{
  "$schema": "https://irmcon.com/services.schema.json",
  "version": "1.0",
  "generated": "2026-11-05",
  "prices_reviewed": "2026-11-04",
  "provider": {
    "name": "IRM Consulting & Advisory",
    "url": "https://irmcon.com/",
    "founded": 2013,
    "email": "info@irmcon.com",
    "telephone": "+1-647-800-2590",
    "address": "First Canadian Place, 100 King Street West, Suite 5700, Toronto, ON M5X 1C7, Canada",
    "areas_served": [
      "Canada",
      "USA"
    ]
  },
  "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
  "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/",
  "booking_api": {
    "openapi": "https://irmcon.com/openapi.json",
    "availability": "https://irmcon.com/api/availability",
    "booking_link": "https://irmcon.com/api/booking-link"
  },
  "pricing_tiers": [
    {
      "id": "crawling",
      "name": "Crawling",
      "stage": "Pre-Seed",
      "monthly_price": 2000,
      "currency": "USD",
      "hours_per_month": {
        "min": 15,
        "max": 20
      },
      "summary": "Foundational Cybersecurity & AI Governance services for small and emerging businesses."
    },
    {
      "id": "walking",
      "name": "Walking",
      "stage": "Seed",
      "monthly_price": 4250,
      "currency": "USD",
      "hours_per_month": {
        "min": 20,
        "max": 40
      },
      "summary": "Expanded Cybersecurity & AI Governance services for businesses as they scale."
    },
    {
      "id": "running",
      "name": "Running",
      "stage": "Series",
      "monthly_price": 6950,
      "currency": "USD",
      "hours_per_month": {
        "min": 40,
        "max": 60
      },
      "summary": "Comprehensive, fully managed Cybersecurity & AI Governance program to maintain ongoing compliance."
    },
    {
      "id": "bundles",
      "name": "Bundled Packages",
      "stage": "Bundles",
      "monthly_price": 4950,
      "currency": "USD",
      "hours_per_month": null,
      "summary": "Pre-packaged Starter, Accelerator and Resilience bundles for rapid risk reduction and compliance."
    }
  ],
  "services": [
    {
      "id": "virtual-ciso-services-vciso",
      "name": "Virtual CISO (vCISO) Services",
      "kind": "service",
      "service_type": "Virtual CISO",
      "url": "https://irmcon.com/virtual-ciso-services-vciso/",
      "summary": "Fractional, on-demand CISO leadership covering security strategy, governance, risk, AI governance and compliance oversight for SaaS companies, startups and SMBs.",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [
        "SOC 2",
        "ISO 27001",
        "ISO 42001",
        "CMMC",
        "NIST AI RMF"
      ],
      "price": {
        "amount": 2000,
        "currency": "USD",
        "unit": "month",
        "is_starting_price": true,
        "tier": "Crawling",
        "hours_per_month": {
          "min": 15,
          "max": 20
        }
      },
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=virtual-ciso-services-vciso",
      "related_free_product": {
        "id": "cis-gap-assessment",
        "name": "CIS Gap Assessment",
        "url": "https://irmcon.com/products/cis-gap-assessment/"
      }
    },
    {
      "id": "ai-governance",
      "name": "AI Governance",
      "kind": "service",
      "service_type": "AI Governance",
      "url": "https://irmcon.com/ai-governance/",
      "summary": "AI governance and agentic AI security programs, including AI risk, ethics, fairness and model security assessments, aligned to ISO 42001, the NIST AI RMF and the EU AI Act.",
      "audience": "SaaS companies, startups, SMBs, private equity portfolio companies, and AI-native organizations",
      "frameworks": [
        "ISO 42001",
        "NIST AI RMF",
        "EU AI Act"
      ],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=ai-governance",
      "related_free_product": {
        "id": "ai-governance-playbook",
        "name": "AI Governance Playbook",
        "url": "https://irmcon.com/products/ai-governance-playbook/"
      }
    },
    {
      "id": "governance-risk-compliance-grc",
      "name": "Governance, Risk & Compliance (GRC)",
      "kind": "service",
      "service_type": "Governance, Risk and Compliance",
      "url": "https://irmcon.com/governance-risk-compliance-grc/",
      "summary": "Managed GRC program that brings security governance, risk management and regulatory compliance into one framework.",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [
        "NIST CSF",
        "SOC 2",
        "ISO 27001",
        "ISO 42001"
      ],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=governance-risk-compliance-grc",
      "related_free_product": {
        "id": "cis-gap-assessment",
        "name": "CIS Gap Assessment",
        "url": "https://irmcon.com/products/cis-gap-assessment/"
      }
    },
    {
      "id": "process-risk-controls-prc",
      "name": "Process Risk & Controls (PRC)",
      "kind": "service",
      "service_type": "Process Risk and Controls",
      "url": "https://irmcon.com/process-risk-controls-prc/",
      "summary": "Turns manual business processes into secure, governed agentic AI workflows.",
      "audience": "Small businesses, startups, SMBs, and scaling SaaS companies",
      "frameworks": [
        "ISO 42001",
        "NIST AI RMF"
      ],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=process-risk-controls-prc",
      "related_free_product": {
        "id": "ai-governance-playbook",
        "name": "AI Governance Playbook",
        "url": "https://irmcon.com/products/ai-governance-playbook/"
      }
    },
    {
      "id": "penetration-testing-pt",
      "name": "Penetration Testing",
      "kind": "service",
      "service_type": "Penetration Testing",
      "url": "https://irmcon.com/penetration-testing-pt/",
      "summary": "Simulated attacks on applications, networks and systems to find and fix exploitable vulnerabilities; supports SOC 2, ISO 27001 and PCI DSS requirements.",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [
        "SOC 2",
        "ISO 27001",
        "PCI DSS"
      ],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=penetration-testing-pt",
      "related_free_product": null
    },
    {
      "id": "threat-modeling-tm",
      "name": "Threat Modeling",
      "kind": "service",
      "service_type": "Threat Modeling",
      "url": "https://irmcon.com/threat-modeling-tm/",
      "summary": "Identifies and prioritizes threats and design flaws early in product development.",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [
        "STRIDE"
      ],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=threat-modeling-tm",
      "related_free_product": null
    },
    {
      "id": "devsecops-dso",
      "name": "DevSecOps",
      "kind": "service",
      "service_type": "DevSecOps",
      "url": "https://irmcon.com/devsecops-dso/",
      "summary": "Security built into the SDLC and CI/CD pipeline, including MLSecOps for machine learning systems.",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=devsecops-dso",
      "related_free_product": null
    },
    {
      "id": "cloud-security-controls-csc",
      "name": "Cloud Security Controls",
      "kind": "service",
      "service_type": "Cloud Security",
      "url": "https://irmcon.com/cloud-security-controls-csc/",
      "summary": "Design and hardening of cloud security controls across AWS, Azure and Google Cloud.",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=cloud-security-controls-csc",
      "related_free_product": null
    },
    {
      "id": "data-security-privacy-dsp",
      "name": "Data Security & Privacy",
      "kind": "service",
      "service_type": "Data Security and Privacy",
      "url": "https://irmcon.com/data-security-privacy-dsp/",
      "summary": "Data protection and privacy programs, including Privacy Impact Assessments, for PII and PHI (PIPEDA, PHIPA, HIPAA, GDPR).",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [
        "PIPEDA",
        "PHIPA",
        "HIPAA",
        "GDPR"
      ],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=data-security-privacy-dsp",
      "related_free_product": null
    },
    {
      "id": "security-architecture-sa",
      "name": "Security Architecture",
      "kind": "service",
      "service_type": "Security Architecture",
      "url": "https://irmcon.com/security-architecture-sa/",
      "summary": "Secure reference architectures with defense-in-depth controls, aligned to the NIST CSF and ISO 27001.",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [
        "NIST CSF",
        "ISO 27001"
      ],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=security-architecture-sa",
      "related_free_product": null
    },
    {
      "id": "iot-security",
      "name": "IoT Security",
      "kind": "service",
      "service_type": "IoT Security",
      "url": "https://irmcon.com/iot-security/",
      "summary": "Assessments of IoT devices, firmware, network segmentation, cloud services and APIs, with a prioritized remediation roadmap.",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=iot-security",
      "related_free_product": null
    },
    {
      "id": "cybersecurity-training-awareness",
      "name": "Cybersecurity Training & Awareness",
      "kind": "service",
      "service_type": "Security Awareness Training",
      "url": "https://irmcon.com/cybersecurity-training-awareness/",
      "summary": "Security awareness and human-risk programs, including phishing and social engineering training, delivered as live virtual sessions and workshops.",
      "audience": "SaaS companies, startups, and SMBs",
      "frameworks": [
        "SOC 2"
      ],
      "price": null,
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=cybersecurity-training-awareness",
      "related_free_product": null
    },
    {
      "id": "fractional-ciso",
      "name": "Fractional CISO Services",
      "kind": "program",
      "service_type": "Fractional CISO",
      "url": "https://irmcon.com/fractional-ciso/",
      "summary": "A part-time security executive on a monthly retainer who owns the security program, compliance and board reporting.",
      "audience": "Startups, B2B SaaS companies, SMBs, and private equity portfolio companies",
      "frameworks": [
        "SOC 2",
        "ISO 27001",
        "ISO 42001",
        "CMMC",
        "CIS Controls"
      ],
      "price": {
        "amount": 2000,
        "currency": "USD",
        "unit": "month",
        "is_starting_price": true,
        "tier": "Crawling",
        "hours_per_month": {
          "min": 15,
          "max": 20
        }
      },
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=fractional-ciso",
      "related_free_product": {
        "id": "cis-gap-assessment",
        "name": "CIS Gap Assessment",
        "url": "https://irmcon.com/products/cis-gap-assessment/"
      }
    },
    {
      "id": "soc-2-compliance",
      "name": "SOC 2 Compliance Readiness",
      "kind": "program",
      "service_type": "SOC 2 Compliance",
      "url": "https://irmcon.com/soc-2-compliance/",
      "summary": "SOC 2 readiness: report scoping, gap assessment against all 61 Trust Services Criteria, controls, evidence and CPA firm liaison. Type I audit-ready in about 90 days.",
      "audience": "B2B SaaS companies, startups, and SMBs selling to enterprise customers",
      "frameworks": [
        "SOC 2"
      ],
      "price": {
        "amount": 4250,
        "currency": "USD",
        "unit": "month",
        "is_starting_price": true,
        "tier": "Walking",
        "hours_per_month": {
          "min": 20,
          "max": 40
        }
      },
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=soc-2-compliance",
      "related_free_product": {
        "id": "soc2",
        "name": "SOC 2 Gap Assessment",
        "url": "https://irmcon.com/products/soc2/"
      }
    },
    {
      "id": "iso27001-consulting",
      "name": "ISO 27001 Consulting",
      "kind": "program",
      "service_type": "ISO 27001 Certification Readiness",
      "url": "https://irmcon.com/iso27001-consulting/",
      "summary": "ISO/IEC 27001:2022 ISMS scoping, all 93 Annex A controls and certification audit readiness in about 90 days.",
      "audience": "B2B SaaS companies, startups, and SMBs selling to enterprise and international customers",
      "frameworks": [
        "ISO 27001"
      ],
      "price": {
        "amount": 4250,
        "currency": "USD",
        "unit": "month",
        "is_starting_price": true,
        "tier": "Walking",
        "hours_per_month": {
          "min": 20,
          "max": 40
        }
      },
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=iso27001-consulting",
      "related_free_product": {
        "id": "iso27001",
        "name": "ISO 27001 Gap Assessment",
        "url": "https://irmcon.com/products/iso27001/"
      }
    },
    {
      "id": "iso42001-consulting",
      "name": "ISO 42001 Consulting",
      "kind": "program",
      "service_type": "ISO 42001 Certification Readiness",
      "url": "https://irmcon.com/iso42001-consulting/",
      "summary": "ISO/IEC 42001 AI Management System (AIMS) scoping, AI risk assessments and the 38 Annex A controls, audit-ready in about 90 days.",
      "audience": "SaaS and AI-first companies, and SMBs deploying AI in regulated markets",
      "frameworks": [
        "ISO 42001",
        "NIST AI RMF"
      ],
      "price": {
        "amount": 4250,
        "currency": "USD",
        "unit": "month",
        "is_starting_price": true,
        "tier": "Walking",
        "hours_per_month": {
          "min": 20,
          "max": 40
        }
      },
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=iso42001-consulting",
      "related_free_product": {
        "id": "iso42001",
        "name": "ISO 42001 Gap Assessment",
        "url": "https://irmcon.com/products/iso42001/"
      }
    },
    {
      "id": "cmmc-compliance",
      "name": "CMMC Compliance",
      "kind": "program",
      "service_type": "CMMC Compliance",
      "url": "https://irmcon.com/cmmc-compliance/",
      "summary": "CMMC Level 1 and Level 2 readiness for US defense suppliers (NIST SP 800-171, SSP, POA&M, SPRS, C3PAO readiness) and CPCSC alignment for Canadian defence suppliers.",
      "audience": "Small and mid-sized defense subcontractors and manufacturers in the USA and Canada",
      "frameworks": [
        "CMMC",
        "NIST SP 800-171",
        "CPCSC"
      ],
      "price": {
        "amount": 2000,
        "currency": "USD",
        "unit": "month",
        "is_starting_price": true,
        "tier": "Crawling",
        "hours_per_month": {
          "min": 15,
          "max": 20
        }
      },
      "pricing_url": "https://irmcon.com/cybersecurity-pricing/",
      "booking_url": "https://irmcon.com/cybersecurity-consulting-appointments/?utm_source=services-json&utm_medium=catalog&utm_campaign=cmmc-compliance",
      "related_free_product": {
        "id": "cybersecurity-baseline-assessment",
        "name": "Cybersecurity Baseline Assessment",
        "url": "https://irmcon.com/products/cybersecurity-baseline-assessment/"
      }
    }
  ],
  "free_products": [
    {
      "id": "ai-governance-playbook",
      "name": "AI Governance Playbook",
      "url": "https://irmcon.com/products/ai-governance-playbook/",
      "app_url": "https://irmcon.com/products/ai-governance-playbook-app/",
      "summary": "Builds a tailored AI governance framework, risk findings and a 90-day plan for SMBs adopting AI apps, agents and agentic workflows (NIST AI RMF, ISO 42001, EU AI Act).",
      "frameworks": [
        "NIST AI RMF",
        "ISO 42001",
        "EU AI Act"
      ],
      "price": 0
    },
    {
      "id": "cybersecurity-baseline-assessment",
      "name": "Cybersecurity Baseline Assessment",
      "url": "https://irmcon.com/products/cybersecurity-baseline-assessment/",
      "app_url": "https://irmcon.com/products/cybersecurity-baseline-assessment-app/",
      "summary": "Gap assessment against CAN/DGSI 104:2021 (Rev 2:2026), Canada's baseline cyber security controls for small and medium organizations.",
      "frameworks": [
        "CAN/DGSI 104"
      ],
      "price": 0
    },
    {
      "id": "cis-gap-assessment",
      "name": "CIS Gap Assessment",
      "url": "https://irmcon.com/products/cis-gap-assessment/",
      "app_url": "https://irmcon.com/products/cis-gap-assessment-app/",
      "summary": "Gap assessment against the CIS Critical Security Controls v8.1 at Implementation Group 1, 2 or 3 scope.",
      "frameworks": [
        "CIS Controls v8.1"
      ],
      "price": 0
    },
    {
      "id": "iso42001",
      "name": "ISO 42001 Gap Assessment",
      "url": "https://irmcon.com/products/iso42001/",
      "app_url": "https://irmcon.com/products/iso42001-app/",
      "summary": "Gap assessment against ISO/IEC 42001:2023, Clauses 4 to 10 and the 38 Annex A controls.",
      "frameworks": [
        "ISO 42001"
      ],
      "price": 0
    },
    {
      "id": "soc2",
      "name": "SOC 2 Gap Assessment",
      "url": "https://irmcon.com/products/soc2/",
      "app_url": "https://irmcon.com/products/soc2-app/",
      "summary": "Readiness assessment against all 61 AICPA Trust Services Criteria at Type I or Type II level. Not a SOC 2 examination.",
      "frameworks": [
        "SOC 2"
      ],
      "price": 0
    },
    {
      "id": "iso27001",
      "name": "ISO 27001 Gap Assessment",
      "url": "https://irmcon.com/products/iso27001/",
      "app_url": "https://irmcon.com/products/iso27001-app/",
      "summary": "Gap assessment against ISO/IEC 27001:2022, Clauses 4 to 10 and the 93 Annex A controls.",
      "frameworks": [
        "ISO 27001"
      ],
      "price": 0
    }
  ]
}