---
title: "What GRC costs: a cost model for a 25 to 250-person UK firm"
canonical: https://www.grcmana.io/vault/grc/grc-cost
published: 2026-10-21
updated: 2026-10-23
author: "Harry West"
framework: "GRC"
control: "Guide What GRC costs: a cost model for a 25 to 250-person UK firm"
journeyStage: fundamentals
---

# What GRC costs: a cost model for a 25 to 250-person UK firm

## Key takeaways

GRC cost for a UK firm of 25 to 250 people is the sum of six lines: people, outside help, tooling, certification and audit fees, training, and staff time. Building the system costs more than running it, scope moves the total most, and automating evidence collection cuts the staff-time line most budgets miss.

- **Core cyber salary** — DSIT's 2025 cyber skills study put the median advertised salary for a core cyber security job in the UK at £55,000, based on job postings made during 2024.
- **Employer on-costs** — For 2025 to 2026, employers pay National Insurance at 15% on earnings above the secondary threshold, plus a minimum pension contribution, so a hire costs more than its salary.
- **Cyber Essentials fee** — The NCSC states that Cyber Essentials certification is priced by organisation size, starting at £320 plus VAT, while Cyber Essentials Plus is quoted.
- **Breach prevalence** — DSIT's Cyber Security Breaches Survey 2025 found that 67% of UK medium businesses identified a cyber breach or attack in the previous 12 months.

The board has asked for a number. An audit finding, the operational resilience work or a new client's due diligence has landed on a budget that was already stretched, and every page you find on GRC cost prices software licences in US dollars. None of them tells you what it takes to run governance, risk and compliance at a UK firm of your size.

This guide is for ops directors, compliance leads and managing directors at UK regulated firms with 25 to 250 staff. It builds the annual cost of GRC line by line, splits one-off costs from run costs, and shows what moves each line, so the budget you take to the board holds up to its questions.

## How much does GRC cost for a UK firm of 25 to 250 people?

GRC cost for a firm of this size is the sum of six predictable lines: people, outside help, tooling, certification and audit fees, training, and staff time spent on evidence and questionnaires. Building the system costs more than running it. Scope, meaning how many frameworks and regulators you answer to, moves the total most.

That is why no honest page can give you one headline figure. A 40-person firm holding Cyber Essentials and a 200-person insurer answering to the FCA, three client audit regimes and ISO 27001 are buying different things, even if both call it GRC.

The useful question is not "what does GRC cost?" but "which lines do we carry, and what drives each one?" The rest of this guide answers that.

A GRC budget with one line in it is a software quote, not a budget.

## What are the cost lines in a GRC budget?

The cost lines in a GRC budget are people, outside help, tooling, certification and audit fees, training and awareness, and internal staff time. Each line behaves differently: some are one-off build costs, some recur every year, and one, staff time, rarely appears on any invoice. Budget each line separately so the board can see which costs fall away.

| Cost line | What it covers | One-off or annual | What drives it up or down |
| --- | --- | --- | --- |
| People | The salary and on-costs of whoever owns GRC, full-time or as part of another role | Annual | Seniority, location, and whether the role is full-time or shared |
| Outside help | Consultancy days for the build, and fractional roles such as a vCISO or vDPO | Mostly one-off for the build; annual for fractional roles | Scope, how much you build yourselves, and how long you need cover |
| Tooling | Policy, risk register and evidence platforms, or the spreadsheets they replace | Annual subscription, plus set-up | Number of systems connected, users and frameworks |
| Certification and audit fees | Certification bodies, CPA firms, Cyber Essentials assessment | Initial fee, then surveillance or renewal each year | Headcount in scope, number of certifications, report type |
| Training and awareness | Staff awareness training, role training for control owners, professional development for the GRC lead | Annual | Headcount and how often regulators or clients expect it |
| Staff time | Control owners running controls, gathering evidence, answering questionnaires and supporting audits | Annual, and heavier in the build year | How much evidence comes from systems rather than from people |

The first five lines arrive as salaries, quotes or invoices. The sixth arrives as hours lost from other work, which is why most budgets miss it.

## What does a GRC role cost in salary and on-costs?

A GRC role costs its salary plus employer on-costs. The UK government's 2025 cyber skills study puts the median advertised salary for a core cyber security job at £55,000 in 2024. Employer National Insurance and pension then add to that, so the true cost of one full-time hire is well above the advertised salary.

The [DSIT Cyber security skills in the UK labour market 2025](https://www.gov.uk/government/publications/cyber-security-skills-in-the-uk-labour-market-2025) report draws on job postings from January to December 2024. Its headline figures for core cyber roles:

- **Median advertised salary:** £55,000, against £48,900 for the wider IT labour market.
- **Mean advertised salary:** £58,800 across the UK, and £69,800 in London.
- **Experience:** 63% of postings asked for two to six years' experience.

Treat these as a reference point, not a price. They cover core cyber roles in general, not GRC roles alone, and many postings in 2024 carried no salary at all.

On-costs are the part budgets understate. As a starting assumption, replace with your own payroll data:

1. **Employer National Insurance** at 15% on earnings above £5,000 a year, the [HMRC rates for 2025 to 2026](https://www.gov.uk/guidance/rates-and-thresholds-for-employers-2025-to-2026).
2. **Employer pension** at the 3% legal minimum on qualifying earnings between £6,240 and £50,270, as set out on [GOV.UK's workplace pensions guidance](https://www.gov.uk/workplace-pensions/what-you-your-employer-and-the-government-pay). Many schemes pay more.
3. **Everything else:** recruitment, equipment, benefits and professional development, priced from your own records.

On those first two assumptions, a hire at the £55,000 median costs about £63,800 a year before the third line. At many firms of 25 to 250 people, though, GRC is not one hire. It is part of an operations or IT manager's job, and that share of their time is a cost too.

## How should you budget for outside help?

Budget for outside help as two separate lines: a one-off build, priced as a fixed number of consultancy days, and an ongoing fractional role, such as a vCISO or vDPO, priced as a monthly retainer. Ask for both as fixed-scope quotes, so you can compare like with like rather than day rate against day rate.

Firms of this size lean on outside help more than larger firms do. The [DSIT Cyber Security Breaches Survey 2025](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025) found that 43% of medium businesses, those with 50 to 249 staff, sought cyber security information or guidance from external consultants or providers. Among medium businesses that ran vulnerability audits, 38% used external contractors only.

The build line usually covers:

- **Gap analysis** against the frameworks you need to meet.
- **Policy set and risk method**, written to match how the business actually works.
- **Control design** for the gaps the analysis finds.
- **Internal audit** before the first external audit.

The retainer line covers the ongoing judgement: risk reviews, board reporting, regulator and client questions, and the next audit cycle.

Two questions keep this line honest. What will we own when the engagement ends? And which hours does this remove from our own team?

## What do certification and audit fees add to GRC cost?

Certification and audit fees add an initial fee for each certification or report, then a recurring fee to keep it. The size of each fee follows the headcount and scope you put in front of the assessor. The framework pages carry the detail; this line only needs one entry per certification you hold or plan.

For the certifications buyers ask for most, use the framework guides rather than a single figure here:

- **ISO 27001:** audit days come from your headcount in scope, then surveillance audits follow in the next two years. Our [ISO 27001 certification cost guide](https://www.grcmana.io/vault/iso-27001/certification-cost) breaks the fee down.
- **SOC 2:** the CPA firm's fee follows the trust services categories, systems and report type. Our [SOC 2 cost guide](https://www.grcmana.io/vault/soc-2/audit-cost) sets out the four SOC 2 cost lines.
- **Cyber Essentials:** the [NCSC states](https://www.ncsc.gov.uk/cyberessentials/overview) that certification is priced by organisation size, starting at £320 plus VAT. Cyber Essentials Plus, with independent technical testing, is quoted. Our [Cyber Essentials page](https://www.grcmana.io/vault/cyber-essentials) covers the scheme.

Budget the fee alongside the readiness work and staff time behind it. Those costs sit on the other lines, and they are the ones a quote never shows.

## Where does the hidden cost of staff time go?

The hidden cost of staff time goes on gathering evidence, answering client security questionnaires, preparing for audits and running controls on their stated cadence. It sits in the diaries of engineers, IT staff, finance and HR, not in the GRC budget. Price it by estimating the hours and multiplying by what those hours cost you.

Start with the activities, then put an owner and an hour estimate against each:

1. **Evidence gathering:** screenshots, exports and sign-offs collected for each audit or review.
2. **Questionnaires:** client due diligence and vendor reviews, often asking the same questions in new formats.
3. **Audit support:** walkthroughs, sample requests and follow-up questions.
4. **Control operation:** access reviews, supplier reviews, risk reviews and policy updates.

For a reference point, the [ONS Annual Survey of Hours and Earnings 2025](https://www.ons.gov.uk/employmentandlabourmarket/peopleinwork/earningsandworkinghours/bulletins/annualsurveyofhoursandearnings/2025) puts median hourly earnings for full-time employees at £19.67 in April 2025, excluding overtime. It is a national median across all jobs, so use it as a floor, not as the cost of your engineers.

The GRC line nobody invoices is the one nobody manages.

Engineering the evidence work is how this line comes down. Access logs, change records, backup results and configuration data already exist in your systems. Collecting them automatically and continuously, rather than by hand before each audit, removes most of the evidence-gathering hours. [NIST SP 800-137](https://www.grcmana.io/vault/nist-800-137) describes this approach as information security continuous monitoring. The same evidence then feeds the monitoring and measurement that [ISO 27001 clause 9.1](https://www.grcmana.io/vault/iso-27001/clause-9-1-monitoring-measurement-analysis-and-evaluation) already asks for.

## What drives total GRC cost up or down?

Total GRC cost is driven by four things: how many frameworks and regulators you answer to, how wide the scope is, how mature your existing practice is, and how much of your evidence comes from systems rather than people. The first two set the size of the work; the last two set how much is done by hand.

1. **Frameworks and regulators.** Each framework adds requirements, but most overlap. One set of controls, mapped once to ISO 27001, SOC 2, Cyber Essentials and your regulator's expectations, costs far less than four separate programmes.
2. **Scope.** Every legal entity, site, system and critical supplier inside the boundary adds work to every line.
3. **Existing maturity.** A firm that already runs access reviews, change control and tested backups mostly needs to evidence its controls. A firm without them has to build them first.
4. **Evidence automation.** Evidence pulled from systems costs set-up time once. Evidence gathered by hand costs the same hours every cycle.

Regulation can also widen scope on its own. The [FCA's operational resilience policy statement PS21/3](https://www.fca.org.uk/publications/policy-statements/ps21-3-building-operational-resilience) covers banks, building societies, insurers, payment and e-money institutions and enhanced scope SM&CR firms, among others. It required them to be able to remain within impact tolerances for each important business service by 31 March 2025. Work like this lands in the build year, and keeping it current lands in every year after.

## What does an illustrative GRC budget look like?

An illustrative GRC budget for a 120-person FCA-authorised firm outside London sets the six lines against a build year and a run year, with every assumption shown. The figures are illustrations, not benchmarks. Replace each assumption with your own payroll data, quotes and hour estimates before the budget goes to the board.

The firm in this illustration is in scope of the FCA's operational resilience rules, holds Cyber Essentials and is working towards ISO 27001. It hires one full-time GRC lead.

| Cost line | Build year | Run year | Assumption to replace |
| --- | --- | --- | --- |
| People | About £63,800 | About £63,800 | One hire at the DSIT median of £55,000, plus 15% employer National Insurance above £5,000 and the 3% minimum pension on qualifying earnings |
| Outside help | Build days at your quoted rate | Retainer at your quoted rate, or none | A fixed-scope quote for gap analysis, policy set, control design and internal audit; a retainer only if you keep fractional cover |
| Tooling | Set-up plus first-year subscription | Renewal | Quotes for the systems and frameworks in scope; zero if you stay on spreadsheets and accept the extra hours |
| Certification and audit fees | ISO 27001 Stage 1 and Stage 2, plus Cyber Essentials | ISO 27001 surveillance, plus Cyber Essentials | Audit days for your headcount from the ISO 27001 cost guide; Cyber Essentials at the tier for your size |
| Training and awareness | Awareness for all staff, role training for control owners | The same, refreshed | Your provider's quote, plus the hours staff spend in training |
| Staff time | 1,200 hours, at least £23,600 | 480 hours, at least £9,400 | Ten control owners at ten hours a month in the build year and four hours a month after, priced at the ONS median of £19.67 an hour as a floor |

Two lines are priced from public data, and four from your own quotes. That split is the point of the exercise: the board can see which numbers are researched, which are quoted and which are estimated.

The staff-time line also shows where automation pays. If automated evidence collection halves the run-year hours, the saving recurs every year, while the set-up cost is paid once.

## What does it cost not to do GRC?

The cost of not doing GRC shows up as breach costs, lost deals and regulatory findings. None of these arrives on a predictable invoice, which is why they are easy to discount. The government's 2025 breaches survey gives the clearest UK data on the first, and client requirements drive the second.

The DSIT Cyber Security Breaches Survey 2025 reports, for UK businesses:

- **Prevalence:** 67% of medium businesses identified a cyber breach or attack in the previous 12 months.
- **Cost:** among medium and large businesses whose most disruptive breach had an outcome and a reported cost above £0, the mean self-reported cost was £14,360 and the median £1,410, from a base of 69 businesses.
- **Staff time:** staff time was the exception where the median cost for medium and large businesses was not £0, which the survey reads as a sign that even incidents with no specified outcome still took staff time.

The survey notes these are self-reported estimates that may understate the full impact. Read them as a floor.

Lost deals are harder to count, but the same survey found that medium and larger businesses were particularly likely to say client requirements determined whether they sought accreditation. Regulatory findings carry their own cost: remediation work under a deadline, at whatever rate is available that month.

GRC bought after the finding costs more than GRC built before it.

## How can you reduce GRC cost without weakening it?

You reduce GRC cost by shrinking the hours, not the assurance. Build one control set and map it to every framework you need, collect evidence from systems instead of people, keep scope to what clients and regulators require, and buy outside help with a defined end point. Cutting the controls themselves is the saving that costs most later.

The savings that survive an audit:

1. **Map once, report many times.** Keep one control register, with each control mapped to every framework it answers. A new framework then becomes a mapping exercise, not a new programme.
2. **Automate the evidence you collect most often.** Start with the evidence every audit and questionnaire asks for: access reviews, change records and backups.
3. **Keep a questionnaire answer library.** Approved answers, linked to current evidence, turn repeat questionnaires into a review rather than a rewrite.
4. **Scope to the requirement.** Add a framework or a certification only when a client contract or a regulator needs it.
5. **Fix gaps before the auditor finds them.** A gap analysis costs less than a nonconformity.

We recommend reviewing the budget each year against the hours actually spent. The lines that fall are the proof that the system is working.

## Frequently asked questions

### How much does GRC cost a small firm?

There is no fixed price, because the cost follows scope rather than headcount alone. A firm answering to one framework and no regulator may need only part of one person's time, Cyber Essentials and some outside help. Each framework, regulator or client audit regime you add brings its own fees and hours.

### Is GRC software worth it?

GRC software is worth its subscription when it removes recurring hours, such as collecting evidence or answering repeat questionnaires. A platform that stores policies while staff still gather evidence by hand adds a cost without removing one. Compare the subscription with the staff hours it will remove each year, not with a spreadsheet.

### What is the cheapest way to start with GRC?

The cheapest credible start is a short gap analysis against the one framework your clients or regulator ask for, a risk register with named owners, and Cyber Essentials if you do not hold it. We recommend building the evidence habit from day one, because evidence collected as you go costs less than evidence rebuilt before an audit.

### Should GRC cost sit in the IT budget or the compliance budget?

GRC cost usually sits wherever its owner sits, which hides part of it. Tooling lands in IT, fees in compliance or finance, and staff time in every department. We recommend one GRC budget line owned by one person, even when the costs are spent across teams, so the board sees the whole number.