One Price.
Everything Included.

For most small and mid-sized companies, TCSA engagements are indicative and typically fall under ₹5 lakh all-inclusive — ISO 27001 is ₹2–4 Lakh ($3,000–6,000, £2,400–4,800) in year one, our fee plus the certification body’s, which the body charges. SOC 2 is all-in, including the independent CPA attestation: ₹2–3 Lakh ($2,500–5,000) for Type 1 and ₹3–5 Lakh ($3,000–10,000) for Type 2. Final pricing is scope-based (number of employees, systems, locations, and whether you need Type I or Type II). Larger or multi-framework programs are quoted individually.

No. We quote a single fixed, all-inclusive price before we start — covering gap analysis, documentation, policy development, risk assessment, control implementation, employee training, internal audit, and unlimited revisions until you pass. There is no scope creep and no surprise invoices.

For SOC 2, no. Our SOC 2 price is all-in, including the independent CPA attestation. We source and pay the independent, US-licensed CPA firm that issues your report, and we name that firm before you sign with us, together with its licence number, the state board that issued it, and its current AICPA peer review enrolment. For ISO standards, yes, except ISO 42001. The accredited certification body charges its own certification and surveillance audit fees. We coordinate with the certification body on your behalf and tell you its indicative costs upfront so there are no surprises. ISO 42001 is the exception. Its indicative bands include the certification body’s audit fee, the certificate is issued by that body and not by Tranquility Cybersecurity, and the final figure depends on the certification body you choose.

Platforms charge recurring annual fees (₹6-12L/year) that compound over time. Our consulting is a one-time investment. After certification, you only pay surveillance audit fees (₹40-80K/year). Over 3 years, consulting saves you 50-70%.

Everything except the certification body audit fee (for ISO standards other than ISO 42001, whose bands include it). This includes: gap analysis, documentation templates, policy development, risk assessment, control implementation, employee training, internal audit, and unlimited revisions until you pass.

Yes! Typical structure: 30% upfront, 40% at mid-project, 30% before certification audit. We align payments with deliverables so you pay as you see value.

We offer bundled pricing with 15-25% savings. Many controls overlap between ISO 27001, SOC 2, and other frameworks. We leverage shared controls to reduce your cost and timeline.

We're the anti-platform. Platforms require you to do the work with software guidance. We do the work for you. No learning curve, no CISO required, no annual subscription. Many of our clients switched from platforms because they spent more time on the software than getting compliant.

We provide post-certification support. Surveillance audits happen annually (conducted by the certification body). We can support surveillance audit preparation at an additional nominal cost if needed.

An independent, US-licensed CPA firm, one of several we work with. Its fee is inside our all-in price, and we source and pay it. Before you sign with us, we share the firm’s name, its licence number and the state board that issued it, and its current AICPA peer review enrolment, so you can check them yourself.