Start free. Upgrade when the work gets serious.
TractionGRC gives small teams a practical way to understand cybersecurity, organize evidence, and grow into formal compliance. Start free, move to Starter for monitoring and cloud posture, and upgrade to Professional when ISO 27001, SOC 2, supplier assurance, or advanced Security Intelligence becomes part of the roadmap.
Want to explore first? Start on the Free tier. No credit card required.
Free
$0 forever
Best for nonprofits and small teams getting started. Use it to understand your risks, organize the basics, and see your first readiness score.
Start free- Up to 3 users
- Up to 15 documents
- NIST CSF 2.0 and CIS Controls starter visibility
- Risk register and remediation tracking
- Context & Scope workspace
- Controls Tracker
- KPI & Monitoring basics
- TractionScore™ dashboard
- 1 Security Checkup / domain baseline scan
- 15 TractionAI helper calls per month
- Up to 3 suppliers
Starter
$349 /mo
$3,490 /yr
Save $698, equal to 2 months free
Best for growing organizations preparing for customer security reviews, recurring monitoring, and foundational cloud posture visibility.
Get started- NIST CSF 2.0, CIS Controls, and CMMC 2.0 Level 1 (Foundational)
- Core ISMS modules (scope, risk, controls, documents)
- TractionScore™ dashboard
- TractionAI guidance and remediation assistance
- Azure and Google Workspace signals hub
- Security Checkup plus Domain Deep Scan
- Continuous monitoring
- Up to 10 users, 100 documents, and 10 suppliers
- 75 TractionAI calls per month
- Email support
Professional
$999 /mo
$9,990 /yr
Save $1,998, equal to 2 months free
Best for formal compliance, supplier assurance, advanced Security Intelligence, and multi-framework operations.
Book a walkthrough- Everything in Starter
- ISO 27001, SOC 2, ISO 42001, and CMMC 2.0 Level 2 (Advanced)
- Cross-mapped controls across every framework
- Supplier Assurance: respond to and issue SSPA, SIG, CAIQ, and HITRUST
- Security Intelligence: incident correlation, verdict, and compliance impact
- AWS Connect (in addition to Azure and Google)
- AI Risk Score
- TractionScore™ Registry and shareable profile
- Auditor guest portal with time-boxed access
- Exportable evidence packs indexed by clause
- Up to 50 users, 500 documents, 50 suppliers
- 500 TractionAI calls per month
- Priority support
Enterprise
Custom
Pricing depends on scale, deployment, and assurance needs
Multi-framework compliance programs, privacy obligations, supplier ecosystems, or organizations requiring dedicated deployment models.
Contact sales- Everything in Professional
- ISO 27701 for privacy and CMMC 2.0 Level 3 (Expert) for critical DoD programs
- Custom supplier assurance programs built for your standard
- AI Governance Dashboards and AI Trust Score
- Unlimited users, documents, and suppliers
- Unlimited TractionAI calls
- Custom SLA with uptime and response targets
- Named customer success contact
- Single-tenant deployment available
Why teams upgrade to TractionGRC
Most organizations do not struggle because they lack tools. They struggle because compliance lives in too many places.
Replace scattered spreadsheets
Bring controls, risks, evidence, suppliers, and readiness into one workspace.
Reuse evidence across frameworks
Build once and map across ISO 27001, SOC 2, NIST CSF, and supplier assurance workflows.
Respond faster to questionnaires
Reduce repetitive responses by maintaining a reusable source of truth.
Measure maturity over time
Use TractionScore to understand readiness, gaps, and operational progress.
Which plan fits best?
Choose Starter if
You are a small team starting your first security or compliance program. Customers are beginning to ask for questionnaires, or you are a DoD sub handling Federal Contract Information. You want NIST CSF, CIS Controls, CMMC Level 1, and Azure or Google Workspace posture in place before deeper certification work begins.
Choose Professional if
You are driving toward ISO 27001, SOC 2, or CMMC Level 2, managing AWS workloads, and starting to send supplier assurance questionnaires to your own vendor base.
Choose Enterprise if
You manage a multi-framework program, privacy obligations under ISO 27701, critical DoD requirements, hundreds of suppliers, or deployment needs that require single-tenant infrastructure.
Looking for a free starting point? TractionGRC Free gives small teams a practical cybersecurity baseline with NIST CSF, CIS Controls starter visibility, risk tracking, Context & Scope, KPI basics, up to 15 documents, one Security Checkup, and your TractionScore. No credit card required.
What is included on each plan
| Capability | Free | Starter | Professional | Enterprise |
|---|---|---|---|---|
| Security Checkup | Included in Free | Included in Starter | Included in Professional | Included in Enterprise |
| NIST CSF 2.0 | Included in Free | Included in Starter | Included in Professional | Included in Enterprise |
| CIS Controls | Included in Free | Included in Starter | Included in Professional | Included in Enterprise |
| CMMC 2.0 Level 1 (FCI) | Not in Free | Included in Starter | Included in Professional | Included in Enterprise |
| Respond to assurance programs | Not in Free | Not in Starter | Included in Professional | Included in Enterprise |
| Issue assurance programs (SSPA, SIG, CAIQ, HITRUST) | Not in Free | Not in Starter | Included in Professional | Included in Enterprise |
| Custom supplier assurance programs | Not in Free | Not in Starter | Not in Professional | Included in Enterprise |
| ISO 27001 | Not in Free | Not in Starter | Included in Professional | Included in Enterprise |
| SOC 2 | Not in Free | Not in Starter | Included in Professional | Included in Enterprise |
| ISO 42001 | Not in Free | Not in Starter | Included in Professional | Included in Enterprise |
| CMMC 2.0 Level 2 (CUI) | Not in Free | Not in Starter | Included in Professional | Included in Enterprise |
| ISO 27701 | Not in Free | Not in Starter | Not in Professional | Included in Enterprise |
| CMMC 2.0 Level 3 (critical CUI) | Not in Free | Not in Starter | Not in Professional | Included in Enterprise |
| AI Essentials | Included in Free | Included in Starter | Included in Professional | Included in Enterprise |
| AI Risk Score | Not in Free | Not in Starter | Included in Professional | Included in Enterprise |
| AI Governance Dashboards | Not in Free | Not in Starter | Not in Professional | Included in Enterprise |
| AI Trust Score | Not in Free | Not in Starter | Not in Professional | Included in Enterprise |
| Azure + Google Workspace Connect | Not in Free | Included in Starter | Included in Professional | Included in Enterprise |
| AWS Connect | Not in Free | Not in Starter | Included in Professional | Included in Enterprise |
| Domain Deep Scan | Not in Free | Included in Starter | Included in Professional | Included in Enterprise |
| TractionAI remediation guidance | Not in Free | Included in Starter | Included in Professional | Included in Enterprise |
| Continuous monitoring | Not in Free | Included in Starter | Included in Professional | Included in Enterprise |
| Security Intelligence (incident correlation) | Not in Free | Not in Starter | Included in Professional | Included in Enterprise |
| Users | 3 | 10 | 50 | Unlimited |
| Documents | 15 | 100 | 500 | Unlimited |
| Suppliers | 3 | 10 | 50 | Unlimited |
| TractionAI calls / month | 15 | 75 | 500 | Unlimited |
Frequently asked questions
Can I try TractionGRC for free?
Yes. The Free tier gives you NIST CSF, CIS Controls starter visibility, risk tracking, Context & Scope, KPI basics, up to 15 documents, one Security Checkup, 15 TractionAI helper calls, up to 3 suppliers, and your TractionScore. No credit card required, and no time limit.
Can I change plans later?
Yes. Most teams begin on Free or Starter, then move to Professional when ISO 27001, SOC 2, or supplier assurance becomes part of their roadmap.
What frameworks are included on Starter?
Starter includes NIST CSF 2.0, CIS Controls, CMMC 2.0 Level 1 for DoD subs handling Federal Contract Information, Azure and Google Workspace Connect, Domain Deep Scan, continuous monitoring, and expanded usage limits. NIST CSF and CIS starter visibility are also available on Free.
Which signals hub do I get on Starter?
Starter includes Azure and Google Workspace cloud connect, plus domain deep scan for external attack surface monitoring. AWS Connect requires Professional, since AWS environments tend to be larger and more complex than the SMB-focused Azure and Google footprints we see at the Starter level.
What does Professional add?
Professional adds ISO 27001, SOC 2, ISO 42001, CMMC 2.0 Level 2, supplier assurance (responding to and issuing SSPA, SIG, CAIQ, and HITRUST), Security Intelligence with incident correlation and compliance impact, AWS Connect, AI Risk Score, and higher usage limits.
What does Enterprise add?
Enterprise adds ISO 27701 for privacy, CMMC 2.0 Level 3 for contractors on critical DoD programs, AI Governance Dashboards, AI Trust Score, custom supplier assurance programs, single-tenant deployment options, and unlimited scale.
Is SSPA included?
Supplier assurance is a Professional feature. Both responding to questionnaires like SSPA, SIG, SIG Lite, CAIQ, and HITRUST and issuing your own programs to suppliers come with Professional.
Which CMMC level do I need?
It depends on what DoD data you handle. Level 1 covers Federal Contract Information and applies to many DoD contractors. Level 2 is for organizations handling CUI and usually requires third-party assessment. Level 3 is for critical programs. The required level should appear in your contract solicitation.
How many users and suppliers are included?
Free includes 3 users, 15 documents, and 3 suppliers. Starter includes 10 users, 100 documents, and 10 suppliers. Professional includes 50 users, 500 documents, and 50 suppliers. Enterprise is unlimited.
How many TractionAI calls are included?
Free includes 15 calls per month, Starter includes 75, Professional includes 500, and Enterprise is unlimited. A TractionAI call is a single policy draft, risk suggestion, remediation recommendation, or assisted task.
Do you offer annual billing?
Yes. Annual billing includes two months free compared with monthly pricing on Starter and Professional plans.
How does Enterprise pricing work?
Enterprise pricing depends on deployment model, SLA level, scale, and the shape of your supplier assurance program. We quote per customer because the range is genuinely wide.