ISO 27001 certification cost: what sets the price

ISO 27001 certification has no list price. The price is the sum of separate items: a gap analysis, building the information security management system (ISMS), tools, the certification body's Stage 1 and Stage 2 audit, two surveillance audits and a recertification audit in year three. Scope, sites, people, suppliers and starting maturity decide how large each item is.

Only one of those items follows a written method: the audit time of the certification body, which accredited bodies determine with documented procedures under ISO/IEC 17021-1. It is the item you can check line by line, and the one that tells you whether an offer is high, low or simply incomplete.

We give no prices here: the right figure depends on your scope, and an average tells you less than the structure of the quote.

What makes up the price of ISO 27001 certification?

The total is not one invoice. It is five items that are worth keeping apart, because mixing them up is the main reason quotes never seem to compare.

• Gap analysis. Where you stand against ISO/IEC 27001:2022 (with Amendment 1:2024), what is missing, which scope makes sense. A short phase, and the point where the cost of your case becomes clear.
• Implementation of the ISMS. Risk assessment, Statement of Applicability, policies, procedures, training and controls. The most variable item, because it depends on where you start.
• Tools. Platforms that collect evidence, track controls and monitor systems. This is where most of the time is saved.
• The certification audit. The fee of the accredited certification body that issues the certificate. Two stages, always separate from consultancy.
• Surveillance and recertification. A three-year cycle with an audit every year: a recurring cost that belongs in the budget from day one.

You can compress implementation and tools with the right choices. The audit much less: its duration follows a method.

What drives the cost (it is not only headcount)

Two organisations of the same size can spend very differently. These are the factors that move the figure.

• The breadth of the scope. This is the main lever. Certifying the product and the systems that handle customer data costs far less than certifying the whole organisation.
• Sites and locations. ISO/IEC 17021-1 lists the size and number of sites, their geographical locations and multi-site arrangements among the factors for audit time. Each extra site is also more to document and keep under control.
• Suppliers and outsourcing. Outsourced activities that fall within the scope are another audit-time factor in the same standard, and every critical supplier has to be assessed. If your supplier list is long, our guide to third-party risk management shows where that work sits.
• Starting maturity. Written policies, an existing risk assessment and monitoring in place shorten implementation.
• Technology and regulation. The technological and regulatory context is another audit-time factor: a complex stack or a regulated sector gives the auditors more to cover.
• How evidence is collected. By hand or from the systems: the difference shows in year one and at every surveillance audit.

A mid-market company that certifies one business line can spend less than a smaller one that certifies everything. That is why a serious estimate starts from your case, not from a table.

How audit days are set

This is the only item that can be checked objectively. Audit time is not a commercial choice of the certification body. ISO/IEC 17021-1:2015, the standard certification bodies are accredited against, requires documented procedures for determining audit time, and requires the duration and its justification to be recorded (clauses 9.1.4.1 and 9.1.4.3).

The aspects the body considers (clause 9.1.4.2) include complexity, technological and regulatory context, outsourcing, prior audit results, sites and their locations, and the risks of your activities. Where a scheme has its own criteria, the same clause names ISO/IEC 27006 as an example and says those criteria apply. For information security that standard is now ISO/IEC 27006-1:2024, which sets requirements for bodies certifying an ISMS on top of ISO/IEC 17021-1.

Three practical consequences when you have an offer in front of you:

• Ask for the quote in audit days, not as a lump sum. Days for Stage 1, days for Stage 2, and on what basis. The body records that justification anyway, and it makes two offers comparable.
• An offer far below the others usually has fewer days. Not necessarily wrong, since two bodies can read the same scope differently, but it is the first question to ask.
• Travel is not audit time. ISO/IEC 17021-1 excludes time spent travelling to and from audited sites from the audit days (note 1 to clause 9.1.4.2). Check how travel and expenses are billed.

It is also worth checking that the body is accredited, and accredited for ISO/IEC 27001 specifically. In the EU, Regulation (EC) No 765/2008 gives each Member State a single national accreditation body; the useful check is that this body signs the European (EA) or international (Global ACI) recognition arrangements for management system certification. The full procedure is in our guide to choosing an ISO 27001 certification body. An unaccredited certificate may cost less, and it also carries less weight with a customer or a tender that checks it.

One last constraint shapes the budget. ISO/IEC 17021-1 bars a certification body, any part of the same legal entity and any entity under its control from offering or providing management system consultancy (clause 5.2.5). It also bars the body from suggesting that certification would be simpler, faster or cheaper with a particular consultant (clause 5.2.9). Preparation and certification are two separate invoices, always: it is a condition of accreditation, not a commercial habit.

How long does ISO 27001 certification take?

The path runs in four phases, each as long as your readiness allows.

1. Gap analysis. Where you stand, what is missing, which scope to propose.
2. Implementing the ISMS. The long part: policies, risk assessment, controls, training and the first evidence. Its length depends on your starting point.
3. Stage 1. The certification body reviews your documented information, discusses readiness with your people and agrees the details of Stage 2 (ISO/IEC 17021-1, clause 9.3.1.2.2). Concerns raised here can postpone Stage 2.
4. Stage 2. At your sites, the body evaluates whether the system is implemented and effective, including internal auditing and management review (clause 9.3.1.3). If it goes well, the certificate follows.

Since Stage 2 audits internal auditing and management review, both need to have actually taken place before it: plan at least one round of each into the timeline. What sets the overall duration is measurable before you start: the breadth of the scope, how much is already in place, how long new controls need to produce evidence and the certification body's calendar.

The standard does fix one time limit that affects the cost. If the body cannot verify the corrections and corrective actions for a major nonconformity within six months of the last day of Stage 2, it conducts another Stage 2 before recommending certification (clause 9.5.3.2). A rushed Stage 2 can end up costing a second one.

The real figure is the three-year cycle

The first year is the one people look at; the three-year cycle is the one you pay for. Under ISO/IEC 17021-1, the audit programme for initial certification includes the two-stage initial audit, surveillance audits in the first and second years after the certification decision, and a recertification audit in the third year before the certificate expires (clause 9.1.3.2). The first surveillance audit comes no more than twelve months after the certification decision (clause 9.1.3.3).

Surveillance audits need not be full system audits, but each one covers internal audits and management review, actions on previous nonconformities and changes (clause 9.6.2.2). At recertification, a major nonconformity has to be corrected and verified before expiry, otherwise the certification is not extended (clauses 9.6.3.2.2 and 9.6.3.2.4).

Next to the body's fee sits the work ISO/IEC 27001 asks of you every year, which never arrives as an invoice: internal audit (clause 9.2), management review (clause 9.3) and updates to the risk assessment (clause 8.2) and the Statement of Applicability when systems, suppliers or the organisation change. If that work is not budgeted, year two becomes a scramble and year three a risk.

To compare two offers, always ask for the cost of the full three-year cycle, surveillance and recertification included, not only the first audit.

The costs that rarely appear on the quote

When an offer looks too good, the difference is usually in one of these items, which simply sit outside the total.

• Travel and auditor expenses. Often quoted separately, and significant if your sites are far apart.
• Follow-up on nonconformities. To verify corrections, the body can ask for documented evidence, a limited additional audit or a full additional audit (clause 9.4.10). The last two are extra days.
• The text of the standard. ISO/IEC 27001 is a paid publication, sold by ISO and by national standards bodies. A small item, but one to plan for every copy the team needs.
• Your people's time. Often the largest item, and the only one with no invoice: policies, evidence and auditor questions take time from usual work.
• Manual evidence collection. Chasing screenshots, logs and exports by hand comes back at every surveillance audit.
• Extending the scope later. Starting narrow is the right call, but adding a site, a product or a group company later means a review and further audit activity by the body (clause 9.6.4.1). Better to know it now and put it in the plan.

How to reduce time and cost

Two levers act on time and cost together. The first is a narrow scope at the start: begin with the core (the product, the systems that handle customer data), get certified sooner, and extend once the system runs smoothly.

The second is letting systems produce the evidence, not people. A compliance platform connects to your systems, checks controls continuously and keeps evidence ready for the audit; we use Vanta. It does not issue the certificate or decide scope and risks, but it takes the repetitive work out of every surveillance year.

If you also sell in the US and are weighing SOC 2, look at the two together: the controls overlap a great deal, and building them in parallel reuses much of the work. The same goes for an organisation in scope of the NIS2 Directive: an ISMS covers much of the work on risk, incidents, continuity and suppliers, although the directive does not name ISO 27001 as proof of compliance and has obligations of its own.

Five questions to ask before signing

1. How many audit days are planned for Stage 1 and Stage 2, and what is the recorded justification?
2. Is the body accredited for ISO/IEC 27001, by which national accreditation body, and does that body sign the EA or Global ACI arrangements for management system certification?
3. Are travel, certificate issue and follow-up days included, or quoted separately?
4. What is the cost of the three-year cycle, surveillance and recertification included?
5. What stays with us: who writes the policies, who collects evidence, who runs the internal audit and the management review?

If a provider answers all five plainly, the quote is comparable. If not, the figure at the bottom of the page means little.

In short: the ISO 27001 certification price depends on how wide the scope is and how much work is left to do. For a figure on your own scope, our team prepares an estimate after the gap analysis that keeps our support separate from the certification body's fee: start from our ISO 27001 consulting and certification page.