What does ISO 27001 certification cost? The cost blocks explained
The managing director asks a simple question: what will ISO 27001 cost us? The honest answer is a range, and most of it does not appear on the certification body’s quote. The audit fee is the part you can compare easily. The larger part is the time your own people spend building and running the ISMS.
This guide breaks the cost into blocks, explains what drives each one and shows how to plan a budget that holds through the whole three-year certificate cycle.
Key takeaways
- Four cost blocks: the certification body, your own team’s time, optional outside help and optional software.
- The audit fee follows audit days. Certification bodies calculate them under ISO/IEC 27006-1, mainly from the number of people in scope.
- The certificate runs for three years, with a surveillance audit in years two and three and a recertification audit after that.
- Internal effort is usually the largest block. It depends on how much already exists when you start.
- Scope is the biggest lever. A clear scope around the product your customers buy keeps every block smaller.
1. The certification body
An accredited certification body audits your ISMS in two stages. Stage 1 reviews your documentation and readiness. Stage 2 tests whether the system works in practice. The fee is mostly a function of audit days.
Certification bodies do not pick audit days freely. ISO/IEC 27006-1:2024 sets out how they calculate audit time, starting from the number of people doing work under your control within the scope, including contractors in scope. People performing identical activities can be counted with a reduced effective number. From that starting point, the body can add or subtract time for factors such as the complexity of your IT, the number of sites or how much of the work is outsourced. For an organisation with 150 people in scope, the standard’s table gives 13 audit days for the initial certification audit before such adjustments.
After certification, the cycle continues. Surveillance audits in years two and three typically take about a third of the initial audit time, and the recertification audit about two thirds. Budget for all three years, not only the first audit. Add travel costs if the audit is on site and ask whether the quote includes the certificate itself.
Quotes from different certification bodies are only comparable if they assume the same headcount and scope. If one quote is much lower, check the number of audit days behind it.
2. Your team’s time
This block rarely appears in a budget line, but it is usually the largest. Someone has to own the ISMS, and several people contribute:
- The ISMS owner defines scope, runs the risk assessment, writes or reviews policies, prepares the Statement of Applicability and coordinates the audit.
- IT and engineering implement and evidence controls: access reviews, backups and restore tests, logging, vulnerability management, secure development.
- Management approves policies, sets objectives, attends the management review and is available to the auditor.
- Every employee completes security awareness training.
How much time this takes depends on your starting point. A company with documented processes and modern tooling has much of the evidence already. A company that starts from scratch has to build the processes first.
3. Closing gaps
The risk assessment and the gap analysis usually reveal measures you do not have yet. Typical examples are multi-factor authentication everywhere, a tested restore of backups, central logging, an asset inventory, a supplier review process or a penetration test where your risk assessment calls for one. Some of these cost licences, others mainly time. Plan a buffer for them, because they only become visible once the analysis is done.
4. Outside help
Many companies bring in a consultant for the first certification. Consultants typically charge by day or by project. They can save time on structure and audit experience, but the work inside your systems still has to be done by your team. If you hire one, agree in advance which documents and decisions remain yours, because the auditor will talk to your people, not to the consultant.
5. Software
ISMS software replaces spreadsheets and document folders: risk register, Statement of Applicability, policies, controls, evidence and tasks in one place. It is optional, and its value grows with the number of frameworks and the frequency of evidence.
The recurring costs
ISO 27001 is not a one-off project. Each year you run an internal audit and a management review, update the risk assessment, collect evidence and prepare for the surveillance audit. Plan this as a running cost from the start. Teams that treat the first audit as the finish line usually pay for it in the first surveillance audit.
How to keep the cost down
- Scope deliberately. Start with the product and the teams your customers care about. You can extend the scope later.
- Reuse what exists. Many controls already run in your tech stack. Document and evidence them instead of building parallel processes.
- Collect evidence continuously. Evidence gathered during the year is cheaper than evidence reconstructed in the weeks before the audit.
- Ask for comparable quotes. Give every certification body the same headcount and scope.
- Plan for the full cycle. Include the two surveillance audits and the recertification in your budget.
If you are preparing your first certification, our guide on the Statement of Applicability covers the document auditors read first, and our page on ISO 27001 certification shows how GetTeddy’s AI agents support each step.
