Pricing
Real ranges, not “contact us”. Most work is fixed-scope and fixed-price once we have looked at your situation. The numbers below are typical ranges - your final fixed price is set on a short scoping call and depends on the factors listed under each.
$1,250 fixed
The low-risk entry point: your top Stage 1 blockers, fast. The easiest way to find out whether a full assessment is even needed.
100% of the Mini Gap Review fee is credited toward a Readiness Assessment booked within 30 days.
From $4,500
Typical $4,500-$8,500
The full picture before Stage 1: clauses 4-10 and Annex A, with a scored readiness result and a gap register ranked by audit impact.
What changes the price
Employee count · ISMS scope · Number of entities · Audit date · Current evidence quality
By size: up to 50 employees from $4,500; 51-150 from $6,000; 151-250 from $7,500; multiple entities or complex scope is custom.
From $8,500
Typical $8,500-$18,000
Hands-on closure of the gaps between the assessment and the audit - scoped from real findings, never open-ended.
What changes the price
Number of open gaps · Policies and processes to fix · Quality of the existing SoA and risk register · Number of teams and control owners · Time to the audit
Scoped from the Readiness Assessment findings. We do not offer unlimited remediation on a flat fee.
From $2,000/month
Up to one advisory day per month (8 hours)
Keep a single-framework ISMS alive and audit-ready between cycles - the operational upkeep, not senior leadership.
Not included
Up to one advisory day per month for one primary framework, one entity and one agreed ISMS scope. For multi-framework leadership and board reporting, see Compliance Lead or the Fractional Lead.
From $4,500/month
Up to three advisory days per month (24 hours)
Everything in Maintenance, plus up to two frameworks and regular leadership - for teams that need coordination, not just upkeep.
Not included
What changes the price
Number of frameworks · Maturity of what you already run · Reporting cadence
Up to three advisory days per month, covering up to two agreed frameworks within one organisational scope.
From $7,500/month
Up to five advisory days per month (40 hours)
Senior, multi-framework security and AI-governance leadership on a retainer - board reporting, incident governance and a defined monthly capacity, without a full-time hire.
Not included
What changes the price
Number of frameworks · AI in scope · Board cadence · Incident load
Up to five advisory days per month for the agreed governance scope. This is fractional leadership, not a full-time or 24/7 security function.
From $3,000
Typical $3,000-$6,000
A control-by-control evidence map and audit-ready index - the artifact most audits actually turn on.
What changes the price
Scope size · Current evidence quality
From $4,500
Typical $4,500-$10,000
Turn a half-configured compliance platform into real, audit-grade evidence - not a screen full of green checks an auditor will reject.
What changes the price
State of the platform · Number of controls · Scope
$1,250 fixed
Fast, expert answers to a stalled security questionnaire - up to 150 questions, so a deal stops waiting on you.
For larger or ongoing needs, see Full Questionnaire Support.
From $3,500
Ongoing questionnaire response backed by a reusable answer library, so each one gets faster, not harder.
What changes the price
Volume · Complexity
From $3,500
For already-certified teams: confirm you will pass surveillance before the auditor arrives - find the drift first.
What changes the price
Scope · Time since certification
From $6,500
Where you stand against DORA's five pillars, with the evidence a supervisor asks for - ICT risk, incident reporting, the Register of Information, resilience testing and third-party risk.
What changes the price
Entity type · Scale · Existing ISMS
From $2,500
Find out whether NIS2 even applies to you before building anything - the two-gate scope test worked through and put in writing.
What changes the price
Entity and ownership structure · Sector · Number of services
The cheapest possible answer to the most expensive NIS2 question - do the obligations reach you at all.
From $5,500
AI management system readiness against ISO 42001's Annex A and the AI impact assessment that sets it apart from ISO 27001.
What changes the price
Number of AI systems · Scope · Existing ISMS
Prices are indicative and exclude applicable taxes, certification-body fees, travel and third-party services. Final scope and fixed price are confirmed before the engagement starts.
Retainer terms
How pricing works
Every engagement is scoped before it starts. You get a fixed price and a fixed set of deliverables in writing - not an hourly meter. The ranges above exist because a 30-person SaaS and a 250-person multi-entity group are genuinely different amounts of work.
The honest way to narrow your number is the Mini Gap Review or the free readiness self-assessment. Both tell you roughly where you stand before you commit to a larger piece of work.
Prices are shown in your local currency for convenience - EUR across Europe, USD elsewhere - and the exact fee is agreed on the call and invoiced.
Kellwick is an independent advisory practice, not a certification body. We prepare you for certification and supervision; we do not perform them and cannot guarantee an outcome. Figures are indicative and not a binding quote.
Tell us where you are and the audit or deadline you are working toward. We will point you at the right starting point - and give you a fixed price for it.