vendors)

Pricing & free-tier limitsVendorCage Free 5 vendors + evidence collection, Starter $350/mo ($4.2k/yr) 50 vendors. UpGuard Trust Exchange Free 20 attestation shares, Premium $500/mo ($6k/yr) unlimited shares + 100 vendors. Vanta Vendor Risk $600/mo ($7.2k/yr) 100 vendors auto-collect 30 attestations. OneTrust Third-Party $2,500/mo ($30k/yr) 150 vendors. Overage: $5/vendor/mo attest, $25/manual collection.

Privacy Impact Assessment (PIA/DPIA) Automation

Pricing & free-tier limitsICO DPIA + CNIL open-source tool free unlimited DPIAs manual. Osano DPIA Lite free ≤3 PIAs/mo, Growth $199/mo unlimited + templated. Transcend Assessment Lite $500/mo 50 assessments. OneTrust PIA/DPIA $2,500/mo ($30k/yr) base 50 PIAs/yr incl risk scoring, Enterprise $4,167/mo 200 PIAs/yr. Securiti PIA $30k/yr. Overage: OneTrust $25/PIA over, $10/assessment copy.

Regulatory Change Tracking

Pricing & free-tier limitsPublic NIST/CISA/SEC/PCI SSC feeds free unlimited RSS. 6clicks Starter $1,000/mo ($12k/yr) 500 regulations tracked + alerts, Enterprise $2,500/mo ($30k/yr) 2000 regs AI summarization. Ascent $50k/yr ($4,167/mo) 1000 financial regs, Enterprise $120k/yr. OneTrust Regulatory $30k/yr ($2.5k/mo). Free tier: manual RSS free. Overage: $2/regulation/mo tracked.

Incident Response & Breach Notification Management

Pricing & free-tier limitsTheHive OSS + Cortex free self-hosted unlimited cases + analyzers disk $40/mo. PagerDuty Team $32/user/mo (2026 $32) 2025 was $29, Business $51/user/mo, Enterprise $69/user/mo. Incident.io Starter $30/user/mo. ServiceNow SIR $30k/yr ($2.5k/mo) 10 responders, Enterprise $72k/yr. OneTrust Incident Response $2,500/mo ($30k/yr) 100 incidents/yr. Free tier TheHive fully free. Overage: PagerDuty $5/incident over 1000/mo.

Customer Trust Portal / Compliance Docs Sharing

Pricing & free-tier limitsConveyor Free 1 trust center 20 views/mo + 5 docs + NDA e-sign. Starter $500/mo ($6k/yr) unlimited views + 50 docs, Pro $1,200/mo ($14.4k/yr) advanced analytics + Salesforce. Vanta Trust Center $500/mo standard custom domain, $1,000/mo advanced 2026. SafeBase Free 50 views/mo, Growth $750/mo ($9k/yr) 200 views, Enterprise $2,500/mo ($30k/yr) unlimited + integrations. Overage: $5/view, $10/NDA over.

Internal Audit Collaboration

Pricing & free-tier limitsConfluence Free ≤10 users, Standard $6.05/user/mo. OpenAudit OSS free. AuditBoard Starter $20k/yr ($1,667/mo) 10 users 5 audits, Pro $35k/yr ($2,917/mo) 25 users unlimited audits, Enterprise $60k/yr ($5k/mo). Diligent HighBond $40k/yr ($3,333/mo) starter, $100k/yr enterprise. Teams/SharePoint free 5GB. Free tier Confluence free viable. Overage: $150/user/mo audit.

Pricing & free-tier limitsOpenEDiscovery OSS free self-hosted. Purview eDiscovery included in M365 E3 $23/user/mo (2026 $24.50) 100GB mailbox, Premium add-on $5/user/mo $60/yr advanced hold. Logikcull Starter $250/mo ($3k/yr) per project 10GB included, Growth $750/mo 50GB, Enterprise $1,500/mo 200GB, $25/GB over. Exterro Starter $60k/yr ($5k/mo) 100GB, Enterprise $150k/yr. Onna $30k/yr. Free tier Purview basic case free holding 500 mailboxes.

Risk Quantification (FAIR Model)

Pricing & free-tier limitsFAIR-U Tool free 1 scenario at a time, OpenFAIR spreadsheet free. RiskLens Community Free 5 quantifications/mo. Starter $15k/yr ($1,250/mo) 50 quant/year + 3 users, Pro $30k/yr ($2,500/mo) 200 quant, Enterprise $60k/yr ($5k/mo) unlimited + API. Safe Security Starter $2k/mo ($24k/yr) 100 assets quantified. Archer Risk Quant $80k/yr ($6,667/mo). Free tier spreadsheet fully free. Overage: $100/quant over, $0.50/asset/mo.

Enterprise GRC Orchestration (ServiceNow GRC / RSA Archer Suite)

Pricing & free-tier limitsEramba Community free OSS self-hosted unlimited risks/controls/issues support $6k/yr optional. OpenGRC OSS free. LogicGate Enterprise $90k/yr ($7,500/mo) unlimited workflows + 50 users. ServiceNow GRC Starter $50k/yr ($4,167/mo) 100 users + 3 modules, Enterprise $150k/yr ($12.5k/mo) full suite + 500 users. RSA Archer $100k/yr ($8,333/mo) starter 50 users + 5 use cases, Enterprise $250k/yr ($20,833/mo) unlimited. Overage: $150/user/mo.

Advanced Third-Party Risk Scoring & Benchmarking

Pricing & free-tier limitsShodan Free 100 queries/mo, $59/mo pro 10k queries. Censys Free 250 queries/mo, $199/mo. UpGuard Pro $1,200/mo ($14.4k/yr) 500 companies advanced scoring + benchmarking, Enterprise $2,500/mo ($30k/yr). BitSight Starter $2,083/mo ($25k/yr) 200 vendors scoring, Enterprise $5k/mo ($60k/yr) portfolio 1000 vendors + tiering + 4th party, Overage $3/company/mo. SecurityScorecard $30k/yr $2,500/mo 150 vendors, Portfolio $84k/yr ($7k/mo) 1000 vendors. RiskRecon $50k/yr starter.

Integrated Risk Intelligence Feed (Cyber Threat Intel for Risk)

Pricing & free-tier limitsAlienVault OTX free unlimited indicators + pulses, MISP + abuse.ch + CISA AIS free feeds OSS self-hosted disk $50/mo. OTX Premium add-on $1k/mo extra context. Anomali Match Starter $2,500/mo ($30k/yr) 1 intel feed + matching, Enterprise $6k/mo ($72k/yr) 10 feeds. Recorded Future Starter $100k/yr ($8,333/mo) 1 use case, Enterprise $250k/yr ($20,833/mo) GRC integration + API 100k queries/day. Flashpoint Starter $75k/yr ($6,250/mo), Enterprise $180k/yr. Overage: $0.10/query over.

Compliance Analytics & Board Reporting

Pricing & free-tier limitsMetabase OSS free self-hosted unlimited dashboards, Cloud Starter $85/mo 10 users, Pro $500/mo. Grafana OSS free + Superset free. Power BI Pro $16.40/user/mo (2026) annual $14/mo, Premium P1 $5k/mo capacity. AuditBoard Analytics add-on $833/mo ($10k/yr) board packs, Enterprise $2k/mo advanced. ServiceNow Performance Analytics $20k/yr add-on included in GRC enterprise $150k/yr. Snowflake data warehouse for analytics $400/mo starter 2 credits/day. Overage: Power BI $0.10/GB dataset over 1TB, Metabase $5/user/mo over.

AI Governance & Model Risk Management

Pricing & free-tier limitsNIST AI RMF free framework + AIF360 OSS free self-hosted. Credo AI Starter $25k/yr ($2,083/mo) ≤10 models + 5 users, Growth $40k/yr ($3,333/mo) 25 models, Enterprise $60k/yr ($5k/mo) unlimited + API. OneTrust AI Governance $30k/yr ($2,500/mo) starter 20 models risk register, Enterprise $50k/yr ($4,167/mo) 100 models + lineage, $80k/yr full. DataRobot AI Governance $50k/yr add-on. Overage: $500/model/mo over, Credo $200/model/mo.

Supply Chain Resilience Risk Management

Pricing & free-tier limitsCISA SCSRM toolkit free + MITRE n-tier template free. UpGuard Free 50 suppliers, Supply Chain $3k/mo ($36k/yr) 500 suppliers + 4th party, Enterprise $6k/mo. Interos Starter $50k/yr ($4,167/mo) 250 suppliers, Enterprise $150k/yr n-tier AI. Resilinc Starter $60k/yr ($5k/mo) 100 suppliers multi-tier mapping, Pro $100k/yr 500 suppliers, Enterprise $150k/yr ($12.5k/mo) unlimited + conflict minerals. Everstream Starter $100k/yr ($8,333/mo), Enterprise $250k/yr. Overage: $10/supplier/mo.

Automated Evidence & User Access Review (UAR) at scale

Pricing & free-tier limitsOpenIAM OSS UAR free self-hosted unlimited reviews. ConductorOne Free ≤50 IDs 5 apps SSO, Growth $500/mo ($6k/yr) ≤500 IDs 50 apps automated UAR, Enterprise $3k/mo ($36k/yr) 5000 IDs + 200 apps. Vanta UAR Automation $300/mo add-on automates 100 systems reviews. SailPoint IdentityNow $180k/yr ($15k/mo) min 500 IDs enterprise + $50/ID/yr addl, Enterprise $350k/yr 5000 IDs. Saviynt Enterprise $150k/yr ($12.5k/mo). Overage: $0.30/identity/mo for UAR, $2/review over.

GRC API & Data Warehouse Integration for SIEM/SOAR

Pricing & free-tier limitsAirbyte OSS free self-hosted unlimited connectors compute ~$80/mo VM. Airbyte Cloud Free 14 days, Starter $50/mo base + $10/credit, Growth $200/mo 500 credits included, Enterprise $1k/mo. Fivetran Free ≤500k MAR, Starter $500/mo ($6k/yr) 1M MAR, Standard $1k/mo 5M MAR, Enterprise $2k/mo ($24k/yr) 50M MAR. Vanta API free 1k calls/mo, $0.02/call over, Enterprise API $500/mo 100k calls. Snowflake Standard $400/mo starter (2 credits/day $2/credit $0.00056/sec = ~ $1200/mo typical), BigQuery $6.25/TB scanned. Workato $30k/yr ($2.5k/mo) 100k tasks, Tray.io $20k/yr. Overage: Fivetran $0.20/credit, Airbyte $0.15/credit.

Options and prices come straight from our research sheets for a enterprise governance risk and compliance project. Prices are estimates and change often — always confirm on the provider's page before committing.

How this enterprise governance risk and compliance checklist works.

Each requirement below is something a enterprise governance risk and compliance build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.

Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.