Menu
ISO 27001
Bottom line
ISO 27001 is a certification, not an attestation. An accredited certification body issues a three-year certificate with annual surveillance audits required to maintain it. Audit fees run $10K–$80K; all-in first-year program cost typically $50K–$220K.
One of 10 compliance framework explainers we maintain.
Key facts
- Controls
- 93 Annex A controls (ISO/IEC 27001:2022, down from 114 in the 2013 version)
- Recertification cycle
- 3-year certificate
- Ongoing oversight
- Annual surveillance audits in years 1 and 2
- Public registry
- IAF CertSearch ↗
- Common gap categories
- Risk assessment (clause 6.1); Access control (A.5 and A.8); Supplier relationships (A.5.19–A.5.22); Cryptography (A.8.24); Logging and monitoring (A.8.15–A.8.16)
- Related standards
- ISO 27002ISO 27017ISO 27018ISO 27701SOC 2
What is ISO 27001?
An international standard (ISO/IEC 27001:2022) published by ISO and IEC, scoped to an organization's Information Security Management System (ISMS). The 2022 version updated Annex A controls from 114 to 93.
Is ISO 27001 a certification or an attestation?
ISO 27001 is a certification. A physical certificate with three-year validity is issued by an accredited certification body (e.g., BSI, Bureau Veritas, Schellman, A-LIGN). Annual surveillance audits are required to maintain it.
Who needs ISO 27001?
Tech companies selling to European enterprise or government buyers, organizations subject to GDPR accountability expectations, or any vendor whose customers expect a recognized international ISMS standard rather than a US-specific framework.
What does ISO 27001 cost and how long does it take?
Range
$10K–$80K audit / 6–18 months
Certification body audit fees of $10K–$80K. All-in first-year cost (consultant, tooling, internal time) typically $50K–$220K for mid-market organizations.
One thing to watch
Audit body fees and total program cost diverge sharply. Quote both numbers when budgeting; one is the auditor invoice, the other is everything else.
Sources
Last verified 2026-05-13. Found a stale or wrong source? Email hello@soc2auditors.org.