Pricing a cloud compliance engagement
Written for firms. Price cloud compliance on the things that drive effort: accounts, providers, starting state and the standard. Buyers compare fixed-scope offers, so publish what is included.
Most Canadian buyers see cloud compliance offers between $8,000 and $40,000 CAD, fixed scope, split into cloud hardening and readiness. Price on the number of accounts or subscriptions, the number of providers, whether production is already separated, and which standard is in scope. Quote a range after one scoping call and a fixed price after a short discovery.
What drives effort
| Driver | Low effort | High effort |
|---|---|---|
| Account structure | Production already separated | One shared account, production must move |
| Providers | One | Two or three with production data |
| Identity | SSO in place | Local cloud users and shared keys |
| IaC maturity | Everything in Terraform or Bicep | Console-built infrastructure |
| Standard | SOC 2 security only | SOC 2 plus ISO 27001, or PCI DSS |
| Client engineering time | Dedicated platform engineer | No one available |
Pricing models
- Fixed scope
- Named deliverables, stated exclusions. Buyers prefer it and it is easier to compare.
- Time and materials with an estimate
- Suits hardening where the starting state is unclear. Cap it or report burn weekly.
- Retainer
- Evidence upkeep, access reviews, annual audit support. $1,500 to $6,000 CAD a month is common for small clients.
A worked example
A 40 person SaaS company on AWS, one account holding production and staging, SSO through Google Workspace, no Terraform, SOC 2 Type 2 requested by a customer for next spring. A defensible offer splits it in two.
| Phase | Deliverables | Fixed fee (CAD) |
|---|---|---|
| Account restructure | Organization, five accounts, Identity Center, organization trail, Config and Security Hub, SCPs, production migration plan | $14,000 to $20,000 |
| Readiness | Gap assessment, control matrix, 15 policies, evidence map, first access review, restore test, auditor introduction | $18,000 to $26,000 |
| Optional retainer | Monthly evidence upkeep and fieldwork support during the window | $2,000 to $3,500 a month |
State the exclusions: the audit fee, the penetration test, provider charges, and remediation of application code. Buyers compare exclusions as closely as totals.
Pricing mistakes that cost margin
- Fixed price before discovery. A single account with fifty console-built resources is a different project from one built in Terraform.
- Assuming client engineering time. If the client has no one free, your team does the changes. Price it.
- Unbounded fieldwork support. Cap auditor questions within the fee or state the hourly rate.
- Ignoring the second provider. A small Azure or Google Cloud footprint still needs identity, logging and evidence.
Should we bundle a compliance platform in our price?
Only if it fits the client. Disclose any referral arrangement and say when a platform is not needed; buyers now ask.
List your firm
A free listing puts your pricing approach in front of Canadian buyers.
List your firm