Multi-Framework Readiness Snapshot™
Where do you actually stand against the framework your auditor reads, today, from your live cloud telemetry? SOC 2, PCI DSS v4.0, ISO 27001, NIST CSF, and HIPAA; GDPR and US state privacy by request. Ten-question intake plus up to five optional read-only connectors (AWS, Azure, Microsoft 365, Okta, CrowdStrike). Per-framework gap matrix PDF in your inbox within hours. $1,995 credits 100% to month-1 of any tier within 30 days.
Run my Snapshot · $1,995 →Aegis AI™ vCISO subscription tiers
Six tiers. Cornerstone carries one framework of your choosing. Sentinel and above carry all five: SOC 2, PCI DSS v4.0, ISO 27001, NIST CSF, and HIPAA; GDPR and US state privacy by request. Cadence, entity coverage, and concierge level rise from there. The $1,995 Snapshot credits to month 1 of any tier within 30 days. Annual prepay is 10× monthly, two months free.
How to size the ladder: Cornerstone is for one entity carrying one framework. It costs about what a compliance platform costs, and instead of handing you a dashboard and an empty evidence list, the work arrives done for your approval. Move up to Sentinel when a second framework enters scope. Sentinel and Guardian deliver what most teams assemble from compliance software plus outside consulting hours, done for you, continuously. Vanguard replaces standing up an internal compliance function. Fortress and Sovereign price against headcount, not software: security-office coverage, with your executives making every call.
- One framework of your choosing: SOC 2, PCI DSS v4.0, ISO 27001, NIST CSF, or HIPAA
- Monthly validation cycle
- One legal entity
- Email support, business hours
- Standard audit-defense exhibits
- All five frameworks, not one: map to whichever your auditor reads (SOC 2, PCI DSS, ISO 27001, NIST CSF, HIPAA; others by request) every cycle
- Monthly validation cycle
- One legal entity
- Email support, business hours
- Standard audit-defense exhibits
- Map to whichever framework your auditor reads (SOC 2, PCI DSS, ISO 27001, NIST CSF, HIPAA; others by request) every cycle
- Bi-weekly validation cycle
- One legal entity
- Email + chat support
- Quarterly board narrative
- Map to whichever framework your auditor reads (SOC 2, PCI DSS, ISO 27001, NIST CSF, HIPAA; others by request) every cycle
- Weekly validation cycle
- Up to 3 legal entities
- Email + chat + Slack Connect
- Named customer success manager
- Monthly board narrative
- Enhanced audit defense
- Map to whichever framework your auditor reads (SOC 2, PCI DSS, ISO 27001, NIST CSF, HIPAA; others by request), every week
- Weekly validation cycle
- Up to 10 legal entities
- Concierge SLA, 15-min P0 response
- Named escalation contact
- Audit-defense exhibit assembly
- Quarterly board + audit committee narrative
- Map to whichever framework your auditor reads (SOC 2, PCI DSS, ISO 27001, NIST CSF, HIPAA; others by request), every week
- Weekly validation cycle
- Unlimited legal entities
- Dedicated IR runbook
- Two named contacts, highest priority queue
- M&A-grade control mapping
- Board + audit committee + ad-hoc
GLBA Safeguards vertical entry
Below the ladder sits one single-framework tier for nonbank financial institutions under the FTC Safeguards Rule: auto dealers that finance, mortgage and installment lenders, money services businesses, collection agencies, tax preparation firms, and advisers outside SEC registration. 16 CFR §314.4 names the artifacts your program must contain; this tier keeps them current. Start with the $1,495 Safeguards Readiness Assessment and it credits in full to month 1 within 30 days.
- One framework: GLBA / FTC Safeguards Rule (16 CFR §314.4)
- The six named artifacts kept current monthly: QI designation record, written risk assessment, incident response plan, provider oversight register, annual board report, FTC notification checklist
- Service provider oversight register, up to 25 providers
- One legal entity, monthly cycle, from your attested intake
- No live cloud scanning at this tier: step up to Cornerstone or above for measured evidence and a second framework
OFAC and Authorized Signatory certification required at intake. Service is for organizations not subject to U.S. sanctions and signed by an officer authorized to bind the company. Custom MSA, regulated industry overlays (FedRAMP, IL5+, FINRA, HITRUST inheritance), or scopes beyond unlimited: sales@ai4ciso.ai.
Tier comparison matrix
| Feature | Sentinel | Guardian | Vanguard | Fortress | Sovereign |
|---|---|---|---|---|---|
| Price / month | $4,500 | $8,500 | $17,000 | $33,500 | $60,000 |
| Price / year | $45,000 | $85,000 | $170,000 | $335,000 | $600,000 |
| SOC 2 (live) | ✓ | ✓ | ✓ | ✓ | ✓ |
| PCI DSS v4.0 (live) | ✓ | ✓ | ✓ | ✓ | ✓ |
| ISO 27001 (live) | ✓ | ✓ | ✓ | ✓ | ✓ |
| NIST CSF 2.0 (live) | ✓ | ✓ | ✓ | ✓ | ✓ |
| HIPAA (live) | ✓ | ✓ | ✓ | ✓ | ✓ |
| GDPR + US state privacy (by request*) | by request* | by request* | by request* | by request* | by request* |
| * Live today at every tier: SOC 2, PCI DSS v4.0, ISO 27001, NIST CSF 2.0, and HIPAA. GDPR and US state privacy mappings are onboarded per engagement. Reply to support@ai4ciso.ai with your audit timeline and we’ll confirm ETA before you commit. | |||||
| Validation cycle | Monthly | Bi-weekly | Weekly | Weekly | Weekly |
| Legal entities | 1 | 1 | Up to 3 | Up to 10 | Unlimited |
| Support channel | Email + chat | Email + chat + Slack Connect | Concierge SLA | Highest priority queue | |
| P0 response SLA | 15 minutes | 15 minutes | 15 minutes | 15 minutes | 15 minutes, named backup |
| Named contact | · | · | Named CSM | Named escalation | Two named contacts |
| Audit-defense exhibit assembly | Standard | Standard | Enhanced | ✓ | ✓ |
| Board narrative | · | Quarterly | Monthly | Quarterly board + audit committee | Board + audit committee + ad-hoc |
| M&A-grade control mapping | · | · | · | · | ✓ |
| Dedicated IR runbook | · | · | · | · | ✓ |
| $1,995 Snapshot credit (30 days) | ✓ | ✓ | ✓ | ✓ | ✓ |
Billing terms
Every tier is available monthly or as an annual prepay at ten times the monthly price, which is two months free. Full billing mechanics and refund terms on the Refund Policy page.
What every tier includes
- Read-only telemetry connectors. AWS, Azure, Microsoft 365, Okta, CrowdStrike. Configured in minutes, revocable in 30 seconds. Configuration metadata only: no PHI, PCI cardholder data, or customer data harvested.
- Multi-framework control matrix. SOC 2, PCI DSS v4.0, ISO 27001, NIST CSF, and HIPAA; GDPR and US state privacy by request. Every applicable control mapped to live evidence with SHA-256 hash and validation timestamp.
- Audit-ready binder. Pre-staged in the format your CPA firm, certification body, HIPAA assessor, or PCI QSA consumes during fieldwork.
- Risk register + POA&M. Every open gap with owner, target date, framework cross-reference, refreshed every cycle.
- Executive summary. One-page snapshot of posture across your in-scope frameworks, suitable for an internal weekly review or a board pre-read.
- DPA + BAA on request. Industry-standard Data Processing Addendum at every tier. HIPAA Business Associate Agreement available where applicable.
Aegis AI™ is not an auditor. SOC 2 attestations come from independent CPA firms; ISO 27001 certifications from accredited certification bodies; HIPAA from your designated assessor; PCI Reports on Compliance from independent QSAs. Aegis AI is the readiness software you use before they arrive. How each framework is covered →