Calculation framework
How CloudGovernanceCost.com Calculates Cost Ranges
Every figure on the site either comes from one of the public sources documented below or is our own model, labelled as such. This page walks through which source feeds which number, how the bands are derived, what is explicitly out of scope, and the refresh cadence. The goal is that any reader who disagrees with a figure can look at the same public source and form their own view.
Sources by category
The full source list. Each cost figure on the site is mapped to one of these sources via the calculation framework below.
| Category | Source | What we use it for |
|---|---|---|
| Tooling | Vendor pricing pages and AWS Marketplace listings (Wiz, Orca, Prisma Cloud, Vanta, Drata, Sonrai, Tenable) | These commercial vendors price by custom quote and do not publish full list prices. We mark them quote-only rather than publishing a derived figure. Where a vendor lists an entry SKU on AWS Marketplace (e.g. Vanta, Drata), we note that it exists without restating the number as the company's price. |
| Tooling | AWS, Azure, GCP public pricing pages and the Azure Retail Prices API | Native CSPM and security tool list prices (AWS Security Hub $3.75/resource-unit/mo Essentials as of the 2026 model change, Defender for Servers Plan 2 $0.02 per server-hour in East US, GCP SCC paid tiers quote-only). |
| Tooling | Flexera State of the Cloud Report 2026 | The 29% respondent-estimated wasted cloud spend used on the home and /roi pages. |
| Tooling | CloudQuery | Public pricing for cloud asset inventory and governance data. Reference point for the open-source vs commercial spectrum on the /build-vs-buy page. |
| Tooling | FinOps Foundation State of FinOps and Framework | Authoritative on how cloud cost governance interlocks with the broader FinOps lifecycle. Used on /governance-vs-finops to delineate the overlap. |
| Staffing | BLS Occupational Employment and Wage Statistics (OEWS) | Primary source for cloud security architect, cloud engineer, and compliance analyst wage data. Annual public release. |
| Staffing | Levels.fyi, Salary.com, Glassdoor, Indeed | Consumer salary aggregators. Cross-referenced against BLS OEWS to derive the bands on /staffing. We publish the range, not a point estimate, because each source measures something different. |
| Compliance | AICPA SOC 2 reference materials | Authoritative source for SOC 2 Type II control categories. The SOC 2 +40% multiplier on /compliance is our own model of the work those controls add. |
| Compliance | Certification-body audit-fee ranges (BSI, BV, Schellman and other accredited bodies) | These bodies quote audit fees per engagement rather than publish a public rate card, so we treat the audit component as an estimated range, not a cited list price. |
| Compliance | HHS HIPAA publications and PCI Security Standards Council documentation | Authoritative on the control requirements. The HIPAA +60% and PCI DSS +80% multipliers are our own model of the work those requirements add. HIPAA penalty amounts on /roi come from HHS's 2026 inflation adjustment (Federal Register, 28 Jan 2026). |
| ROI | IBM Cost of a Data Breach Report 2026 | Industry standard for the $4.99M average breach cost figure that powers the /roi page. Annual public release. |
Calculation framework
How public source data becomes the bands published on the site.
Tooling cost band derivation
Where a vendor publishes a list price (AWS Security Hub at $3.75 per resource-unit per month under its 2026 Essentials model, Defender for Servers Plan 2 at $0.02 per server-hour, AWS IAM Access Analyzer free, GCP SCC Standard free), we use the public figure directly. Where a vendor prices by custom quote and does not publish a list price (Wiz, Orca, Prisma Cloud, CrowdStrike, Sonrai, Tenable), we mark it quote-only rather than derive a number from reseller listings or aggregators; a guess at a vendor's undisclosed price is not something we can defend, so we do not print one. We deliberately exclude quoted enterprise discounts because they are not reproducible across readers.
The headline annual program cost ($40k-$400k+ on the home page) is our own planning model: tooling cost by company size plus governance staffing time. It is not a published benchmark.
Staffing cost band derivation
Base wage data comes from BLS OEWS for the closest matching occupation codes (typically Information Security Analysts, Software Developers, and Computer and Information Research Scientists). We apply a 1.3x loaded-cost multiplier on top of base salary to account for benefits, employer payroll taxes, equipment, and overhead. The 1.3x multiplier is our assumption; employers' real loading varies with their benefits and payroll-tax mix.
For roles where BLS does not cleanly map (cloud security architect, governance engineer), we publish a band reconciled from Levels.fyi, Salary.com, Glassdoor and Indeed. Each aggregator measures something slightly different (base vs total comp, self-reported vs employer-reported) so the band is wider than any single source.
Compliance multiplier derivation
The compliance multipliers on the /compliance page (SOC 2 +40%, ISO 27001 +50%, HIPAA +60%, PCI DSS +80%) are our own model: they compare a baseline cloud governance program against the added cost of running the same program plus the framework controls. They are estimates, labelled as such, not figures lifted from a single published schedule. Certification-body audit fees (BSI, BV, Schellman and other accredited bodies) are themselves quote-based and not published as public rate cards, so we treat the audit component as an estimated range, not a cited price. We use AICPA, HHS, and PCI SSC published control requirements for the control-implementation component. Compliance automation vendors (Vanta, Drata, OneTrust) price by quote, so the /tools page marks them quote-only. The multipliers assume governance baseline is in place; pursuing compliance from scratch is more expensive.
ROI calculation components
The /roi page treats governance ROI as the sum of three independent components: cloud waste recovery (Flexera's 2026 respondent estimate of 29% waste, with a stated 60% recovery assumption you can change in the calculator), breach risk reduction (the IBM Cost of a Data Breach 2026 global average of $4.99M times your own breach probability and reduction), and audit-preparation savings (your own engineer hours times their loaded rate; the calculator's $35k per framework is a stated default). The 200-600% three-year ROI band is the convolution of those three across the company-size tiers on the /staffing and home pages.
Refresh cadence
We re-check the figures in periodic reviews, and out of cycle when a source changes. The Updated YYYY-MM-DD line at the bottom of every page is the day that page's content last changed.
Mechanically, each page's Updated date and its Article JSON-LD dateModified are read from our version history when the site is built. Nobody types them by hand, so a date cannot run ahead of the page it describes.
Material rate changes trigger an out-of-cycle refresh: a cloud-provider pricing announcement, a public commercial vendor list-price change of more than 10 percent, a new annual BLS OEWS release, a new IBM CODB release, or a substantive FinOps Foundation publication.
Explicitly out of scope
We do not publish figures we cannot defend from public sources, even where the demand is high.
Quoted enterprise discounts
Negotiated discount levels are not publicly disclosed and vary by contract size, term, multi-product bundling, and reseller markup. Publishing a single figure would be misleading.
AWS Reserved Instance / Savings Plan specifics
RI and SP economics are heavily company-specific (workload pattern, reservation horizon, regional commitment). The /roi page does not model them.
Azure regional surcharges
Azure pricing varies by region, currency, and contract type in ways that defy a single number. We cite the East US list price as a reference point.
Cold-start premiums for vector DBs and SaaS tools
Where vendors charge a deployment / activation fee on top of monthly list, we exclude it because the figure is not consistently disclosed.
Single-vendor brand-comparison pages
We do not publish pages that purport to compare two named brands (Wiz vs Orca, Vanta vs Drata) in isolation. The /tools and /build-vs-buy pages treat each vendor as one entry in a category.
Personal salary disclosures
We use BLS OEWS aggregate ranges and consumer aggregator bands. We do not publish or solicit individual salary data points.
Limitations
Even with public sources and periodic review, the data has known limitations and we want to be explicit about them.
Cloud-provider list prices drift between our reviews. AWS, Azure, and GCP each issue smaller pricing changes weekly. If a figure on the site differs from what you see on a vendor pricing page today, the vendor page is the authoritative value and we will catch up on the next review.
The 29% cloud-waste figure (Flexera State of the Cloud 2026) is what survey respondents estimate they waste, not a measured audit. Individual organisations span a wide range. Governance recovers a portion of waste, not all of it; the /roi calculator applies a stated 60% recovery assumption to whatever waste rate you enter.
Compliance multipliers assume the baseline cloud governance program is in place. Pursuing compliance certification on top of a zero baseline (no CSPM, no policy enforcement, no identity governance) costs substantially more than the multiplier figures suggest because the framework controls also have to be implemented from scratch.
The /staffing salary bands are US-centric. Outside the US, BLS OEWS does not apply; the consumer aggregator bands span global self-reported data unevenly. For roles in EU, UK, India, or other geographies, treat the US bands as a starting point and apply regional adjustments.
Corrections
If a figure on the site looks wrong or a source we cite has moved, email [email protected] with the figure in dispute and the public source you would prefer we cite. Material errors get addressed within five business days; minor figure refreshes ride the regular monthly review cadence.
Editorial position is documented on /about.
Updated 2026-11-10