What compliance actually costs, itemised

Seven costs, and the software is rarely the largest

Suppliers budget for a product and are surprised by the programme. The honest itemisation looks like this.

Somebody's time. The largest line in almost every case. A person defining the boundary, writing the plan, chasing evidence and answering an assessor, for the better part of a year, alongside whatever else they do.

Documentation. A system security plan and its supporting procedures. This is writing, it is slow, and no product produces it for you however the demonstration looked.

Remediation. Whatever the gap analysis finds: segmentation, identity, logging, replacing something that cannot be brought into line.

Tooling. Licences, and the infrastructure they run on.

The assessment itself. Assessor fees, and they vary with the size of your boundary.

Preparation for the assessment. A readiness review or a mock assessment, which is optional and which most suppliers who skip it wish they had not.

Keeping it. Annual affirmation, evidence collection that does not stop, and re-assessment when the validity period ends.

Front-loaded, then permanent

The first year is dominated by remediation and documentation. The years after are dominated by evidence and by the time of whoever holds it.

A budget that treats this as a project with an end will be short in year two, and the shortfall arrives as a person quietly not doing the evidence collection because nothing forces them to.

The largest lever is scope

Every cost above scales with the size of the boundary. A narrow enclave with a small number of systems is cheaper to remediate, cheaper to document, cheaper to assess and cheaper to keep.

It is also harder to work in, and a boundary drawn so tightly that people route around it is worse than a wider one, because the routing around is invisible and is where the covered information actually goes.

That trade is the single most consequential decision in the budget and it is usually made by whoever draws the first diagram.

Six questions before comparing numbers

• Which of the seven lines above does this figure cover?
• Is the assessment fee included, and whose assessor?
• What is the annual cost after the first year?
• What happens to the price if the boundary grows?
• How much of our own time does this assume, and from whom?
• What is explicitly out of scope?

Two quotes answering these differently are quotes for different things, and the cheaper one is frequently the one that assumed more of your time.

A number before seeing an environment

Not caution: the figure would be invented. The cost is driven by the boundary, the state of the documentation and what the gap analysis finds, and none of those is knowable from a phone call.

The counterfactual is losing the contracts

Every figure above is large in isolation and is compared against the wrong thing. The comparison is not against zero; it is against the share of revenue that requires the clause.

Calculate that share before reading any quote. It is usually the number that settles the argument, and it is available from your own sales ledger in an afternoon.

The figure to ask every vendor for

Total cost in year three, including licences, the assessment cycle, and the internal time to keep evidence current.

Year one is dominated by setup and flatters whoever front-loads their pricing. Year three is what you will actually be paying for as long as you hold the contracts.

Splitting the cost inside the business

Compliance spend charged entirely to one department produces an owner with no authority and a budget everybody resents. Where the requirement protects revenue across several product lines, the cost belongs across them.

That is an accounting decision and it changes behaviour: a business unit contributing to the cost takes an interest in the boundary, and an interest in the boundary is the thing that keeps it small.

Assessment fees scale with scope

An assessor prices by the number of controls in play and the size of the environment they have to examine. Two suppliers of the same size can receive quotes differing by a factor of two because one drew a boundary and the other did not.

Ask a prospective assessor how they scope their fee before you finalise the boundary, not after.

Roughly where the money goes

Across the suppliers we have seen, internal time is the largest single line, documentation and remediation together are the next, and software licences are smaller than either. Assessment fees are a modest share and are the one that arrives as a single invoice, which is why they feel larger than they are.

Those proportions vary with the state of an environment and the shape is stable enough to plan against.

Elsewhere in buying and budgeting

• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.