Best for early-stage teams looking for advisory support and a single-framework compliance foundation.

Included:

Compliance Advisory services for 1 framework

Dedicated GRC Engineer for expert level support

Policy templates with advisory on implementation (client-led execution)

Vendor risk oversight guidance (advisory only)

Strategic risk management program setup (advisory only)

Disaster recovery & business continuity planning (advisory only)

Audit-readiness guidance (advisory only)

Control & test remediation support (advisory only)

Slack-based support

Built for organizations ready to scale their security efforts with hands-on support across two frameworks, tailored execution, and a focus on doing compliance right from the start.

Includes everything in LITE, plus:

Execution-Level Support:

Management of Vanta instance

Compliance across 2 frameworks

Policies written by GRC Concierge, approved by client

Hands-on risk program:

-Adding risks

-Control mapping

-Risk treatment planning

Vendor Risk Program Design (Client executed)

We run questionnaires using Vanta (unlimited with module / capped at 5 per Quarterly without)

Custom Google Forms for vendors with tailored security questions

We run Vendor Risk using Vanta (unlimited with module / capped at 5 per Quarterly without)

Disaster Recovery & Business Continuity Testing creation (client led execution)

Incident Management Testing Creation (Client executed)

Templates and creation guidance - client led execution

1x Annual Penetration Test (Web and Mobile only)

1x Annual Vulnerability Scan

Slack support and quarterly executive touchpoints

Standard response package for frequently asked questions

Guidance for outlier questions

GRC Concierge Badge to showcase ongoing compliance commitment

Designed for organizations committed to embedding security into their culture, the Luxe package delivers deep involvement, unlimited frameworks, and executive-level guidance to build trust and demonstrate lasting compliance.

Includes everything in ESPRESSO, plus:

Enterprise-Level Delivery:

Unlimited Framework Coverage

Dedicated vCISO and GRC Engineer

Full execution of all programs

Policy writing and enforcement

Audit checklist completion and final gap recommendations

Disaster Recovery and Incident Management – scheduling, moderating, reporting

End-to-End Vendor Risk Management

Unlimited with Vanta module, or capped at 10 per quarter without

Management of incoming and outgoing questionnaires

3x Vulnerability Scans annually

Annual Penetration Testing (Web, Mobile, and API)

Monthly Gap Assessments and Executive Reports

KPI and KRI Development and Management

Enterprise-Grade Security Awareness Training

Advanced Vulnerability Management

Slack and Google Meet support

Quarterly Executive Engagements

GRC Concierge Badge to showcase ongoing compliance commitment