The gazette
Guides for teams that answer to regulators
The same material the product is built on: what the frameworks require, how the programs run, and where the manual work goes. Plain language, cited, no fluff.
-
19 Oct 2026 · 8 min read
Apptega alternatives and Apptega competitors priced from their own rate cards
Apptega lists $7,080 to $14,880 a year for up to 200 employees, the cheapest public card in its market, so most alternatives win on scope or negotiated price rather than list. Here is each rival priced at one, three and five frameworks, and who should switch.
Read the guide →
-
15 Oct 2026 · 7 min read
Scrut pricing and Scrut Automation cost from its AWS rate card and recorded contracts
Scrut prints no price on its website, but its AWS Marketplace listing does: $15,000 a year for up to 20 employees, frameworks included. Recorded contracts land at half that. Here is what it covers, how it compares with Vanta, Drata and Sprinto, and what to negotiate.
Read the guide →
-
14 Oct 2026 · 8 min read
ServiceNow GRC pricing per IRM operator, and who counts as one
ServiceNow prints no GRC price, but two of its resellers do. Integrated Risk Management lists at $125, $250 and $375 per IRM operator a month, and the definition of an operator includes anyone who receives an attestation, which is where most quotes go wrong.
Read the guide →
-
13 Oct 2026 · 8 min read
Thoropass pricing and what Thoropass costs a year with the SOC 2 audit included
Thoropass prints no price on its site, but its AWS Marketplace listing does: $8,700 for the platform with one framework and $5,800 for a SOC 2 audit by its in-house auditors. Here is what buyers really sign, how that compares with Vanta, Drata, Secureframe and Sprinto, and the renewal clause to fix before you sign.
Read the guide →
-
12 Oct 2026 · 8 min read
Venminder pricing and what Venminder costs a year, from its AWS list price, recorded contracts and both versions of its terms
Venminder lists its Enterprise platform at $125,000 a year on AWS Marketplace, but recorded contracts have a $10,790 median. Here is what is in each package, what is billed a la carte, and the renewal clause that differs between its two contracts.
Read the guide →
-
9 Oct 2026 · 8 min read
Ncontracts competitors and Ncontracts pricing for banks, credit unions and mortgage lenders
Three of the names on most Ncontracts shortlists are owned by Ncontracts. Here are the real alternatives for banks and credit unions, the one public list price in the family ($125,000 for Venminder Enterprise on AWS) against a $10,790 recorded median, and the questions to ask before renewal.
Read the guide →
-
8 Oct 2026 · 8 min read
MetricStream pricing and what MetricStream costs a year, from public contracts and its own subscription agreement
MetricStream prints no price list, but its AWS listing, its own subscription agreement and public contract notices do. Here is what a module costs, what an enterprise program costs a year, and the fixed 6 percent renewal step written into its contract.
Read the guide →
-
7 Oct 2026 · 8 min read
Bitsight pricing and what Bitsight costs a year, from ten years of federal awards
Bitsight prints no price list and its pricing page is a 404, but federal agencies publish every award. The records show what a Bitsight subscription costs by package, how renewals moved year to year, and where SecurityScorecard, UpGuard and Panorays publish real numbers.
Read the guide →
-
6 Oct 2026 · 8 min read
RSA Archer pricing and Archer GRC cost from ten years of federal renewal records
Archer prints no price and its AWS listing shows a $9,999,999 placeholder, but federal agencies publish every renewal. The records show what Archer costs at agency scale, how renewals moved after the 2023 carve-out from RSA, and which rivals publish real numbers.
Read the guide →
-
5 Oct 2026 · 7 min read
Panorays pricing per vendor, the band cliff at 100 vendors, and Panorays competitors priced
Panorays charges per vendor and per type of evaluation. The public price list shows bands where 100 vendors cost less than 99, recorded US deals sit near $21,700, and UpGuard, SecurityScorecard and Bitsight publish prices you can use against the quote.
Read the guide →
-
2 Oct 2026 · 8 min read
Smarsh competitors compared on price and on what each contract makes you sign
Global Relay, Theta Lake and Microsoft Purview against Smarsh, priced from marketplace listings and recorded contracts, plus the two published contracts side by side: renewal windows, uplifts, minimums and what happens to your archive when you leave.
Read the guide →
-
1 Oct 2026 · 7 min read
Smarsh pricing and Smarsh email archiving cost from the public price lists and recorded contracts
Smarsh prints no price, but its AWS listing, a public-sector price list and federal award records show how the bill is built: a platform fee plus a per-user fee for every channel you capture.
Read the guide →
-
30 Sep 2026 · 7 min read
RIA in a Box cost and pricing, what COMPLY charges an advisory firm per user and what the alternatives cost
RIA in a Box publishes no price, but its custodian partner sheet shows how the bill is built: per-user fees for compliance and cybersecurity, a service fee and implementation. Here is what to negotiate and what the alternatives cost.
Read the guide →
-
28 Sep 2026 · 8 min read
OneTrust vs Panorays, what each costs for third-party risk management and which one fits your vendor count
OneTrust prices third-party risk on admin users and vendor inventory, Panorays per vendor and per type of evaluation. Both price lists are public on the UK government framework, and the cheaper one depends on how many vendors need a real evaluation.
Read the guide →
-
27 Sep 2026 · 8 min read
PolicyStat pricing from the published RLDatix price list and what US hospitals pay a year
RLDatix does publish a PolicyStat price list, on the UK government framework, and US federal buyers record what they pay. Together they show how the license bands work, how fast the list rose, and what a hospital should expect.
Read the guide →
-
26 Sep 2026 · 7 min read
PolicyTech pricing in federal purchase records and how fast NAVEX renewals climb
NAVEX publishes no PolicyTech price, but federal buyers record theirs: $5,000 for one hospital department to $40,425 for a large VA medical center, with renewals compounding about 5 percent a year.
Read the guide →
-
24 Sep 2026 · 7 min read
Hyperproof vs Vanta pricing in recorded contracts and how the bill grows with every framework
Vanta is the cheaper contract and Hyperproof is built for many frameworks. The real difference is the unit each bill grows on: employee bands and modules for Vanta, programs counted monthly for Hyperproof.
Read the guide →
-
22 Sep 2026 · 7 min read
Onspring pricing per year and how platform tiers, license models and implementation add up
Onspring publishes no price, but it publishes how the bill is built: a platform level that sets support and environments, and a separate license by users, by products or both. Here is what buyers pay and which choice moves the total most.
Read the guide →
-
29 Sep 2026 · 8 min read
LogicGate competitors and alternatives, what Onspring, Optro, ServiceNow, Hyperproof and Archer cost against LogicGate Risk Cloud
Every list of LogicGate alternatives names the same vendors and none says what they cost. Here are the medians, the published price lists where they exist, and the billing unit that decides your quote.
Read the guide →
-
21 Sep 2026 · 8 min read
LogicGate pricing for Risk Cloud and how Applications and Power Users set the yearly bill
LogicGate publishes no price, but it publishes exactly how it charges: Applications and Power Users, with everyone else free. Here is what buyers pay, why implementation is bought once per Application, and the regulatory content lag hidden in the support tiers.
Read the guide →
-
18 Sep 2026 · 8 min read
Sprinto pricing from the published rate card and why each framework is the cheap part
Every roundup says Sprinto hides its pricing behind a password. It also publishes a rate card, on AWS Marketplace: $7,500 a year for the platform and $2,000 for a framework. Here is what that means for your budget, and why most guides overstate the framework cost by up to four times.
Read the guide →
-
16 Sep 2026 · 8 min read
Workiva SOX compliance and when Optro wins instead
Workiva runs SOX programs well when the output is a filing and less well when the work is control testing. Here is what the SOX solution covers, why adding it is a new priced line rather than more users, and the specific cases where Optro is the better buy.
Read the guide →
-
15 Sep 2026 · 9 min read
How much does Workiva cost, from the median contract to the list price Workiva does publish, and why the discount is so thin
Workiva is said to publish no pricing. It does, on five AWS Marketplace listings, and the figure is $1,000,000 for a twelve month contract. Recorded deals close at a median of $49,420. Here is what the gap between those two numbers tells you about the negotiation you are about to have.
Read the guide →
-
6 Sep 2026 · 9 min read
Policy management software pricing and policy manager software cost across thirteen vendors
We opened thirteen policy management pricing pages on 6 September 2026. Seven were 404s and exactly one showed a price. Here is the contract data that does exist, the per-employee versus per-module trap, and how to size the number before your first demo.
Read the guide →
-
2 Sep 2026 · 9 min read
BCM software pricing and business continuity software cost after the public price pages disappeared
We opened the pricing URL of ten business continuity vendors on 2 September 2026. Seven errored and the three that resolved redirected into an acquirer. Here is the contract data that does exist, what really drives the bill, and how to build the number from your own estate.
Read the guide →
-
1 Sep 2026 · 9 min read
AI governance software pricing and why two platform quotes never compare
We opened the public pricing page of every major AI governance platform on 1 September 2026. Two of them did not resolve at all, one was still request-access only, and the two vendors that state anything state a different unit of measure. Here is what that means for your budget and your negotiation.
Read the guide →
-
31 Aug 2026 · 10 min read
Privacy compliance software pricing for multi-entity groups and why a per-entity quote will not hold
A privacy platform almost never bills you per entity, which is why the per-entity number a vendor gives you falls apart at the second subsidiary. Here is what six platforms actually cost, the six metering units that decide your bill, and how each one behaves when you add a company.
Read the guide →
-
30 Aug 2026 · 9 min read
Compliance software implementation cost and timeline for a real GRC rollout
The license is the number everyone compares. Implementation is the number that decides whether the platform is live before your next testing cycle, and it commonly runs 30 to 100 percent of year one license on top. Here is the realistic timeline by tier, what drives it, and what vendors need from you to scope it.
Read the guide →
-
26 Aug 2026 · 9 min read
Compliance software discounts a multi-year GRC contract actually earns, vendor by vendor
Buyers get about 30 percent off the opening quote at one vendor in this market and about 11 percent at another, so a flat procurement rule is wrong at both ends. Here is the achieved discount at eight platforms, what a multi-year term adds on top, and what it costs you.
Read the guide →
-
23 Aug 2026 · 9 min read
Multi-entity compliance software pricing per subsidiary and how vendors count an entity
Entity count is the second biggest lever on a GRC quote and the one buyers understand least, because four vendors will count the same corporate group four different ways. Here is how each model works and what it does to the number.
Read the guide →
-
24 Aug 2026 · 9 min read
GxP compliance software pricing for a validated eQMS and what Part 11 validation adds
Recorded contract data for four validated life sciences platforms, why they run two to five times a general GRC tool, and the cost line that lands after the license: validation.
Read the guide →
-
22 Aug 2026 · 10 min read
SOX compliance software pricing and how it compares with GRC software
Median contract data for seven platforms, the five levers that actually move a quote, and the number that reframes the budget: the license is about two percent of a $2.3 million SOX program.
Read the guide →
-
4 Sep 2026 · 9 min read
SOX software for pre-IPO companies, the best SOX compliance software to buy before your first 404(a) year
Pre-IPO teams almost always buy the wrong thing first, because the platform that wins an enterprise bake-off is not the one that survives a first 404(a) year. Six platforms with real contract data, and the sequencing that decides whether year one produces an opinion or a material weakness.
Read the guide →
-
21 Aug 2026 · 9 min read
AuditBoard vs Workiva pricing and Workiva vs AuditBoard for SOX testing, now that AuditBoard is Optro
One of these tools is built to test controls and one is built to file the 10-K, which is why teams that buy on brand end up owning both. Here is the split, with real contract data, plus the March 2026 rebrand that most published comparisons still have not caught.
Read the guide →
-
19 Aug 2026 · 10 min read
Material weakness vs significant deficiency and the two tests that decide it
Both are internal control deficiencies. Only one of them makes your internal control over financial reporting ineffective and puts a paragraph in your 10-K. The line between them is two questions, and most teams only ask the first one.
Read the guide →
-
16 Aug 2026 · 9 min read
BOI report requirements in 2026 and who still files under the Corporate Transparency Act
FinCEN finalized the rollback on 14 August 2026. US-formed companies no longer file a BOI report at all, and foreign reporting companies no longer report any beneficial owner who is a US person. Here is what the final rule actually changed, with the regulation text.
Read the guide →
-
9 Jul 2026 · 9 min read
What is compliance automation? A 2026 guide for regulated teams
Compliance automation means software doing the repetitive parts of staying compliant: collecting evidence, checking controls, tracking the rules. Here is what it covers in 2026, and where the current generation of tools stops.
Read the guide →
-
9 Jul 2026 · 10 min read
Anti money laundering program requirements and how to run one
An anti money laundering program is the written, board-approved system a financial business runs to detect and report financial crime. US law sets five pillars. This guide walks through each one.
Read the guide →
-
9 Jul 2026 · 8 min read
SOC 2 compliance checklist for every control area, and how to prepare
A practical SOC 2 compliance checklist: the control areas the Trust Services Criteria actually cover, the evidence auditors ask for in each, and how to keep it current between audits.
Read the guide →
-
14 Jul 2026 · 9 min read
ISO 27001 vs SOC 2 and which one your buyer actually wants
US buyers ask for SOC 2. European and enterprise buyers ask for ISO 27001. They overlap heavily, cost different amounts and take different lengths of time. Here is how to pick the one that unblocks revenue first.
Read the guide →
-
14 Jul 2026 · 10 min read
How much does compliance software cost? Real 2026 pricing
The platform fee is rarely the biggest number on the invoice. Here is what compliance software actually costs in 2026, including the audit, the pen test and the line items vendors leave off the quote.
Read the guide →
-
9 Sep 2026 · 9 min read
Secureframe pricing at list price and why the number everyone quotes is half of it
Almost every guide puts Secureframe entry pricing at $7,500 a year. That figure is real, it is published, and it buys you a platform with no compliance framework attached. Here is the full list price, what the second framework costs, and how it compares with Drata, Vanta and Sprinto on the same day.
Read the guide →
-
19 Jul 2026 · 11 min read
Vanta vs Drata pricing and which one is cheaper for your team
Vanta and Drata do the same core job: automate evidence for SOC 2, ISO 27001 and the rest. The differences are in integrations, monitoring speed, per-framework pricing and support. Here is how to pick, with the numbers stated honestly.
Read the guide →
-
21 Jul 2026 · 11 min read
SOX 404 audit and compliance requirements for management and auditors
Section 404 is the part of Sarbanes-Oxley that costs the most and confuses the most. Here is exactly what management has to assert, when an auditor has to attest, who is exempt, and what the annual cycle looks like in practice.
Read the guide →
-
21 Jul 2026 · 10 min read
How to choose compliance software with a buyer checklist
Most compliance software demos look identical. The differences that matter show up in scope, renewal pricing and what the tool does when a rule changes. Here is the checklist to run before you sign anything.
Read the guide →
-
14 Jul 2026 · 9 min read
HIPAA Security Rule changes that are actually law in 2026
Plenty of vendor pages tell you MFA and encryption are now mandatory under HIPAA. They are not. Here is what the proposed Security Rule rewrite would change, where it actually stands, and what to do in the meantime.
Read the guide →
-
24 Jul 2026 · 9 min read
CMMC Phase 2 suspended, so is CMMC still required in 2026?
On 13 July 2026 the Department of War suspended CMMC Phase 2, the mandatory third-party certification rollout that was set for November. The 110 controls did not go away. Here is exactly what changed, what still applies, and what to do next.
Read the guide →
-
25 Jul 2026 · 9 min read
Compliance officer cost in salary, fully loaded cost, and outsourced pricing
A full-time compliance officer costs a US employer about $115,000 a year once benefits are counted, and a chief compliance officer far more. Here is where every figure comes from, what each option actually buys, and the point where each one stops making sense.
Read the guide →
-
25 Jul 2026 · 9 min read
COSO ERM vs ISO 31000 differences and which one to adopt
COSO ERM and ISO 31000 are not competing answers to the same question. One is a governance-heavy framework built for boards and US public companies, the other is short, sector-agnostic guidance. Here is what actually separates them, and how most mature programs end up using both.
Read the guide →
-
1 Aug 2026 · 10 min read
SOX 404 testing of control design and operating effectiveness in practice
Design effectiveness and operating effectiveness are two different tests, run in a fixed order, and confusing them is the fastest route to a reported deficiency. Here is how each one works, what PCAOB AS 2201 actually requires, and why the sample size table everybody quotes is not in any standard.
Read the guide →
-
10 Aug 2026 · 10 min read
Can AI replace compliance officers? What the regulations actually require
The usual answer is that human judgment is irreplaceable. The better answer is narrower and written down: BSA/AML, HIPAA and the OIG guidance each require a named individual, and no amount of automation satisfies the wording. Here is what AI does take over, and what changes about staffing when it does.
Read the guide →
-
5 Aug 2026 · 11 min read
Seven elements of an effective compliance program as OIG names them now
Almost every published list of the seven elements is the 1998 version. OIG renamed two of them, folded risk assessment into a named element, and changed the order in November 2023. If your compliance committee still works from the old numbering, the mapping is not one to one.
Read the guide →
-
5 Aug 2026 · 10 min read
Bank compliance management system requirements from the FDIC, element by element
Almost every published guide describes a compliance management system as three pillars. The FDIC examination manual describes two interdependent elements, and the difference is not academic: the framing most banks copy quietly drops the component examiners reach for first.
Read the guide →
-
11 Aug 2026 · 11 min read
Suspicious activity report filing with the 30 day clock, the $5,000 trigger and the CTR line most guides get wrong
The SAR clock starts at initial detection, not at the transaction, and a CTR needs more than $10,000 rather than $10,000 or more. Both are stated backwards on a lot of published guidance. Here is what 31 CFR 1020.320 and 1010.311 actually say.
Read the guide →
-
13 Aug 2026 · 10 min read
21 CFR Part 11 compliance requirements and the letter almost every checklist forgets
Part 11 is short enough to read directly, and doing so settles most of the arguments about it. Including the one-time certification letter to FDA that almost no published checklist mentions, and whose submission address quietly changed in 2023.
Read the guide →
-
17 Aug 2026 · 9 min read
CCPA compliance checklist with every requirement, deadline and clock
Eleven items, three of which almost every program skips: the browser opt-out signal, the service provider contract terms, and employee data. Here is the full list with the current thresholds, clocks and penalty figures.
Read the guide →
§ 99 · Final entry
Create your account
Leave your work email, confirm the 6-digit code, and your account is ready. Nothing is charged to create it.