Sam For Compliance

What Sam For Compliance does

SAM for Compliance Limited is a privately held New Zealand-based software company that operates the SAM4C cloud-based compliance management platform. Founded in 2016 by Tony and Jackie Krzyzewski, the platform provides 30+ pre-built cybersecurity and information security frameworks including CIS Controls, NIST CSF, ISO 27001, ISO 27002, PCI DSS, NIST 800-171, CMMC, GDPR, and sector-specific frameworks such as HISO (healthcare), CPS 234 (Australian finance), AESCSF (energy), and TAPP (US government). The platform is delivered as multi-tenanted SaaS and supports self-assessment, evidence collection, and reporting workflows tailored to organisations that must demonstrate compliance with recognised standards.

The company serves customers across New Zealand, Australia, the United Kingdom, and the United States, with offices in each of those markets alongside its New Zealand headquarters. Verticals served include local government, healthcare, finance and insurance, energy, non-profit, and government agencies. A flagship distribution channel is the ALGIM Local Government Cybersecurity Programme launched in partnership with ALGIM, which the company reports has participation from approximately 60% of New Zealand councils. Additional ecosystem relationships include CIS (Controls Ambassador status and Supporter License), GMIS International (TAPP framework distribution), and the Global Cyber Alliance.

The business model is a self-serve SaaS subscription priced at $500-$5,000 per annum per framework, with additional enterprise and programme-level engagement available through partnerships. No external funding rounds are disclosed, and the company remains founder-led and privately held. Founder credentials include CIS Controls Ambassador status and ISO SC27 committee membership, and the company has been inducted into the ISANZ Hall of Fame.

Name

Sam For Compliance

Legal name

SAM for Compliance Limited

Website

https://samcompliance.co

Company type

Private

Founded year

2016

Operating status

Operating

Headcount range

1–10 employees

Short description

SAM for Compliance is a New Zealand-based SaaS provider of the SAM4C cloud platform, delivering 30+ pre-built cybersecurity and information security compliance frameworks to local government, healthcare, finance, and government agency customers across New Zealand, Australia, the UK, and the US.

Ownership category

akta.pro rank

Headquarters

HQ city

Hastings

HQ country

New Zealand

HQ region

Oceania

Offices4 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Operations, Marketing or Sales, Infrastructure

Revenue model

1. SaaS Platform Subscription: Annual subscription-based access to SAM for Compliance cloud platform with framework subscriptions ranging from $500 to $5,000 per annum. Customers can subscribe to multiple frameworks with potential discounts for additional frameworks or instances.

Pricing tiers

Go-to-market motion1 record

Distribution channels3 records

Marketing channels6 records

Core offering

SAM for Compliance (SAM4C) is a cloud-based Self Assessment and Management platform that allows organisations to self-assess their conformance to cybersecurity and information security standards, identify gaps, quantify risks, manage remediation actions, and report on compliance posture in real time. The platform is sold as annual framework subscriptions priced between $500 and $5,000 per annum, with 30+ pre-defined frameworks available for New Zealand, Australia, USA and UK markets including CIS Controls, NIST CSF, ISO/IEC 27001, PCI DSS, ACSC Essential Eight and SAM-branded frameworks tailored for local government, non-profits and small businesses.

Product overview

SAM for Compliance (SAM4C) is a cloud-based Self Assessment and Management platform that simplifies compliance management to standards. The platform offers a unified SaaS product with multiple compliance frameworks available as subscription options. Core offering includes the SAM4C platform with pre-built frameworks including CIS Controls (v7.1/v8), NIST CSF (1.1 and 2.0), ACSC Essential Eight, ISO/IEC 27001:2022, PCI DSS, and SAM-branded frameworks (SAM-Security, SAM-Local Government, SAM-Non Profit, SAM-Protect). Industry-specific frameworks cover government (NZISM, AGISM), financial services (CPS 234, RBNZ Guide), healthcare (HISO 10029, HIPAA), and energy (AESCSF, C2M2) sectors. The platform provides modules for risk assessment, enterprise multi-site management, and benchmarking. Subscriptions range from $500-$5,000 per annum with no user limits.

Differentiator

Problem solved

Functional benefit

Products and services

• SAM for Compliance (SAM4C) Cloud-based Self Assessment and Management platform providing real-time visibility into cybersecurity posture. Enables assessment against selected frameworks, gap identification, risk quantification, action and task management, executive and conformance reporting, and progress tracking. HTML5 compliant and mobile device friendly, with live dashboards, workplan-based assessment workflows, and the ability to subscribe to multiple compliance frameworks within a single platform.
• ALGIM Local Government Cybersecurity Programme Industry-level programme powered by SAM for Compliance for New Zealand and Australian Councils. Built on the SAM-Local Government framework, it provides benchmarking, peer comparison and awards for cybersecurity achievement, raising the bar on local government cybersecurity practice.
• GMIS Technology Assessment Preparation Program (TAPP)

Quantifiable outcome

• Almost 60% of New Zealand Councils participating in ALGIM programme since 2018

Named customers10 records

Segments7 records

Ideal customer profiles7 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature10 records

Partnerships

Four partnerships are on record, tiered core.

• ALGIM (Association of Local Government Information Managers)coreStrategic or Co-development Partner · 1 August 2018SAM for Compliance partnered with ALGIM to deliver the Local Government Cybersecurity Improvement Programme. SAM for Compliance Ltd provides the platform and management services while ALGIM owns and promotes the programme. ALGIM is a not-for-profit registered charity providing professional development and thought leadership in local government. SAM for Compliance administers the programme with ~60% of NZ councils participating.
• Center for Internet Security (CIS)coreStrategic or Co-development PartnerSAM for Compliance is a CIS supporter and CIS Controls Ambassador contributor. Tony Krzyzewski is a CIS Controls Ambassador and regular contributor to the ongoing development and refinement of CIS Controls. Jackie Krzyzewski is a CIS Controls Contributor. SAM for Compliance produces CIS Controls frameworks under license.
• Global Cyber Alliance (GCA)coreStrategic or Co-development PartnerSAM for Compliance is a Partner in the Global Cyber Alliance, supporting the Alliance's initiatives to help reduce the impact of cybercrime around the world. Tony Krzyzewski is a GCA Ambassador. GCA is an international, cross-sector nonprofit dedicated to confronting systemic cyber risks.
• GMIS InternationalcoreStrategic or Co-development PartnerGMIS International TAPP (Technology Assessment Planning Preparation) Framework is a joint development between GMIS International and SAM for Compliance to help USA State and Local Government organisations improve their IT operations and cybersecurity maturity. SAM for Compliance provides the platform for the GMIS Accreditation Program.

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Hyperproof: Hyperproof is a compliance operations platform that helps organizations manage controls across multiple frameworks including SOC 2, ISO 27001, NIST, and FedRAMP. It competes directly with SAM4C for buyers seeking multi-framework compliance management, with a focus on continuous compliance.
• Sprinto: Sprinto is a compliance automation platform focused on SOC 2, ISO 27001, HIPAA, and GDPR for fast-growing SaaS companies. It competes for the same SMB/mid-market segment as SAM4C, emphasizing continuous compliance monitoring and automated evidence collection.
• Thoropass (formerly Laika): Thoropass is a compliance and audit management platform combining compliance automation with expert services for SOC 2, ISO 27001, HIPAA, and PCI DSS. It is a direct competitor to SAM4C, particularly in the SMB and mid-market compliance segment.
• Drata: Drata is an automated compliance and security platform supporting SOC 2, ISO 27001, HIPAA, PCI DSS, and other frameworks with continuous monitoring. It competes directly with SAM4C for the same SMB and mid-market compliance buyer, differentiating through automation versus SAM4C's manual assessment approach.
• Vanta: Vanta is a leading automated security and compliance platform that helps businesses achieve and maintain compliance with frameworks like SOC 2, ISO 27001, HIPAA, and NIST CSF. It directly competes with SAM4C in offering subscription-based compliance management, though Vanta emphasizes automated evidence collection via integrations while SAM4C uses workplan-based assessments.
• Tugboat Logic (OneTrust): Tugboat Logic, now part of OneTrust, provides compliance automation and GRC software supporting SOC 2, ISO 27001, and HIPAA. It is a direct competitor serving the same target market as SAM4C with an automation-led approach.
• LogicGate Risk Cloud: LogicGate Risk Cloud is a no-code GRC platform for managing risk, compliance, and audit workflows across frameworks. It competes with SAM4C in offering subscription-based compliance management, though it targets larger, more customizable deployments.
• Secureframe: Secureframe offers automated compliance management for SOC 2, ISO 27001, HIPAA, PCI DSS, and NIST frameworks. As a direct competitor, it targets the same resource-constrained buyers SAM4C serves, particularly SaaS companies and SMBs, with a more automation-led approach.
• AuditBoard: AuditBoard is a cloud-based audit, risk, and compliance management platform serving enterprises with SOX, SOC, ISO, and other compliance programs. It is a direct competitor in the GRC space, though its focus skews toward larger enterprises than SAM4C's SMB/mid-market sweet spot.

Emerging players

• Scrut Automation: Scrut Automation is an emerging GRC platform focused on Indian and global SMB compliance with SOC 2, ISO 27001, and other frameworks. While focused on a different geographic market, it represents the broader trend of automated GRC platforms competing against legacy compliance management tools like SAM4C.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/sam-for-compliance

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Sam For Compliance