ISO 27001 certification cost: the audit fees, the preparation and what moves the number

ISO/IEC 27001:2022 sets the requirements for an information security management system (ISMS). Clauses 4 to 10 describe the management system: context, leadership, planning, support, operation, performance evaluation and improvement. Annex A lists 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). You choose which controls apply and justify the choice in a Statement of Applicability.

An accredited certification body audits you in two stages. Stage 1 reviews the documentation and readiness; Stage 2 tests that the ISMS runs. The certificate lasts three years, with a surveillance audit in each of the two years in between and a recertification audit in year three.

These ranges come from published vendor and consultancy estimates, which do not all agree; one UK guide puts Stage 1 at 20 to 30 percent of the combined fee. Travel is usually billed on top, and remote audits can lower the total. Treat the ranges as a planning guide and get written quotes from two or three accredited bodies.

Certification bodies price by the auditor-day, and the number of days is not up to them alone. IAF MD 5, the accreditation forum’s mandatory document on audit time, sets the starting number of days from the effective number of people in scope, then adjusts for complexity, sites and risk. More people and more locations mean more days, and every day carries the body’s day rate.

That is why two quotes for the same company can differ: day rates vary by body and country, and the adjustments are a judgment call. Ask each body to show the days it calculated.

• Gap assessment: where you stand against the clauses and Annex A.
• ISMS documentation: scope, information security policy, risk assessment and risk treatment methodology, the Statement of Applicability and the supporting procedures.
• Remediation: whatever the gap assessment finds, from single sign-on and endpoint protection to backups and supplier reviews. Priced after the assessment, not before.
• Internal audit: required by clause 9.2 before certification and every year after. One published estimate puts an outsourced internal audit at $5,000 to $15,000 for a small to mid-size company.
• Management review: clause 9.3, mostly leadership time.
• Tools: a compliance platform or a well-kept set of documents and spreadsheets.
• Your team’s hours, which most budgets leave out.

1. Headcount in scope. It sets the audit days and the size of the training, access and onboarding controls.
2. Sites. Each location can add audit time, and physical controls apply at each.
3. Scope. Certifying one product or service costs less than certifying the whole company. Buyers check the scope statement, so it has to cover what they buy.
4. Starting point. Controls already running for SOC 2 or a cyber insurance questionnaire cut the remediation line.
5. Consultant or not. Outside help costs money and usually saves months; doing it alone costs your team’s time.
6. Accreditation. A certificate from a body accredited by an IAF member, such as ANAB or UKAS, is the one buyers accept. A cheap certificate from an unaccredited body is money spent twice.

Much of the control work is shared: access reviews, change management, vendor reviews, incident response, logging. Companies that sell in the US and abroad often run both from one control set, and the second framework costs much less than the first. The audits stay separate: SOC 2 is a CPA firm’s attestation, ISO 27001 a certification body’s certificate. What SOC 2 costs is broken down in SOC 2 cost and hidden costs, and the framework itself is on our ISO 27001 page.