What does ISO 27001 cost?
Updated: 2026-11
ISO 27001 costs consist of three parts: building the ISMS with internal time and possibly consulting, technical measures to close gaps, and the certification body’s audits, including annual surveillance. Scope and starting point have the greatest influence.
ISO 27001 has no standard price, because the standard is not a product but a management system adapted to your organisation. A software company with twenty people and one site needs something different from a provider with several sites and data centres.
Internal time is often underestimated: an ISMS depends on your people assessing risks, implementing measures and keeping evidence.
What drives the cost
Scope
The more sites, processes and systems are included, the more effort risk assessment and audit require.
Starting point
Existing policies, inventories and technical measures shorten the build considerably.
Internal time
Owners must assess risks, introduce processes and keep evidence; this is the largest item.
Technical gaps
Missing multi-factor authentication, backups or logging cause costs for tools and implementation.
Certification audit
The certification body charges by audit days, which depend on size and scope.
Ongoing operation
Annual surveillance audits, internal audits and maintaining the system recur.
How we price
- 01
Build in stages
Scope and risk assessment first, then rollout and audit, each with fixed scope.
- 02
Start without certification
Build the ISMS to the standard and decide on certification later, when customers require it.
- 03
Support in operation
Annual support with internal audit and management review.
We deliberately publish no online prices: every case differs. After a short first conversation you receive a binding fixed price or clear frame.
Parent service: Cyber readiness & IT security
Matching offers
Building an ISMS to ISO 27001
An ISO 27001 ISMS is the solid foundation for NIS2, TISAX, customer requirements and possible certification. We build it to fit your company: scope, risk assessment, statement of applicability, policies, responsibilities and internal audit. The certification audit is carried out by an accredited body.
Answering customer security questionnaires
Under NIS2 and DORA, large customers must assess their suppliers’ security and send extensive questionnaires to do so. We help answer them honestly and completely, compile the evidence required and build an answer library so the next questionnaire takes hours rather than days.
Cyber readiness check
The cyber readiness check establishes whether your company detects an attack in time, responds correctly and reports on time: review of reporting duties under the ISA, FADP and NIS2 where relevant, inventory of the attack surface, review of cloud and Microsoft 365 baseline configuration, backup recoverability, an incident response plan and a tabletop exercise.
FAQ
Do you have to get certified?
No. Many companies work to the standard without a certificate. Our decision guide on certifying versus implementing without a certificate helps weigh it up.
How often do audit costs arise?
In the certification year the two-stage audit, then annual surveillance audits and recertification after three years.
What is the cheapest way in?
A clearly defined scope covering the services for which customers require evidence.