ISO 27001 is the international standard for information security management systems (ISMS), and it is increasingly a prerequisite for doing business with enterprise customers, government agencies, and regulated industries. But before committing to the certification journey, most organisations need a clear answer to a practical question: how much will it actually cost?
The honest answer is that ISO 27001 certification costs vary significantly based on your organisation’s size, complexity, existing security posture, and the scope of your ISMS. A 20-person SaaS startup will spend a fraction of what a 500-person financial services firm invests. This article provides a detailed, realistic breakdown of every cost category so you can budget accurately and avoid surprises.
Cost breakdown by phase
ISO 27001 certification is not a single expense — it is a series of investments spread across distinct phases. Understanding each phase helps you allocate budget appropriately and identify where costs can be optimised.
Phase 1: Preparation and scoping
Before any implementation work begins, you need to define the scope of your ISMS, identify stakeholders, and assess your current security posture against the standard’s requirements. This phase sets the foundation for everything that follows.
| Activity | Typical cost (GBP) | Typical cost (USD) |
|---|---|---|
| Scoping and context analysis | £1,500 – £5,000 | $1,900 – $6,300 |
| Risk assessment methodology setup | £2,000 – £6,000 | $2,500 – $7,500 |
| Initial project planning | £1,000 – £3,000 | $1,300 – $3,800 |
| Phase total | £4,500 – £14,000 | $5,700 – $17,600 |
Scoping decisions have an outsized impact on total cost. An ISMS that covers your entire organisation will cost substantially more to implement and audit than one scoped to a specific product, service, or business unit. For organisations pursuing certification for the first time, a focused scope is almost always the right approach.
Phase 2: Gap analysis
A gap analysis compares your current controls and documentation against the requirements of ISO 27001 and Annex A. This can be performed internally, by a consultant, or through a GRC platform with built-in gap assessment capabilities.
| Approach | Typical cost (GBP) | Typical cost (USD) |
|---|---|---|
| Internal gap analysis (staff time) | £2,000 – £5,000 | $2,500 – $6,300 |
| Consultant-led gap analysis | £5,000 – £15,000 | $6,300 – $19,000 |
| Platform-assisted gap analysis | £1,000 – £3,000 | $1,300 – $3,800 |
A thorough gap analysis is one of the highest-value investments in the certification process. It prevents you from discovering major non-conformities during the certification audit, where they are far more expensive and time-consuming to address.
Phase 3: Implementation
Implementation is typically the largest cost category. It encompasses writing policies and procedures, deploying technical controls, conducting risk assessments, training staff, and building the evidence base that auditors will examine.
| Activity | Typical cost (GBP) | Typical cost (USD) |
|---|---|---|
| Policy and procedure development | £3,000 – £12,000 | $3,800 – $15,000 |
| Technical control implementation | £5,000 – £25,000 | $6,300 – $31,500 |
| Risk assessment and treatment | £2,000 – £8,000 | $2,500 – $10,000 |
| Staff awareness training | £1,500 – £5,000 | $1,900 – $6,300 |
| Documentation and evidence collection | £2,000 – £8,000 | $2,500 – $10,000 |
| Phase total | £13,500 – £58,000 | $17,000 – $73,000 |
The wide range reflects the reality that organisations with mature security programmes may only need to formalise and document what they already do, whilst organisations starting from scratch will need to build controls from the ground up. Technical control costs depend heavily on your existing tooling — if you already run an endpoint detection platform, SIEM, or vulnerability scanner, those costs are already sunk.
Phase 4: Internal audit
ISO 27001 requires at least one internal audit before the certification audit. Internal audits evaluate whether your ISMS conforms to the standard and to your own policies. They must be conducted by someone independent of the processes being audited.
| Approach | Typical cost (GBP) | Typical cost (USD) |
|---|---|---|
| Internal auditor (trained staff member) | £1,500 – £4,000 | $1,900 – $5,000 |
| Outsourced internal audit | £3,000 – £10,000 | $3,800 – $12,600 |
Many organisations outsource their first internal audit to ensure it is rigorous enough to surface issues before the certification body arrives. In subsequent years, a trained internal team member can perform this function at lower cost.
Phase 5: Certification audit (Stage 1 and Stage 2)
The certification audit is conducted by an accredited certification body and consists of two stages.
Stage 1 is a documentation review. The auditor examines your ISMS documentation, scope statement, risk assessment, Statement of Applicability, and key policies to confirm you are ready for the Stage 2 assessment. This is typically conducted remotely and takes one to two days.
Stage 2 is the main assessment. The auditor verifies that your controls are implemented and operating effectively through interviews, evidence sampling, and observation. This is conducted on-site or remotely over two to five days, depending on the size and complexity of your organisation.
| Activity | Typical cost (GBP) | Typical cost (USD) |
|---|---|---|
| Stage 1 audit | £2,500 – £6,000 | $3,100 – $7,500 |
| Stage 2 audit | £5,000 – £18,000 | $6,300 – $22,700 |
| Certification audit total | £7,500 – £24,000 | $9,400 – $30,200 |
Certification body fees are determined primarily by the number of employees within scope, the number of sites, and the complexity of your information security environment. The International Accreditation Forum (IAF) provides guidance on audit duration based on these factors, and most certification bodies follow these guidelines closely.
Phase 6: Surveillance audits (Years 2 and 3)
ISO 27001 certification is valid for three years, but it is not a one-time exercise. In years two and three, the certification body conducts annual surveillance audits to verify that your ISMS remains effective and that you are continually improving.
| Activity | Typical cost (GBP) | Typical cost (USD) |
|---|---|---|
| Annual surveillance audit | £3,000 – £10,000 | $3,800 – $12,600 |
| Internal audit (annual) | £1,500 – £6,000 | $1,900 – $7,500 |
| Management review preparation | £500 – £2,000 | $600 – $2,500 |
| Annual maintenance total | £5,000 – £18,000 | $6,300 – $22,600 |
Surveillance audits typically cover a subset of the ISMS each year, with the full scope reviewed over the three-year cycle. They are shorter and less expensive than the initial certification audit, usually lasting one to three days.
Phase 7: Recertification (Year 4)
At the end of the three-year cycle, you must undergo a recertification audit to maintain your ISO 27001 certification. This is similar in scope to the initial Stage 2 audit, though it is often slightly shorter if your ISMS has been well-maintained.
| Activity | Typical cost (GBP) | Typical cost (USD) |
|---|---|---|
| Recertification audit | £5,000 – £16,000 | $6,300 – $20,000 |
Organisations that have maintained their ISMS diligently through the three-year cycle find recertification straightforward. Those that have let documentation and controls drift will face a more intensive — and expensive — process.
Total cost by company size
The following table provides realistic total cost ranges for the initial certification cycle, including preparation, implementation, and the certification audit. These figures assume a single-site organisation with a reasonably defined scope.
| Company size | Employees in scope | Total cost (GBP) | Total cost (USD) | Timeline |
|---|---|---|---|---|
| Startup / small business | 10 – 50 | £15,000 – £40,000 | $19,000 – $50,000 | 3 – 9 months |
| SMB | 50 – 250 | £35,000 – £80,000 | $44,000 – $100,000 | 6 – 12 months |
| Mid-market | 250 – 1,000 | £60,000 – £150,000 | $75,000 – $190,000 | 9 – 15 months |
| Enterprise | 1,000+ | £100,000 – £300,000+ | $126,000 – $380,000+ | 12 – 18 months |
These figures include consultant or platform costs but exclude the salaries of internal staff dedicated to the project. For most organisations, internal staff time represents an additional 20 to 40 percent on top of the direct costs shown above.
Hidden costs to budget for
Beyond the core certification costs, several frequently overlooked expenses can catch organisations off guard.
Penetration testing
Whilst ISO 27001 does not explicitly mandate penetration testing, Annex A control A.8.8 (management of technical vulnerabilities) and A.8.34 (protection of information systems during audit testing) strongly imply it. Most auditors expect to see evidence of regular security testing. A comprehensive penetration test typically costs £5,000 to £20,000 (USD $6,300 to $25,000) depending on scope.
Security tooling
Implementing the technical controls required by Annex A often necessitates investment in security tooling. Common requirements include endpoint detection and response (EDR), mobile device management (MDM), security information and event management (SIEM), vulnerability scanning, and backup solutions. Depending on your existing stack, this can add £5,000 to £30,000 (USD $6,300 to $38,000) annually in licensing costs.
Training and awareness
ISO 27001 requires ongoing security awareness training for all personnel. Beyond the initial training during implementation, you need to budget for annual refresher training, role-specific training for IT and security staff, and training for new joiners. Annual training costs typically range from £1,000 to £5,000 (USD $1,300 to $6,300) depending on the delivery method and organisation size.
GRC platform licensing
Organisations that use a GRC automation platform to manage their ISMS will incur ongoing licensing costs. These platforms streamline evidence collection, policy management, risk assessments, and audit preparation — typically saving far more in staff time than they cost in licensing fees. Annual platform costs range from £5,000 to £25,000 (USD $6,300 to $31,500) depending on the platform and the number of users.
Staff time and opportunity cost
The most significant hidden cost is staff time. Preparing for ISO 27001 requires sustained effort from IT, security, engineering, HR, and management. For a small organisation, expect the project lead to dedicate 40 to 60 percent of their time to the project for three to six months. For larger organisations, multiple team members will be involved, and the cumulative time investment is substantial.
Corrective actions
If the certification auditor identifies non-conformities, you will need to implement corrective actions and potentially schedule additional audit time to verify them. Major non-conformities can delay certification by months and add £2,000 to £10,000 (USD $2,500 to $12,600) in additional costs.
How to reduce ISO 27001 certification costs
Certification costs are significant, but there are proven strategies to reduce them without compromising the quality of your ISMS.
Start with a focused scope. The single most effective way to control costs is to limit the scope of your ISMS to the systems, processes, and personnel that are genuinely critical. You can always expand the scope in subsequent certification cycles once the core ISMS is established.
Use a GRC automation platform. Platforms like Prova GRC dramatically reduce the time spent on policy creation, evidence collection, risk assessments, and audit preparation. Organisations using automation typically reduce their implementation timeline by 40 to 60 percent and cut consulting costs by a similar margin. Pre-built policy templates, automated evidence collection, and control mapping across frameworks eliminate hundreds of hours of manual work.
Leverage existing controls. If you are already SOC 2 compliant, NIST-aligned, or following another recognised framework, many of your existing controls will map directly to ISO 27001 requirements. A thorough control mapping exercise at the start of the project can prevent you from duplicating effort and investment.
Invest in the gap analysis. Spending adequately on a thorough gap analysis upfront prevents far more expensive surprises during the certification audit. A well-executed gap analysis gives you a clear remediation roadmap and reduces the risk of non-conformities.
Choose your certification body wisely. Certification body fees vary meaningfully. Obtain quotes from at least three accredited certification bodies and compare not only price but also auditor expertise in your industry. Some certification bodies offer package pricing that includes the Stage 1 and Stage 2 audits along with the first surveillance audit at a reduced rate.
Build internal audit capability. Training an internal team member to conduct internal audits (ISO 19011 Lead Auditor training costs approximately £1,500 to £2,500) eliminates the recurring cost of outsourced internal audits and builds institutional knowledge.
The ROI of ISO 27001 certification
Certification costs should be evaluated against the tangible business returns that ISO 27001 delivers.
Accelerated sales cycles. Enterprise procurement teams increasingly require ISO 27001 certification. Organisations report that certification reduces the time spent on security questionnaires by 50 to 70 percent and shortens sales cycles by two to four weeks on average. For a B2B SaaS company with an average contract value of £50,000, closing even two additional deals per year more than covers the cost of certification.
Reduced insurance premiums. Cyber insurance providers offer meaningful premium reductions — typically 10 to 25 percent — for organisations with ISO 27001 certification. For organisations paying £20,000 to £50,000 annually in cyber insurance, the savings alone can offset a significant portion of ongoing maintenance costs.
Lower incident costs. Organisations with a certified ISMS experience fewer security incidents and resolve those that do occur more quickly. The IBM Cost of a Data Breach Report consistently shows that organisations with mature security programmes spend significantly less per breach than those without formal frameworks in place.
Market access. Certain industries and geographies effectively require ISO 27001. Government contracts in the UK and EU, financial services partnerships, and healthcare technology agreements frequently mandate the certification. Without it, these revenue streams are simply inaccessible.
Operational efficiency. The discipline of implementing an ISMS — formalising processes, defining roles, establishing metrics — improves operational efficiency beyond security. Organisations regularly report that the clarity and structure introduced during implementation reduces duplication, improves incident response times, and creates better cross-functional communication.
Three-year total cost of ownership
When budgeting for ISO 27001, it is important to consider the full three-year certification cycle rather than just the initial certification costs.
| Cost category | Startup / SMB (GBP) | Mid-market / Enterprise (GBP) |
|---|---|---|
| Initial certification (Year 1) | £15,000 – £80,000 | £60,000 – £300,000 |
| Surveillance audit (Year 2) | £5,000 – £18,000 | £12,000 – £35,000 |
| Surveillance audit (Year 3) | £5,000 – £18,000 | £12,000 – £35,000 |
| Ongoing tooling and training (per year) | £6,000 – £20,000 | £15,000 – £50,000 |
| Three-year total | £37,000 – £156,000 | £114,000 – £470,000 |
These figures reinforce the importance of viewing ISO 27001 as a continuous programme rather than a one-off project. The organisations that extract the most value from certification are those that integrate the ISMS into their daily operations rather than treating it as an annual audit preparation exercise.
Planning your certification budget
Accurate budgeting starts with honest assessment. Before committing to a timeline or engaging a consultant, evaluate your current security posture, identify the scope that makes sense for your business objectives, and obtain multiple quotes from certification bodies and consultants.
The cost of ISO 27001 certification is real and non-trivial, but for organisations that handle sensitive data, serve enterprise customers, or operate in regulated industries, it is an investment that pays for itself through faster revenue growth, reduced risk, and operational maturity. The question is rarely whether to pursue certification, but how to do so efficiently — and that starts with understanding exactly where the money goes.