specification: API Commons Plans
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/Plans
provider: Secureframe
providerId: secureframe
created: '2026-05-08'
modified: '2026-08-27'
generated: '2026-08-27'
method: searched
source: https://secureframe.com/pricing (HTTP 200, fetched 2026-08-27)
reconciled: true
tags:
- GRC
- Compliance
- SOC 2
- ISO 27001
- Risk
- Plans
description: Secureframe publishes three named packages on its pricing page — Fundamentals, Complete and Defense
  — with a feature comparison table. Only Fundamentals carries a public number ("Starting at $7,000/year");
  Complete and Defense are "Get a quote". API access is not itemised as a separate line on any tier and is
  not metered.
plan_count: 3
notes: No self-serve signup and no published API pricing. Every tier routes to "Get a quote"; the API and the
  hosted MCP server are included with a paid subscription rather than sold separately, and there is no usage-based
  API charge, quota or overage published anywhere.
sources:
- https://secureframe.com/pricing
- https://api.secureframe.com/docs
- https://mcp.secureframe.com/mcp_docs
plans:
- id: secureframe-fundamentals
  name: Fundamentals
  type: paid
  tagline: Get compliant fast
  description: 'Entry package: one compliance framework, infrastructure monitoring, evidence collection, personnel/risk/policy
    management and Trust Center.'
  entries:
  - label: Subscription
    name: subscription
    type: flat
    metric: annual subscription
    limit: -1
    timeFrame: yearly
    geo: global
    unit: 1
    price: 7000
    currency: USD
    price_note: Starting at $7,000/year, as published on the pricing page
    userMultiplied: false
  limits:
  - name: Compliance frameworks
    value: 1
  - name: Custom automated tests
    value: 1
  - name: Automated asset scoping rules per asset type
    value: 1
  elements:
  - Infrastructure Monitoring
  - Custom Frameworks, Controls, and Tests
  - Evidence Collection
  - Personnel Management
  - Risk Management
  - Policy Management
  - Trust Center
  - 300+ native integrations
  - Public API access
  - Hosted MCP server access
- id: secureframe-complete
  name: Complete
  type: paid
  tagline: Scale your compliance program and grow your business
  description: Everything in Fundamentals plus advanced TPRM, advanced risk management, advanced user access
    reviews, advanced Trust Center, advanced questionnaire automation and SSO/SCIM connections.
  entries:
  - label: Subscription
    name: subscription
    type: flat
    metric: annual subscription
    limit: -1
    timeFrame: yearly
    geo: global
    unit: 1
    price: contact sales
    userMultiplied: false
  limits:
  - name: Custom automated tests
    value: unlimited
  - name: Automated asset scoping rules per asset type
    value: unlimited
  elements:
  - Advanced Third-Party Risk Management
  - Advanced Risk Management
  - Advanced User Access Reviews
  - Advanced Trust Center
  - Advanced Questionnaire Automation
  - SSO & SCIM Connections
  - Additional Workspaces (add-on)
- id: secureframe-defense
  name: Defense
  type: paid
  tagline: Simplify SSP, POA&M, and other CMMC compliance requirements
  description: Everything in Complete plus the CMMC/Defense surface. This is the tier the SSP and POA&M API
    resources belong to.
  entries:
  - label: Subscription
    name: subscription
    type: flat
    metric: annual subscription
    limit: -1
    timeFrame: yearly
    geo: global
    unit: 1
    price: contact sales
    userMultiplied: false
  elements:
  - SPRS Score Tracker
  - System Security Plan (SSP)
  - Plan of Action & Milestones (POA&M)
  - Automate SSP Implementation Statuses
  - Managed CUI Enclave
  - Managed Virtual Desktops
  - Manage CUI Vendors
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com