The five parts of ISO 27001 cost
| Cost | What drives it |
|---|---|
| Implementation support | Scope, number of systems and how much of the work you want done for you |
| Internal audit | Required before certification. Size of the ISMS and number of controls in scope |
| Certification body audit | Headcount, sites and complexity, which set the number of audit days. Paid directly to the accredited body |
| Compliance platform | Optional. Tools like Vanta or Drata automate evidence collection and monitoring |
| Your team's time | Usually the hidden cost. Good support keeps it to a couple of hours a week |
Why consulting quotes vary so much
Most ISO 27001 consulting is quoted per day or per hour, so the final cost depends on how long the project runs. Scope creep, slow evidence collection and rework after a failed audit all add days. Ask any consultant for a clear written scope, deliverables and timeline before you start, so you can compare like with like.
What drives the certification audit fee?
Certification bodies calculate audit days mainly from the number of people in scope, the number of sites and the complexity of your systems. A tightly defined scope keeps the audit shorter, and it's one of the first things we work on.
Ongoing costs
Certification lasts three years, with surveillance audits in years one and two and recertification in year three. Budget for the annual surveillance audit, an annual internal audit and the time to keep controls running. A managed compliance retainer can cover this end to end.
How we make your budget go further
- Right-size the scope. Certify what your tender or customer actually needs, not the whole business by default.
- Only the tools you need. We'll tell you honestly whether a compliance platform pays for itself in your case, and which one fits your budget.
- Build once, reuse. Controls built for ISO 27001 carry over to SOC 2, ISO 42001 and Essential Eight, so the next framework costs far less.
- Protect your team's time. We do the heavy lifting so your people stay on their day jobs.
- Plan the whole cycle. We budget for surveillance and recertification up front, so there are no surprises in years two and three.
Get a proposal for your scope
In a free 30-minute consultation we'll work out your scope with you, then send a written proposal with deliverables and a timeline. Book a time or see our services.