How Much Does ISO 27001 Certification Cost?

The first question a finance director asks about ISO 27001 is usually "how much will this cost us?", and the honest answer is that it depends. That answer is not much use when you are building a budget, so this article breaks the cost into the parts you can actually plan for, shows typical market ranges for each, and explains the decisions that push the total up or down.

One principle runs through all of it: the certification body's fee is the smallest and most predictable part of the bill. Most of the cost, and most of the opportunity to save, sits in how you prepare. If you want a figure for your own organisation rather than a range, our ISO 27001 consultancy team can scope it with you.

The Four Parts of ISO 27001 Cost

ISO 27001 cost confuses people because it arrives as several bills from several places, at different times. Separate them and the picture becomes much clearer.

Certification Body Fees

The certification body is the independent auditor that issues your certificate. In the UK that should be a body accredited by UKAS. Its fee is the easiest part to predict, because it is driven by a formula rather than by negotiation.

Certification bodies calculate the number of audit days using ISO/IEC 27006, the standard that governs how they work. The starting point is the number of people working within your ISMS scope, adjusted for complexity, the number of sites and the sensitivity of the information you handle. Your fee is then those audit days multiplied by the auditor's day rate.

Published market guidance puts accredited audit day rates at roughly £1,000 to £1,800 a day, and a small organisation typically needs around five days across Stage 1 and Stage 2. That is why the initial certification audit for a small business commonly lands in the region of £6,000 to £12,000, and rises with headcount and complexity.

Two tips. First, ask every certification body you approach to show the audit day calculation behind its quote, so you can compare like with like. Second, make sure the body is accredited. An unaccredited certificate is cheaper, but customers, insurers and procurement teams increasingly reject them, which makes it the most expensive certificate you can buy.

Preparation and Expert Support

Preparation is where budgets vary most. It covers everything that needs to happen before the auditor arrives: a gap analysis, defining scope, building the risk assessment, writing policies and the Statement of Applicability, running training, carrying out an internal audit and getting ready for Stage 1 and Stage 2.

You have three broad options:

• Do it yourself. The lowest cash cost, but the highest demand on internal time. It works best where someone already knows the standard well.
• Templates or compliance software. Useful structure and evidence tracking, but the documents still need adapting to how you work, and software does not run your risk assessment or face the auditor for you.
• Expert led. A consultancy runs the programme with you. Market guidance for UK implementation support ranges from a few thousand pounds for a small, well prepared organisation to £40,000 or more for larger, more complex scopes.

The right choice depends less on budget than on your starting point. Our clause by clause ISO 27001 requirements guide includes a readiness checklist that will tell you quickly how far you have to go.

The Hidden Cost: Your Team's Time

The largest cost in most ISO 27001 projects never appears on an invoice. Process owners have to describe how they work, leaders have to set objectives and attend management reviews, IT has to produce evidence, and everyone has to complete training. Several industry analyses put internal time at half or more of the true total cost.

This is also where expert help often pays for itself. An experienced consultant knows what the auditor will ask for, so your team spends its time producing the right evidence once rather than guessing, redrafting and repeating work after a failed Stage 1.

Tools and Remediation

Your gap analysis will almost certainly find controls that need improving. Common examples include multi factor authentication that does not cover every system, logging that is not reviewed, backups that have never been test restored, no formal vulnerability management or no evidence of security testing. Closing these gaps can mean new tooling, configuration work or services such as penetration testing.

Remediation is the hardest cost to predict before a gap analysis, which is exactly why a gap analysis should come first. It is also money that improves your actual security, not just your paperwork, so it is worth treating as an investment rather than a compliance overhead.

What Moves the Total Up or Down

Scope is the biggest lever. Certifying the services your customers actually care about, rather than the whole group, reduces audit days, documentation and remediation. The trade off is that the certificate must still cover what customers need, so agree it with them first.

Maturity is next. An organisation that already holds Cyber Essentials Plus, has managed IT with good controls and keeps decent records will spend far less than one starting from nothing.

Approach and timing matter too. Rushing to meet a contract deadline increases cost because work is done in parallel and corrected later. Our guide to how long ISO 27001 takes explains how to plan a realistic timeline.

Budgeting for the Three Year Cycle

An ISO 27001 certificate lasts three years. Year one carries the preparation and the initial audit. Years two and three each carry a surveillance audit and the ongoing effort of running the ISMS: risk reviews, internal audits, management reviews, training and evidence. Before the certificate expires there is a recertification audit.

Ongoing costs are where a virtual CISO or a retained ISMS manager can be cheaper than a full time hire, particularly for small and mid-sized organisations.

How to Reduce ISO 27001 Costs

• Start with a gap analysis. It turns an unknown remediation bill into a plan you can price.
• Scope deliberately. Cover what customers need, not everything you do.
• Reuse what you have. Cyber Essentials, existing policies and IT processes can all feed the ISMS.
• Keep documents short and true. Fewer documents that match reality are faster to write and easier to audit.
• Collect evidence from day one. Missing records are the most common reason for delays and repeat audit days.
• Get Stage 1 right. A failed or delayed Stage 1 adds audit days and pushes your certificate back.
• Combine standards. If you also need ISO 22301 or ISO 42001, an integrated programme shares processes and can share audit time.

Is ISO 27001 Worth the Cost?

For most organisations the return comes from three places. The first is revenue: ISO 27001 is often a requirement to bid, particularly for enterprise, financial services and public sector contracts, and it shortens security questionnaires dramatically. The second is risk: a working ISMS reduces the chance and the impact of incidents. The third is efficiency: one certified system answers many customer and regulatory demands at once.

The question we encourage clients to ask is not "what will certification cost?" but "what is it costing us not to have it?" One lost tender often answers that on its own.

How Cybergen Can Help

We give you a clear, fixed scope of work before you commit, so there are no surprises. Our ISO 27001 certification service covers the gap analysis, risk assessment, documentation, technical remediation, internal audit and support through Stage 1 and Stage 2, with CREST-certified specialists delivering the technical work in house. For organisations that need more than one standard, our ISO consultancy brings them together into one programme.

Want a figure for your organisation? Book a free ISO 27001 scoping call and we will tell you what it will take.

Market figures are indicative ranges drawn from published industry guidance in 2026 and vary by certification body, location and scope. They are not a quote.

Frequently Asked Questions