In short
The cost of ISO 27001 has three parts: the work to build your information security management system, the certification body's audits, and your own team's time. Size, scope and how much is already in place drive all three. A gap analysis is the quickest way to get an accurate figure for your business.
What do you actually pay for?
| Cost | What it covers | When |
|---|---|---|
| Implementation | Gap analysis, risk assessment, policies, the Statement of Applicability and putting controls in place, with a consultant or in-house | Before certification |
| Certification audit | The certification body's Stage 1 (documentation) and Stage 2 (in practice) audits | Year 1 |
| Surveillance audits | Shorter audits to confirm the system is still working | Years 2 and 3 |
| Recertification | A full audit to renew the certificate | Every three years |
| Your team's time | Workshops, evidence gathering, internal audit and management review | Throughout |
What makes ISO 27001 cost more or less?
- Scope: certifying one service or office costs less than the whole organisation.
- Size: more people, sites and systems mean more audit days and more evidence.
- Starting point: existing policies, Cyber Essentials and good IT records cut the work.
- Support level: full implementation by a consultant costs more than targeted help.
- Complexity: many suppliers, cloud platforms or regulated data add work.
How can you keep ISO 27001 costs down?
- Start with a gap analysis so you only fix what is missing.
- Set a sensible scope around the services your clients care about.
- Get Cyber Essentials first: it covers many of the technical basics.
- Build policies around how you already work, rather than generic templates you will never follow.
Frequently asked questions
Typically several months for a small to medium business, depending on your starting point and the time your team can give.
No. The certificate lasts three years, with surveillance audits in years two and three, so budget for ongoing audit fees and the time to keep the system up to date.
An accredited certification body. Consultants help you prepare, but the certificate comes from the certification body after its audits.