ZCybersecurity

Compliance › ISO 27001 › Certification cost

ISO 27001 certification cost

ISO 27001 certification cost: what drives the price, and how to compare quotes

Published ISO 27001 prices disagree by several times and almost none shows its basis, so this guide does not add another number. It shows the six parts of the bill, how audit time is set, what pushes cost up or down and how to compare quotes, with a calculator that works from your own quote.

Use the audit fee calculatorTell Us What You Need

Free for buyers · provider-funded introductions · Updated October 2026

ISO 27001 cost at a glance
Bill hasSix parts, not one number
Audit feesSet in auditor-days by the certification body
Biggest driverScope and the number of people in it
CycleInitial audit, two surveillance audits, recertification
Often missedYears 2 and 3, and your own staff time
Prices hereNone. We do not publish unsourced figures
The short answer

How much does ISO 27001 certification cost?

There is no single price. ISO 27001 cost is the sum of preparation, tools, testing and training, the certification body’s audits, the surveillance and recertification audits in years 2 and 3, and your own staff time. The certification body prices audits in auditor-days set mainly by how many people are in scope, so scope and headcount move the bill more than anything else.

  • Ask each provider for the number of audit days and the day rate, not just a total.
  • Surveillance and recertification are commonly priced as a fraction of the initial audit, so plan for the whole three-year cycle.
  • We give no price ranges here because the ones published online are unsourced and conflict. For regional context see our ISO 27001 cost in India guide.
The bill

The six parts of an ISO 27001 bill

Quotes cover different parts. Knowing the six lets you compare like with like.

The six parts of an ISO 27001 billThe six parts of an ISO 27001 bill. One, preparation: gap review, scope, risk work and policies, by a consultant or you, often in one quote. Two, tools: platform or software licence, optional. Three, testing and training: penetration test if asked and staff training, often priced separately. Four, certification audits: Stage 1 and Stage 2 priced in auditor-days, quoted by the certification body. Five, years 2 and 3: surveillance audits and recertification, easy to forget. Six, your own time: staff hours, fixes and re-tests, never quoted. Compare quotes by what they include, not by the headline number.Often in one quoteOften priced separatelyEasy to miss1PreparationGap review, scope,risk work, policiesConsultant or you2ToolsPlatform orsoftware licenceOptional3Testing, trainingPen test if asked,staff trainingOften separate4CertificationauditsStage 1 and 2,priced inauditor-daysBody quotes it5Years 2 and 3Surveillance auditsand recertificationEasy to forget6Your own timeStaff hours, fixesand re-testsNever quotedCompare quotes by what they include, not by the headline number.
The six parts of an ISO 27001 bill and which are usually quoted together. Colour shows how often each is missed from a quote.
Audit fees

How audit time, and so audit cost, is set

Certification bodies price audits in auditor-days. The days follow rules, so you can ask how yours were calculated.

Audit effort over one ISO 27001 cycleAudit effort across one three-year ISO 27001 cycle, with the initial certification audit as 1. Surveillance in year 1 is commonly about one third of the initial audit time, surveillance in year 2 about one third, and recertification in year 3 about two thirds. Over one cycle, audit effort adds up to about 2.3 times the initial audit. This is a rule of thumb; your certification body quote decides.Initial certificationStage 1 and Stage 21xSurveillance, year 1Annual checkabout 1/3Surveillance, year 2Annual checkabout 1/3Recertification, year 3Whole ISMS againabout 2/3Over one three-year cycle, audit effort adds up to about 2.3 times the initial audit.
Rule of thumb: surveillance is commonly about a third, and recertification about two thirds, of the initial audit time. Your certification body quote decides.
What decides the number of ISO 27001 audit days
FactorHow it moves audit days
People in scopeThe main input. ISO/IEC 27006-1:2024 introduces an effective number of personnel concept, so ask how contractors and part-timers are counted
Number of sitesIn multi-site setups total headcount drives the days, which are then spread across sites by relevance and risk
Complexity and riskA complex ISMS, many technologies or heavy outsourcing add time
MaturityA well-prepared ISMS tends to need less time than a rough one
Scope changesAdding people, functions, systems or sites after scoping can add days
FindingsMajor and minor nonconformities can add time and follow-up
Remote or on sitePart of an audit may be done remotely. Rules and pricing vary by certification body

Audit time is defined in ISO/IEC 27006-1:2024, which ISMS certification bodies were to apply to all clients by 31 March 2026, per the ANAB transition notice. The standard sets the method. Your certification body sets the day rate.

Calculator

Estimate three years of audit fees from your own quote

Enter the audit days and day rate from a certification body quote. Nothing is stored or sent.

Estimated audit days and fees over one ISO 27001 certificate cycle
AuditAuditor-daysFee
Initial certification--
Surveillance, year 1--
Surveillance, year 2--
Recertification, year 3--
Audit fees, one cycle--
With the extras you entered -

Surveillance at one third and recertification at two thirds of the initial days is a rule of thumb, not a guarantee. Some certification bodies price per audit rather than per day. Their quote overrides this estimate.

Cost drivers

What pushes ISO 27001 cost up or down

Eight levers. You control most of them before you ask for a quote.

Drivers of ISO 27001 certification cost
DriverPushes cost upPushes cost down
ScopeThe whole company, many products or legal entitiesOne product or service with clear boundaries
People in scopeLarge headcount and many contractorsA small, stable team
LocationsSeveral sitesOne site
Starting maturityNo policies, risk process or kept evidenceExisting controls, owned risks and evidence already kept
Who builds itOutside help for everythingAn internal owner with outside review
Certification bodyDifferent rates and rules for the same auditAn accredited body with transparent days and rates
FindingsMajor nonconformities that need follow-upClean audits
Tools and testingBuying tools or tests you do not needOnly what your risks and customers require

The cheapest lever is scope. A smaller, well-defined scope cuts headcount, sites and evidence at once, and you can widen it later. Check how your certification body handles scope extensions first.

Routes

Three ways to get there, and what each leaves with you

Same standard, same audit. The routes differ in who carries the work.

Routes to ISO 27001 certification compared
RouteFits whenYou pay forStays with you
Do it yourselfYou have strong in-house security and an owner with timeStandards, your own time and any toolsAll the design, evidence and upkeep
Consultant-ledLittle ISMS experience or a tight deadlineConsultant time plus the certification auditsRunning the ISMS afterwards and keeping evidence
Platform-assistedA mostly technical scope with repeatable evidenceA software licence plus the audits, often plus advicePolicies, risk judgement and the real controls

A platform does not issue the certificate and does not replace the accredited audit. A consultant should not also certify the ISMS they helped build. See the ISO 27001 consultants page.

Comparing quotes

Ten questions that make quotes comparable

Put these to every certification body and consultant, in writing.

Questions to ask when comparing ISO 27001 quotes
AskWhy it matters
How many audit days for Stage 1 and Stage 2, and how were they calculated?Days times rate is the fee, and the method comes from ISO/IEC 27006-1
How do you count people in scope, including contractors?Headcount is the main input
Is the price per day or fixed?Fixed prices may exclude extra time
What are the surveillance and recertification days?Years 2 and 3 are part of the cost
Is any of the audit done remotely?It can change travel costs and rates
What are the travel, certificate and admin fees?They are often outside the day rate
What if a major nonconformity needs a follow-up audit?Extra audit time may be extra cost
Are you accredited for ISO/IEC 27001, and by whom?Check it in the accreditation body directory, such as ANAB in the US
Does the same firm also consult on the ISMS?Impartiality: under accreditation rules a body should not certify what it helped build
What currency and tax apply?Cross-border quotes are hard to compare otherwise
Hidden costs

Costs that rarely appear in a quote

  • Standards purchase: ISO/IEC 27001 and 27002 are paid documents. Check the current price with ISO or your national standards body.
  • Impartial internal audit: if nobody in-house can audit objectively, you may need an outside auditor.
  • Staff time: the owner, engineers and leaders all spend hours on evidence and reviews.
  • Remediation: gaps found early can mean configuration changes, tooling or process rebuilds.
  • Follow-up audits: major findings can add audit time before the certificate is issued.
  • Years 2 and 3: surveillance and recertification arrive on a schedule and need budget and an owner.
Why prices disagree

Why published ISO 27001 prices conflict

We reviewed leading US guides. They give ranges for the same audit that differ by several times, and most cite no source.

  • Company size is rarely stated. A 10-person firm and a 500-person firm are priced as one.
  • Different things are bundled. Some figures include consultancy, others only the certification body.
  • Region and currency vary. A US figure does not transfer to India or the Gulf.
  • Many authors sell part of the bill. That is not wrong, but it shapes which figures get published.
  • No basis is shown. Few say how a range was built or when it was last checked.

That is why this guide shows the structure of the cost and a calculator that uses your own quote.

Region

Cost depends on where you buy, not just what you buy

The site covers several markets. The structure is the same, the rates are not.

FAQ

ISO 27001 certification cost: common questions

How much does ISO 27001 certification cost?
There is no single price. The cost is six parts: preparation, tools, testing and training, the certification body audits, surveillance and recertification in years 2 and 3, and your own time. Ask each provider for audit days and the day rate, then use the calculator on this page.
Why do ISO 27001 cost estimates differ so much?
Estimates often leave out company size, bundle different parts of the bill, mix currencies and regions, and show no basis. Many are also written by firms that sell part of the service.
What is the biggest ISO 27001 cost driver?
Scope, and the number of people in it. Headcount is the main input to audit time, and scope sets how much evidence you must build and maintain.
How are ISO 27001 audit fees calculated?
Certification bodies price audits in auditor-days. The days follow ISO/IEC 27006-1, which uses the number of people in scope and other factors such as sites and complexity. The fee is days times the body day rate, plus any extras it charges.
How much do surveillance audits and recertification cost?
Surveillance audits are commonly about one third of the initial audit time, and recertification about two thirds. This is a rule of thumb, so ask for the days and rates for all three years in your quote.
Do I need a consultant to get ISO 27001 certified?
No. The standard does not require one. A consultant can speed up design and preparation, but should not also certify the ISMS they helped build. See the consultants page.
Does compliance software reduce the cost?
It can reduce the effort of collecting evidence. It does not issue the certificate or replace the accredited audit, so ask exactly what a licence includes.
What are the hidden costs of ISO 27001?
Standards purchase, an impartial internal auditor if you have none, staff time, remediation work, follow-up audits after major findings and the surveillance and recertification audits in years 2 and 3.
Is the ISO 27001 standard free?
No. ISO/IEC 27001 and ISO/IEC 27002 are paid documents. Check the current price with ISO or your national standards body.
How long is the certificate valid, and what does it cost to keep?
Three years. Keeping it means annual surveillance audits, a recertification audit before expiry and the ongoing work of running the ISMS. See the certification process guide.
Is ISO 27001 cheaper than SOC 2?
There is no general rule. They are structured differently and priced by different parties. See our SOC 2 vs ISO 27001 comparison and the SOC 2 cost guide.
Can you give me a quote?
We do not quote prices. Tell us what you need and we match you with providers who send their own quotes.
Start here

Ready to compare real quotes? Tell us what you need.

Requirement→Scope→Price→Matched provider
Tell Us What You Need

Free for buyers · provider-funded introductions · Reviewed October 2026 by the ZCyberSecurity compliance team

Scroll to Top