The right plan for your ISMS.
Try it free for 30 days with every feature. After that, you use the centrally maintained frameworks: ISO/IEC 27001 Annex A from Starter, and from Pro also NIST CSF 2.0, NIST SP 800-53, NIS2, DORA, FINMA Circular 2023/1 and the Swiss frameworks ICT baseline protection (Switzerland), ICT Minimum Standard (Switzerland) and data security under the FADP. Starter and Pro with hosting in Switzerland, Ultimate also at a location of your choice or on-premises.
Yearly: 1 month free
Try it free for 30 days – with every feature, no credit card required. Then choose Starter or Pro.
Without a purchase, your account then continues free of charge with limited features; your data is kept.
Starter
For getting started with one standard.
EUR 107per monthOrder now- Up to 15 users, unlimited employees
- Platform framework ISO/IEC 27001 Annex A
- ISO/IEC 27001 readiness check
- CSV import, e.g. from Excel
- Support requests directly from the app
- Recommended
Pro
For the path to certification and several standards.
EUR 650per monthOrder now- Unlimited users
- Several organisations under one account
- Platform frameworks: ISO/IEC 27001:2022 Annex A, NIST CSF 2.0, NIST SP 800-53 Rev. 5, NIS2, ICT baseline protection (Switzerland), ICT Minimum Standard (Switzerland), FINMA Circular 2023/1, DORA, Data security under the FADP
- Framework cross-check: equivalent or contained requirements fulfilled automatically
- ISO/IEC 27001 readiness check
- Maturity level 0–4 per requirement
- Single sign-on
- Import from JIRA
- Import from ServiceNow
- Microsoft 365: Entra ID (SCIM), Teams, Intune
- REST API and webhooks
Ultimate
Everything in Pro, plus your specific requirements.
On requestSend a request- Everything in Pro
- Operation at a location of your choice or on-premises
- Further requests by arrangement
Prices in euros for accounts based in the EU or the rest of the EEA, in Swiss francs for Switzerland and Liechtenstein. All other accounts pay in US dollars. No VAT is charged.
Orders from the EU are for businesses only: when ordering, you enter your VAT identification number. If you pay on invoice, the invoice is issued without VAT under the reverse-charge procedure and paid by bank transfer (SEPA). You can also pay by credit card.
Plans compared
Features your plan does not include remain visible in the software: they are shaded, and a note names the plan that includes them. Nothing is deleted when you change plan. On a smaller plan, platform frameworks it does not cover become read-only; if your account has more users than allowed, the most recently assigned functional roles are removed and further organisations are archived.
| Feature | Starter | Pro | Ultimate |
|---|---|---|---|
| Frameworks and readiness check | |||
| Your own frameworks and requirementsEntered by hand | included | included | included |
| Platform frameworksMaintained centrally and kept up to date | ISO/IEC 27001:2022 Annex A |
|
|
| Framework cross-checkCoverage in a radar chart; equivalent or contained requirements of other frameworks fulfilled automatically | not included | included | included |
| ISO/IEC 27001 readiness check | included | included | included |
| Maturity level 0–4Assess per requirement, can be switched on for any framework; always included with the ICT Minimum Standard (Switzerland) | not included | included | included |
| Import and integrations | |||
| CSV importRisks, measures, exceptions, assets, findings and your own frameworks, e.g. from Excel | included | included | included |
| Import from JIRATake over issues from JIRA Cloud, with preview, conflicts and undo | not included | included | included |
| Import from ServiceNowChanges and tasks as measures, CMDB items as assets – read-only | not included | included | included |
| Import from Microsoft IntuneManaged devices as assets, as groups or individually – read-only | not included | included | included |
| People from Microsoft Entra ID (SCIM)Joiners and changes automatically, leavers blocked immediately | not included | included | included |
| Notifications in Microsoft TeamsPending approvals, incidents and overdue tasks in the channel, with reference and link only | not included | included | included |
| REST API and webhooksOther systems read and record data; access per key, signed notifications on events | not included | included | included |
| People and sign-in | |||
| UsersPeople with more permissions than “employees”; anyone who only reports and reads policies does not count | 15 | Unlimited | Unlimited |
| EmployeesReport incidents and risks, read policies | Unlimited | Unlimited | Unlimited |
| Organisations in the accountFor example subsidiaries, sites or departments, with strictly separated data. Active organisations count; archived ones are kept. | 1 active | Unlimited | Unlimited |
| Sign-in with password, second factor or passkey | included | included | included |
| Single sign-onSign in through your company’s identity provider, e.g. Microsoft Entra ID | not included | included | included |
| Operations | |||
| Hosting | In Switzerland | In Switzerland | Location of your choice or on-premises |
| Support requests from the appFor Tenant Admins, with the status of requests; by email on all plans | included | included | included |
| Special requestse.g. integrations, data migration, training | not included | not included | By arrangement |
Frameworks and readiness check
Your own frameworks and requirements
Entered by hand
- Starter
- included
- Pro
- included
- Ultimate
- included
Platform frameworks
Maintained centrally and kept up to date
- Starter
- ISO/IEC 27001:2022 Annex A
- Pro
- ISO/IEC 27001:2022 Annex A
- NIST CSF 2.0
- NIST SP 800-53 Rev. 5
- NIS2
- ICT baseline protection (Switzerland)
- ICT Minimum Standard (Switzerland)
- FINMA Circular 2023/1
- DORA
- Data security under the FADP
- Ultimate
- ISO/IEC 27001:2022 Annex A
- NIST CSF 2.0
- NIST SP 800-53 Rev. 5
- NIS2
- ICT baseline protection (Switzerland)
- ICT Minimum Standard (Switzerland)
- FINMA Circular 2023/1
- DORA
- Data security under the FADP
Framework cross-check
Coverage in a radar chart; equivalent or contained requirements of other frameworks fulfilled automatically
- Starter
- not included
- Pro
- included
- Ultimate
- included
ISO/IEC 27001 readiness check
- Starter
- included
- Pro
- included
- Ultimate
- included
Maturity level 0–4
Assess per requirement, can be switched on for any framework; always included with the ICT Minimum Standard (Switzerland)
- Starter
- not included
- Pro
- included
- Ultimate
- included
Import and integrations
CSV import
Risks, measures, exceptions, assets, findings and your own frameworks, e.g. from Excel
- Starter
- included
- Pro
- included
- Ultimate
- included
Import from JIRA
Take over issues from JIRA Cloud, with preview, conflicts and undo
- Starter
- not included
- Pro
- included
- Ultimate
- included
Import from ServiceNow
Changes and tasks as measures, CMDB items as assets – read-only
- Starter
- not included
- Pro
- included
- Ultimate
- included
Import from Microsoft Intune
Managed devices as assets, as groups or individually – read-only
- Starter
- not included
- Pro
- included
- Ultimate
- included
People from Microsoft Entra ID (SCIM)
Joiners and changes automatically, leavers blocked immediately
- Starter
- not included
- Pro
- included
- Ultimate
- included
Notifications in Microsoft Teams
Pending approvals, incidents and overdue tasks in the channel, with reference and link only
- Starter
- not included
- Pro
- included
- Ultimate
- included
REST API and webhooks
Other systems read and record data; access per key, signed notifications on events
- Starter
- not included
- Pro
- included
- Ultimate
- included
People and sign-in
Users
People with more permissions than “employees”; anyone who only reports and reads policies does not count
- Starter
- 15
- Pro
- Unlimited
- Ultimate
- Unlimited
Employees
Report incidents and risks, read policies
- Starter
- Unlimited
- Pro
- Unlimited
- Ultimate
- Unlimited
Organisations in the account
For example subsidiaries, sites or departments, with strictly separated data. Active organisations count; archived ones are kept.
- Starter
- 1 active
- Pro
- Unlimited
- Ultimate
- Unlimited
Sign-in with password, second factor or passkey
- Starter
- included
- Pro
- included
- Ultimate
- included
Single sign-on
Sign in through your company’s identity provider, e.g. Microsoft Entra ID
- Starter
- not included
- Pro
- included
- Ultimate
- included
Operations
Hosting
- Starter
- In Switzerland
- Pro
- In Switzerland
- Ultimate
- Location of your choice or on-premises
Support requests from the app
For Tenant Admins, with the status of requests; by email on all plans
- Starter
- included
- Pro
- included
- Ultimate
- included
Special requests
e.g. integrations, data migration, training
- Starter
- not included
- Pro
- not included
- Ultimate
- By arrangement
Questions about plans and billing
How do I order a plan?
You open your account yourself via “Try it free” and can get started straight away: 30 days with every feature. You order Starter and Pro online, by credit card or by invoice. With a credit card (also Apple Pay, Google Pay), the plan is active as soon as the payment has been made; by invoice, you enter your billing details when signing up and can start straight away: until your payment has arrived, your trial with every feature continues (for at most 30 days), and then the plan you ordered is activated. For Ultimate, please get in touch with us.
How is billing handled?
Monthly or annually in advance. With an annual subscription you pay for 11 months and get 12, so one month is free. With a credit card, the amount is charged automatically at the start of each term. By invoice (payable within 30 days), the next invoice arrives by email before the term ends.
Can I change the plan later?
Yes, directly in the software under Administration › Account & contacts. You get a larger plan after paying the difference for the remaining term. A smaller plan or Free applies from the next term; until then, you keep using your plan as before. Without a paid term, the switch to Free applies immediately. Nothing is deleted: platform frameworks that the new plan does not include become read-only; if your account has more users than allowed, the most recently assigned functional roles are removed, and additional organisations are archived.
How can I cancel?
At any time, directly in the software under Administration › Account & contacts. The cancellation takes effect at the end of the current billing interval; until then, you can keep working as normal.
What happens to our data after cancellation?
Beforehand, you can request a complete export of your data as a ZIP file at any time. After the contract ends, the data is deleted completely once your account’s deletion period has expired, including uploaded files.
What is the ISO/IEC 27001 readiness check?
It shows how close your organisation is to certification to ISO/IEC 27001. Varmo checks clauses 4 to 10 of the standard including Annex A, most checkpoints directly from your data; for three checkpoints, you also confirm what Varmo shows from the data. For each gap you see the likely finding of an auditor and a link to the place where you close it. Completed checks are kept as a report. Included from the Starter plan.
Not sure which plan fits?
In a demo, we work out together what your organisation needs.