ISO 27001 cost has no reliable universal dollar figure. A certification body quotes for an information security management system, or ISMS, with a defined scope, people, sites and complexity. Your own preparation, remediation and ongoing operation sit outside that quote. If a buyer wants a budget, build those lines separately before asking for prices. A low first-audit fee can be expensive across the full certification cycle.
For a US software company, the useful question is not “What does a certificate cost?” It is “What work must our team perform, what will an independent body audit, and what recurs after the first decision?” ISO publishes ISO/IEC 27001:2022 as the requirements for an ISMS, while external certification bodies perform certification. Neither a software subscription nor a consultant can issue the certificate.
| Budget line | Who does the work | What to request |
|---|---|---|
| ISMS scope and gap review | Your team, with optional adviser | A written boundary, owners and list of missing work |
| Control operation and evidence | Your team | Time for risk treatment, approvals, reviews and records |
| Independent internal audit | Competent internal or external auditor | Scope, independence, days and written findings |
| Certification audit | Independent certification body | Separate Stage 1 and Stage 2 effort and expenses |
| Surveillance and renewal | Certification body and your team | Visits and fees across the entire cycle |
| Software and other services | Your chosen vendors | Subscription, setup, usage and exit terms |
A purchase order for Stage 1 and Stage 2 is only one part of the ISMS budget.
Why ISO 27001 cost varies so much
Two similar-sized companies can receive very different proposals because they describe different systems. One may certify a single cloud service run by one team. Another may include several products, offices, outsourced operations and distinct legal entities. The number of people who perform in-scope activities matters, but headcount alone does not explain audit effort. Tell each certification body the same boundary and ask it to state the assumptions behind its proposed audit time.
ISO/IEC 27006-1:2024 provides requirements for bodies auditing and certifying information security management systems. Its audit-time approach considers people, sites and scope extensions. The IAF transition notice identifies changes to the audit-time calculation, including treatment of similar activities and multiple sites. That is why an online price calculator cannot replace a scoped proposal from the body that will perform the audit.
Scope is a cost lever, but narrowing it simply to buy a cheaper certificate can defeat the purpose. If the enterprise customer is buying your hosted product, a certificate for an unrelated office process will not answer its assurance question. Write the service, locations, teams, interfaces and important suppliers into the scope statement. Ask the customer what it expects to see on the certificate before cutting the boundary.
Budget the work before the certification audit
The first internal line is time. Someone must define interested parties and the ISMS boundary, assess information security risks, decide treatment, set objectives, maintain policies and test whether the system works. The standard requires an internal audit under Clause 9.2 and management review under Clause 9.3. A consultant can facilitate or perform parts of this work, but leadership still owns the decisions and the system that will operate after the consultant leaves.
Count the actual people and weeks in your organisation rather than accepting a percentage of a vendor estimate. List the security lead, engineering owners, people operations, procurement, legal reviewer and executive approver. For each, estimate time to create a process, run it once, correct findings and repeat it. A risk register assembled on the eve of Stage 2 is less useful than dated decisions showing how risks were treated during ordinary work.
- Existing work: identify controls and records you already operate, such as access approvals, change reviews and incident exercises.
- Missing work: price the actual remediation, including system configuration and staff time, separately from documentation.
- Independent review: reserve time and cost for the internal audit, findings and management review before the certification body arrives.
- Continuing work: name an owner for reviews, exceptions, supplier changes and evidence retention after the initial audit.
Do not assume every Annex A control needs a new tool. The Statement of Applicability records which controls are relevant and why, based on risk treatment and other requirements. A policy template does not operate a control. Conversely, a mature access-review process can often produce evidence without buying a dedicated product. The ISO 27001 certification guide on this site explains the ISMS and Statement of Applicability in more detail.
Ask for a comparable Stage 1 and Stage 2 quote
Send the same scope brief to several certification bodies. Include the service and sites, people involved, major technology, outsourced functions, existing management systems and desired certificate wording. ISO advises evaluating several bodies and checking accreditation. Accreditation gives independent confirmation of a body’s competence, though ISO says it is not compulsory. If a buyer or tender demands accredited certification, verify that requirement before selecting a body.
Ask each body to separate Stage 1, Stage 2, travel, remote work, report or certificate charges, and any extra time for a scope change or follow-up. Clarify what happens if Stage 1 reveals a material gap and whether Stage 2 must be rescheduled. An apparently fixed fee can carry exclusions that matter more than its headline. Have procurement compare like with like: the same scope, audit days, locations, expenses and assumptions.
Keep the internal audit distinct from the certification audit in the budget. Clause 9.2 is part of operating your ISMS. A certification body examines the system externally; management still performs its own evaluation. If a consultant offers to perform the internal audit, ask how independence from its implementation work will be maintained.
Model the full certification cycle across three years
A budget that ends on the initial certificate misses the ongoing work. Ask the certification body for its proposed surveillance schedule, audit effort and fees, then the terms for recertification. Ask how it handles a material change to scope, a new site or a significant nonconformity. ANAB explains that surveillance can be annual or more frequent and that certification has a defined validity period with recertification at expiry. The body’s written programme, not a generic blog chart, should drive your cash plan.
- PrepareBuild and run the ISMSScope, risk decisions, controls, internal audit and management review. Record the staff time and remediation separately.Your team
- InitialStage 1 and Stage 2Request audit days, rates, travel, report fees and the assumptions for each stage.Certification body
- MaintainSurveillance and control operationFund both the external visits and the recurring work that keeps the ISMS effective.Both
- RenewRecertification or scope changesAsk for the expected audit plan and how price changes if the business grows.Both
Put the numbers supplied by each provider into the same worksheet and include the time your staff must spend. Keep one-off remediation apart from recurring administration. Discounting the first audit does not lower future visits unless the agreement says so. A proposal that does not state renewal assumptions leaves the buyer unable to compare total cost.
Where a compliance platform changes the budget
Software can reduce repeated collection and help a small team see missing records before an external audit. Evidr’s evidence collection workflow supports uploads, AI-assisted review with confidence scoring, approval and control mapping. Its continuous monitoring product tracks evidence expiry and infrastructure findings. Those are useful if the same records support several controls or customer requests and owners otherwise spend time chasing files.
Test the savings rather than assuming them. Pick a control with a real owner, source record, review step and exception. Measure the manual effort for one cycle, then repeat the cycle with the platform. Include setup, integration permissions, reviewer time, usage charges and export quality. A lower subscription price does not compensate for a workflow that cannot show who approved the evidence or when it applied.
Evidr publishes plan terms on its pricing page; check the current features and limits before budgeting. Its value is in repeated collection, mapping, review and expiry monitoring across controls and customer requests. Management still chooses the scope and performs reviews, an independent auditor performs the internal audit where required, and a certification body alone decides certification.
A quote checklist you can send this week
- Write one scope brief naming the service, sites, people, suppliers, technology and desired certificate wording.
- Ask prospective bodies whether their accreditation covers ISO/IEC 27001:2022, and verify the claim with the accreditation body or recognised certificate register.
- Request separate audit effort and fees for Stage 1, Stage 2, surveillance and recertification, including travel and follow-up terms.
- Create a second worksheet for internal hours, remediation, internal audit, management review, software and advisory support.
- Compare the written assumptions and the full audit schedule. Confirm that the proposed scope answers the buyer’s actual request.
If the budget remains uncertain, keep it as a range built from supplier quotes and your own labour estimate. State which line is not yet quoted. That is more defensible to a finance lead than presenting a market-wide average as your organisation’s price. Before the engagement, ask the selected body to confirm the scope and audit programme in writing.