ISO 27001 Certification Cost

ISO 27001 certification cost, line by line

ISO 27001 certification cost is mostly people and time, not the audit fee. The certificate itself comes from a certification body's audit, but most of the spend goes into building the information security management system the auditor examines. BD Emerson's July 2026 guide breaks the cost into these lines ¹:

• Certification body audit (Stage 1 and Stage 2): $6,000 to $30,000 by headcount and scope; $35,000 to $75,000 for multi-site or multi-country scopes.
• Implementation with consultant support: $15,000 to $60,000.
• Outsourced internal audit: $5,000 to $15,000. Clause 9.2 of the standard calls for internal audits.
• Compliance automation tooling: $8,000 to $25,000 a year.
• Training: $1,500 to $3,500 per seat for lead implementer or internal auditor courses.
• Penetration testing: $8,000 to $25,000 when your controls call for it.

Secureframe's guide frames the same spend differently: up to $40,000 for audit preparation, $15,000 or more for the certification audit and about $10,000 a year for surveillance ². It also gives a $10,000 to $50,000 range for audit costs ². The two guides are close on the audit and differ mainly on preparation, which depends on how much you outsource.

The standard itself is a small line. ISO lists ISO/IEC 27001:2022 at CHF 155 ³; most teams also buy ISO/IEC 27002, the control guidance.

Both firms sell compliance services, so read their numbers as reference points for quotes, not a market average. For a sense of where compliance spend sits next to ordinary IT costs, see our managed IT price index.

Certification audit fees: Stage 1, Stage 2 and auditor days

Certification bodies price the audit by auditor days, and the number of days rises with the number of people and sites in scope. BD Emerson puts certification body day rates at $1,200 to $2,000 and gives these audit sizes ¹:

Stage 1 is mostly a document review: the auditor checks your scope, risk assessment, Statement of Applicability and policies to decide whether you are ready. Stage 2 tests whether the controls work in practice, through interviews, records and sampling. Major findings from Stage 2 generally have to be closed before a certificate is issued.

ISO itself does not certify anyone. It states that it does not perform certification or issue certificates; external certification bodies do ⁵. It also notes that a certificate from an accredited body carries more weight, because an accreditation body has checked the certifier's competence ³. Before you sign, ask each certification body:

• Which accreditation body accredits it for ISO/IEC 27001.
• How many audit days it has calculated for Stage 1, Stage 2 and each surveillance audit, and the day rate.
• Whether travel, report fees or certificate fees are extra.
• Whether it will quote the full three-year cycle in one proposal.

Scope is the biggest price lever you control. Certifying one product line or one office, rather than the whole company, cuts audit days. It also has to match what your customers asked for, so check before you narrow it.

The three-year cycle: surveillance audits and recertification

ISO 27001 certification runs on a three-year cycle: a surveillance audit in each of the two years after the certificate is issued, then a recertification audit at the end. BD Emerson puts each surveillance audit at $4,000 to $12,000 and says recertification costs close to the initial audit fee ¹. Secureframe's figure for maintenance and surveillance is about $10,000 a year ².

The audit fee is only part of the running cost. In BD Emerson's worked example for a 100-person software company, years two and three each carry a $6,000 to $8,000 surveillance audit but come to about $30,000 a year in total running cost ¹. Budget for:

• Surveillance audits in years two and three.
• The internal audit and management review the standard expects every year.
• Risk assessment updates when systems, suppliers or threats change.
• Evidence upkeep: access reviews, training records, supplier reviews and incident logs.
• Recertification in year three, priced near the first audit.

Companies that lose the person who ran the project often struggle at the first surveillance audit. Assign an owner for the ISMS before the certificate arrives. A part-time security lead such as a vCISO is one way to cover that role without a full-time hire.

What an ISO 27001 consultant costs, and when to skip one

An ISO 27001 consultant usually costs $15,000 to $60,000 to take a company through implementation, according to BD Emerson's 2026 guide ¹. Secureframe's published guide puts consultant costs at about $38,000: a $20,000 first phase (scope, risk assessment, gap analysis, remediation plan) and an $18,000 second phase (remediation, ISMS build, internal audit, audit support) ². The same guide quotes Pivot Point Security day rates of $1,400 to $1,800 ².

You can do it without a consultant, but it is not free. BD Emerson estimates an internal-only implementation at 300 to 600 hours of senior staff time ¹. Document toolkits sit in the middle: Advisera lists its ISO 27001 documentation toolkit at $897 as a one-time payment, or $100 a month for three documents a month ⁶. A toolkit gives you templates, not judgment about your risks.

A consultant tends to pay off when:

• A customer contract sets a certification deadline you cannot miss.
• Nobody on staff has written a risk assessment or a Statement of Applicability before.
• Your environment spans several offices, clouds or business units.

Keep the roles separate. A consultant who built your ISMS should not also be your certification body, and your managed IT provider should not grade its own work. If the gap is mostly technical (MFA, logging, backups, patching), start with a cybersecurity risk assessment and fix those controls through your IT provider or co-managed IT arrangement before paying for ISMS consulting. For help choosing an outside adviser, see IT consulting services.

Readiness tooling and other costs

Readiness tooling, the compliance automation platforms that collect evidence and track controls, typically costs $8,000 to $25,000 a year for ISO 27001 ¹. Neither of the best-known platforms, Vanta and Drata, publishes a fixed price list, so contract data from buyers fills the gap. Vendr, which negotiates software purchases, reports a median Vanta contract of $20,000 a year across 374 purchases ⁷. It estimates single-framework pricing at $12,000 to $25,000 for 1 to 50 employees ⁷. It reports a median Drata contract of $24,934 a year across 236 purchases ⁸. Both figures were last updated February 2026.

A platform does not write your risk assessment or pass the audit for you. It pulls evidence from Microsoft 365, Google Workspace, cloud accounts and HR systems, sends policy reminders and gives the auditor a single place to look. It saves the most time when your systems are already in the cloud and well configured.

Other costs that show up on ISO 27001 projects:

• Penetration testing. A published 2026 guide puts an external network test at $5,000 to $20,000 and a web application test at $5,000 to $30,000 ⁹. See our penetration testing cost guide.
• Security fixes found in the gap analysis, often MFA, device management, logging and backup changes.
• Training for staff, plus lead implementer or internal auditor courses for the owner of the ISMS ¹.

Many of these fixes overlap with what a good managed IT plan should already include. Compare your current scope against our managed IT services pricing guide before buying the same control twice.

ISO/IEC 27001:2022 and the 2013 transition deadline

ISO/IEC 27001:2022 is the only current edition, and certificates to the 2013 edition ended on October 31, 2025. ISO published the 2022 edition on October 25, 2022 ³. The International Accreditation Forum's transition rules (IAF MD 26) gave certified organizations 36 months, to October 31, 2025, and state that all certifications based on ISO/IEC 27001:2013 shall expire or be withdrawn at the end of that period ⁴. New certifications and recertifications had to be audited against the 2022 edition from April 30, 2024 ⁴.

The transition audit added time to the bill: at least one auditor day when done with a surveillance audit or on its own, and at least half a day when combined with a recertification audit ⁴. In 2024 ISO also issued Amendment 1, "Climate action changes," at no charge ³. Ask your certification body how it will audit the amendment.

What this means in October 2026:

• If you are starting now, you certify to ISO/IEC 27001:2022 with its amendment. There is no choice of edition.
• If a supplier sends you a 2013 certificate, it is no longer valid under the IAF rules. Ask for the current certificate.
• If your own transition slipped, talk to your certification body about whether a new initial certification is needed.

If a customer is asking for ISO 27001 or a SOC 2 report and you are unsure which to pursue, see our SOC 2 audit cost guide. A request through our form goes to one advisory partner for a larger compliance project, or to one provider for a smaller one.