Stage
Mid-market compliance, more standards with one team
Bigger customers ask for more than one standard, and each addition feels like a new project. In Tidal you set up one set of controls that serves ISO 27001, SOC 2, the GDPR and NIS2 at the same time, with evidence that keeps itself current.
The plan that fits this stage
Professional covers two frameworks, Scale an unlimited number. Choose by how many standards your customers ask for.
Professional
Prove security to enterprise customers with ISO 27001 or SOC 2
€499/monthBilled annually
- 2 frameworks (1x Pro, 1x Essential)
- All 30+ policy documents
- 350+ automated IT tests
- 1:1 Onboarding
- Consultancy discount included
Scale
Unlimited frameworks and advanced controls for growing organisations
€1,699/monthBilled annually
- Unlimited frameworks
- Advanced user permissions
- PowerBI reporting
- Personal account manager
- Single Sign-on
These companies run their compliance on Tidal Control
Why Tidal fits this stage
The problem is no longer the first standard. It is the second and the third, without your team growing to match.
One control, several standards
ISO 27001, SOC 2, the GDPR and NIS2 overlap to a large degree. You set the control up once and see per standard what is already covered, so another certificate is an extension, not a second project.
Monitoring that holds between audits
More than 200 automated tests pull evidence from Azure, AWS, GitHub and your identity provider. Encryption, MFA, access rights and patch status stay current by themselves, instead of being reconstructed in the weeks before an audit.
Suppliers and people are part of it
At this size your risk sits with a supplier or in onboarding as often as it sits in your technology. Supplier assessments and personnel controls live in the same system as everything else, with the same evidence trail.
Customer questions without your engineers
Security questions multiply as your customers get bigger. Your trust center shares policies, controls and certificates with prospects, so sales keeps moving without blocking engineering.
What mid-market organisations usually combine
Often two at once, depending on the market you sell into.
- ISO 27001
- The international standard European customers and tenders ask for
- More about ISO 27001
- SOC 2
- What American customers ask for, usually alongside ISO 27001
- More about SOC 2
- NIS2
- If you supply critical sectors, the duty of care carries into your contract
- More about NIS2
- All frameworks
- See which standards Tidal supports
- View all frameworks
Frequently asked questions
Less than the first time. The Annex A controls and the Trust Services Criteria overlap to a large degree; in Tidal you see per control which evidence counts for both. What is left is the difference, plus the observation period SOC 2 Type II requires.
Usually not at this stage. What you do need is an owner per control and someone keeping the overview, often a security or operations role taking it on. The automation removes the recurring evidence work, which is where most of the time went.
Changes land in the platform and you see which controls are affected. You revise what changed rather than walking through your whole management system again.
Yes. Controls, tasks and evidence have an owner, so IT, HR and operations can work alongside each other without overwriting each other's work. If you need stricter separation, the authorisation model is the next step.