Menu
01Define the ISMS boundary
State the legal entities, products, sites, people, technology, and exclusions inside scope. Headcount alone does not describe audit effort; complexity and the number of locations also change audit days.
ISO 27001 certification cost: price the full three-year lifecycle.
There is no honest single average. Price six lines separately: implementation, Stage 1 and Stage 2, tooling, internal labor, surveillance, and recertification. Certification bodies scope the audit from duration and day rates; consultant and tooling examples are separate purchases.
Initial certification audit
Scope-priced quoteStage 1 + Stage 2
SME implementation example
£8,500–£11,500starting fees
Tooling example
€99–€799monthly, billed yearly
What belongs in an ISO 27001 certification budget?
Your budget needs six distinct classes: implementation advice, the initial Stage 1 and Stage 2 audit, tooling, internal labor, surveillance in each following year, and recertification. Add optional remediation and training only when the scoped gap analysis identifies them.
| Lifecycle line | Published example or method | Scope and limitation |
|---|---|---|
| Stage 1 + Stage 2 | Scope-priced quote | Audit duration and day rates vary with the certified scope. Source, verified 2026-08-05. |
| Implementation advice | £8,500–£11,500 | Published starting fees for guided through full SME support (10–49 employees). Source, verified 2026-08-05. |
| ISMS tooling | €99–€799 / month | One software vendor’s published company-size bands, billed annually. Source, verified 2026-08-05. |
| Internal labor | Model from internal hours | Program hours × each contributor’s loaded hourly cost. Source, verified 2026-08-05. |
| Surveillance audit — each year | Scope-priced quote | Separate quote lines for surveillance in years 1 and 2. Source, verified 2026-08-05. |
| Year-3 recertification | Scope-priced quote | A separate recertification line in the certification-body quote. Source, verified 2026-08-05. |
Quoted fees remain in their source currency. We do not convert or add them because exchange rates, organization sizes, tax treatment, inclusions, and billing periods differ.
How to model the cost without inventing an average
Build three scenarios from your own scope: internal-led, consultant-assisted, and managed. In each, use the same certification-body quote and change only who performs implementation, evidence, internal audit, and ongoing maintenance.
- Internal-led: certification-body fees + tooling selected by the team + role-specific internal hours + external work that cannot be performed independently in-house.
- Consultant-assisted: the same audit quote + a named implementation deliverable + internal owner time + tooling + surveillance preparation.
- Managed: the same audit quote + ongoing advisory or managed-ISMS scope + retained internal decision time + tooling only if it is not already included.
For internal labor, use the ledger method: hours for each contributor multiplied by that contributor’s loaded hourly cost. A blank labor line is unknown, not zero.
What should you ask the certification body to quote?
Request a three-year schedule, not only a first-year total. The schedule should identify the audit days and day rate for Stage 1, Stage 2, both surveillance audits, and recertification, plus application, certificate, travel, and follow-up charges.
NQA says certification quotes are based on audit duration and day rates and should separate Stage 1, Stage 2, annual surveillance in years 1 and 2, and recertification in year 3. No universal fee is published.
Source ledger and limitations
These records are price anchors and quote methods, not a blended market benchmark. Provider-published figures show what that provider advertised for a defined scope on the verification date. Certification-body accreditation and quote inclusions still need direct confirmation.
- Stage 1 and Stage 2 certification audit
- Accredited certification-body quote covering the initial two-stage audit. NQA says certification quotes are based on audit duration and day rates and should separate Stage 1, Stage 2, annual surveillance in years 1 and 2, and recertification in year 3. No universal fee is published. NQA: costs of third-party certification · verified 2026-08-05.
- Micro-business implementation support
- £5,500–£7,500 · engagement. ISO/IEC 27001 guided through full support for 1-9 employees. Advertised starting fees excluding VAT. The guide says final price depends on scope, sites, employee count, operational complexity, documentation, sector risk, and delivery method. Certification-body audit fees are separate. ParagonQMS pricing guide v2026.07.05 · verified 2026-08-05.
- SME implementation support
- £8,500–£11,500 · engagement. ISO/IEC 27001 guided through full support for 10-49 employees. Advertised starting fees excluding VAT. This is a vendor quote anchor, not a typical-market range or all-in certification price. Certification-body audit fees are separate. ParagonQMS pricing guide v2026.07.05 · verified 2026-08-05.
- ISO 27001 ISMS software
- €99–€799 · month-billed-annually. Published platform bands for organizations up to 250 employees. Prices exclude VAT and do not include the independent certification audit. The source publishes company-size bands; the page preserves the monthly basis rather than converting currencies or presenting a market average. isopilot pricing · verified 2026-08-05.
- Internal labor
- Time spent by the program owner, control owners, engineering, leadership, and internal audit participants. Estimate as role-specific hours multiplied by each role's loaded hourly cost. Keep this outside vendor totals so internal effort cannot disappear into a false zero. SOC 2 Auditors budgeting method · verified 2026-08-05.
- Annual surveillance audits
- Separate certification-body quote lines for surveillance in years 1 and 2. NQA identifies annual surveillance in years 1 and 2 as separate certification costs. Obtain both lines in the certification-body quote and confirm audit days, day rates, travel, administration, and nonconformity follow-up charges. NQA: costs of third-party certification · verified 2026-08-05.
- Year-3 recertification audit
- Recertification at the end of the three-year certificate cycle. NQA says the certification-body quote should include recertification in year 3. Do not estimate it as zero or assume it equals surveillance; request the line item when comparing three-year proposals. NQA: costs of third-party certification · verified 2026-08-05.
Scope before price
Why two ISO 27001 quotes can describe different purchases
A low number can be a software subscription, a consultant’s readiness work, or only the certification-body audit. It is useful only when the scope and renewal obligations travel with it.
Do not add the examples on this page into one total: they use different scopes, company sizes, billing bases, and currencies.
| Factor | What it pays for | What it does not prove |
|---|---|---|
| Consultant | ISMS scope, risk process, Statement of Applicability, policies, implementation support, and audit preparation | Authority to issue the certificate |
| Certification body | Independent Stage 1 and Stage 2 audits, certification decision, surveillance, and recertification | That implementation consulting or tooling is included |
| ISMS platform | Workflow, documents, evidence, risk and control records, depending on the product | That the ISMS works or that an accredited body will certify it |
| Internal team | Decisions, control operation, evidence, remediation, interviews, and management review | A vendor invoice — the cost must be modeled from time |
Quote method
Turn the lifecycle into a comparable three-year quote
The cleanest comparison is one scope sheet sent to consultants and certification bodies, with recurring work visible before you choose either provider.
02Separate builder from certifier
Request implementation or readiness support from a consultant and the certification audit from an accredited certification body. Keep both statements of work visible so no one sells preparation as the certificate.
03Ask for every certification-cycle line
Require Stage 1, Stage 2, application and certificate fees, travel, each surveillance audit, and recertification. Record audit days and day rates, not only the final total.
04Add costs no provider owns
Model internal labor by role and hours. Add tooling, remediation, technical controls, training, and outsourced internal audit only when your scope requires them.
FAQ
ISO 27001 certification cost questions
The distinctions that keep an audit quote from being mistaken for an all-in program budget.
How much does ISO 27001 certification cost?
⌄
There is no defensible universal total. Certification bodies scope Stage 1, Stage 2, surveillance, and recertification from audit duration and day rates. Separate published implementation examples run £5,500–£7,500 for 1–9 employees and £8,500–£11,500 for 10–49. Internal labor and tooling sit outside those examples.
What is included in an ISO 27001 certification-body quote?
⌄
Ask for separate lines for Stage 1, Stage 2, certificate or application charges, travel, annual surveillance in years one and two, and year-three recertification. Confirm audit days, day rates, scope, sites, headcount, and charges for closing nonconformities.
Are consultant fees included in the certification audit price?
⌄
Usually not. The consultant builds and prepares the ISMS; an independent accredited certification body audits it and issues the certificate. Compare the two contracts separately so a low implementation quote cannot hide certification-body fees or recurring surveillance work.
How should we budget internal labor?
⌄
List each contributor, estimate the hours required for scoping, risk work, policy decisions, control operation, evidence, internal audit, management review, and auditor interviews, then multiply each role’s hours by its loaded hourly cost. Keep this line outside vendor totals.
Does ISO 27001 software include the certification audit?
⌄
Not in the software example tracked here. Its published price is €99–€799 per month, billed annually, and the vendor says the independent certification audit is paid separately. Check every platform proposal for the same exclusion before comparing totals.
What costs continue after the certificate is issued?
⌄
The ISMS continues to operate. Budget annual certification-body surveillance, internal audit, risk and management reviews, corrective actions, tooling or document maintenance, control-owner time, and a separate recertification audit before the three-year certificate cycle ends.
Next comparison
Related tools and directories
Tell us your scope
Get certification quotes on one scope
Send your ISMS boundary, employee count, sites, current maturity, and target date. We manually review the request before routing it to relevant ISO 27001 providers.
Free and anonymous. We’ll follow up by email.