By Akash Sengar · · 7 min read
The parts of the price
"How much does ISO 27001 cost?" has no single answer, and any quote given before someone understands your scope is a guess. What can be explained is what drives the cost. There are five separate spends, often from different budgets:
- Certification body fees for the Stage 1 and Stage 2 audits, then surveillance audits and recertification.
- Implementation support: consultants, if you use them, for gap analysis, risk assessment, documentation, internal audit and audit preparation.
- Internal staff time, which is the largest cost in most projects and the one most often left out.
- Tooling: an ISMS or GRC platform, if you choose one, and security tools.
- Remediation: fixing the gaps the risk assessment finds.
We do not publish prices, and this guide quotes none, because no public source gives reliable ranges that would apply to your situation.
Certification body audit days
Certification bodies charge mostly by auditor-days, and the number of days is not up to them alone. For information security management systems, accredited certification bodies follow ISO/IEC 27006-1, which sets audit time mainly from the number of people doing work under the organisation's control within scope, adjusted for complexity, number of sites and the scope of the ISMS. (The general audit-time document IAF MD 5 covers quality, environmental and health and safety systems; ISMS audit time sits in ISO/IEC 27006-1.)
So the levers are real but limited: fewer people in scope, fewer sites and a simpler technology estate mean fewer days. A certification body that offers far fewer days than its competitors for the same scope should prompt questions about accreditation.
Check that the body is accredited by an IAF member accreditation body for ISO/IEC 27001, so the certificate is recognised by your customers.
Stage 1, Stage 2 and the three-year cycle
Budget for the cycle, not just the first year. Under ISO/IEC 27001:2022 certification:
- Year 1: Stage 1 (documentation and readiness review) and Stage 2 (evidence that the ISMS operates), then the certificate is issued.
- Years 2 and 3: a surveillance audit each year, shorter than the initial audit.
- Year 3 or 4: a recertification audit before the three-year certificate expires.
Ask each body for a three-year proposal with the days for every audit, travel policy and any per-day charges, so you compare like with like.
Consultant and implementation effort
Implementation effort depends on what you already have. A company with MFA everywhere, managed devices, tested backups, central logging and written policies may need mainly a risk assessment, Statement of Applicability, evidence and an internal audit. A company starting from scratch needs most of the ISMS built.
Typical consultant work packages are gap analysis, risk assessment and Statement of Applicability, policies and procedures, evidence set-up, awareness training, internal audit, management review support and audit accompaniment. Ask for a scope that names each, the days estimated and what your team must provide.
Internal staff time
Someone in your organisation must own the ISMS: run risk reviews, chase evidence, attend audits and keep it going after certification. The standard expects top management involvement too, including the management review. Even with a consultant, plan for a named owner who can spend meaningful time on it during implementation and a smaller but steady share afterwards.
Remediation: the variable that surprises people
The gap analysis often finds controls that need money, not just documents:
- MFA for all users and admin accounts, which may need licence upgrades.
- Device management (MDM) and disk encryption for laptops and phones.
- Backups that are separated from production and actually restore-tested.
- Central logging and monitoring for key systems.
- Vulnerability scanning or a penetration test.
- Supplier contracts updated with security terms.
These are worth doing anyway, but they belong in the ISO 27001 budget conversation so they are not a surprise halfway through.
Tooling
A GRC platform can help with evidence collection and audits, but it is optional. Small organisations often run a sound ISMS on the tools they already have: a document library, a spreadsheet risk register and a ticketing system for actions. Buy a platform when the volume of evidence or frameworks justifies it.
Questions to ask before you sign
Whichever certification body and consultant you choose, these questions make proposals comparable and expose hidden costs:
- How many audit days for Stage 1, Stage 2, each surveillance audit and recertification, and how were they calculated?
- Which accreditation body accredits you for ISO/IEC 27001, and will the certificate carry its mark?
- Are travel, report writing and certificate issue included, or charged separately?
- What happens if a major nonconformity is found: is a follow-up visit charged?
- For a consultant: which deliverables are included, how many days, who does the work, and what must our staff provide?
- Will we own all documents, templates and the risk register at the end?
- Does the price assume the gaps are already closed, or include help closing them?
A certification body cannot also consult for you on the same management system; that would compromise its independence. If one offers both, ask how it keeps them separate.
Does cost differ by country, including India?
Yes, in general terms. Auditor day rates differ between countries and between certification bodies, and travel can add cost for multi-site audits. Searches such as "ISO 27001 cost India" often turn up figures without sources; we have not found a public, reliable source of ranges that we can cite, so we do not quote any. The method above (days from ISO/IEC 27006-1, multiplied by a quoted day rate, plus consulting, staff time and remediation) works in any country.
Keeping cost down for a small business
- Scope tightly. Certify the product, service or location your customers care about first. A tight, honest scope reduces audit days and implementation work.
- Start with a gap analysis. It turns an open-ended project into a list of known gaps you can price.
- Reuse existing controls. Microsoft 365, Google Workspace and cloud platforms already provide many controls; document and use them before buying new tools.
- Keep documents short. Auditors look for controls that work and are evidenced, not page counts.
- Plan for year two. Building evidence collection into normal work makes surveillance audits cheaper.
For the steps in order, read ISO 27001 implementation steps and timeline, and for what the standard requires, ISO 27001:2022 explained.
