A compliance platform like Vanta, Drata or Sprinto is a subscription - commonly a few thousand up to low five figures a year, depending on your size and the frameworks you switch on. But the platform is only half the story. It collects and monitors evidence; it does not decide what good evidence is, run your risk assessment, or sit in the audit for you. The total cost is the subscription plus the expert time to turn a screen of green checks into something an auditor accepts.
If you already have a platform that is half-configured, the fastest and usually cheapest fix is a Vanta / Drata / Sprinto Cleanup rather than a full assessment from scratch - you are correcting a system that exists, not building one.
The two-line budget
| Line | Who bills it | What it buys |
|---|---|---|
| Platform subscription | The vendor | Evidence collection and monitoring |
| Expert help | Your advisor | Turning green checks into audit-grade evidence |
Both scale with headcount and the number of frameworks you switch on. Get the platform quote from the vendor directly; the scope of the cleanup, and what moves its price, is published on the pricing page.
Why the tool alone rarely gets you through Stage 2
A platform will happily show a control as "passing" when the underlying evidence would not survive an auditor's question. The classic failures we clean up:
- A green check backed by a screenshot, not a dated record that the control actually ran.
- Monitoring switched on but never reviewed - collection is not the same as monitoring.
- A risk register and Statement of Applicability that the platform does not build for you, left thin or generic.
- Controls marked in scope that no one actually owns.
What a cleanup covers
A workspace review, a control and evidence gap analysis, a pass to clear the false greens, a remediation plan, and evidence an auditor will actually accept. Full inclusions on the pricing page.
The honest recommendation
Keep the platform - it genuinely saves time on evidence collection. Just budget for the expert layer on top, and do not treat a dashboard full of green as readiness. If you want to know which you need, the five-question guide will route you.
Kellwick is independent of the platforms and is not a certification body.
Want a fixed price for your scope?
Tell us the standards, sites and timeline; you receive a written proposal with scope, deliverables and a fixed price.