How much does ISO 27001 certification cost?

For a small organisation, the stage 1 and stage 2 audits together typically cost between €4,000 and €8,000. That covers the certification body only, and excludes internal time, external support and any remediation.

What are the ongoing costs after certification?

Surveillance audits in years one and two, and a recertification audit before the three-year certificate expires. Surveillance audits are shorter than the initial assessment but recur annually.

Do I need a consultant?

Not necessarily. If someone in your organisation has taken a management system through certification before, you can do it internally. If nobody has, a consultant usually saves more time than they cost.

Does a cheaper certification body save money?

Only if it is accredited. A non-accredited certificate carries considerably less weight in procurement, and clients increasingly check.

What ISO 27001 certification actually costs

By Eoghan Kenny · 12 October 2026

For a small organisation, the stage 1 and stage 2 certification audits together typically cost between €4,000 and €8,000. That figure covers the certification body only, and it is usually the smallest of the three costs involved.

Most articles on this question quote the audit fee and stop, which is why so many budgets are wrong. There are three components, and they behave differently.

Component one: the certification body

This is the quotable number, and it varies with the size and complexity of your scope.

Certification bodies price by auditor days, and there are international rules setting out how many days an audit of a given size should take. A small organisation with a narrow scope might see one to two days for stage 1 and two to four for stage 2. Larger or more complex scopes scale from there.

What affects the quote: number of employees in scope, number of sites, the complexity of what you do, and whether any processes are outsourced.

This cost recurs. A certificate lasts three years, with surveillance audits in years one and two and a recertification audit before it expires. Surveillance audits are shorter than the initial assessment but they are not free, and the recertification is close to a full audit again.

Component two: internal time

This is almost always the largest cost, and it is the one that does not appear on any invoice.

Someone has to define the scope, run the risk assessment, produce the Statement of Applicability, write or revise around two dozen documented policies and procedures, implement the controls, run the internal audit, hold the management review, and then operate the system for long enough to generate the evidence an auditor will want to see.

For a first certification, that is measured in months of part-time effort. Costing it honestly means putting a day rate against the people involved and multiplying. The Compliance Cost Calculator can help you put a figure against it for your own organisation.

The gap comes from the goal people set at the start. Most organisations want to spend as little internal time on this as possible, which sounds sensible until you realise it means underestimating the work before it is even scoped. It is the same as fitness: you can buy the right kit and pay for the best coaching, but if you do not put the time in yourself, none of it makes you fit. The organisations that budget honestly ask a different question, not how do we get through this with the least effort, but how do we run this operationally without disrupting the business. The ones chasing the first question tend to end up in one of three places: a poor certification outcome, a system that looks fine on paper but does not work day to day, or a team that gets it done but ends up working evenings and weekends because they underestimated by half.

Component three: external support

Optional, and the answer depends on one question: has anyone in your organisation taken a management system through certification before?

If someone has, you can do this internally. If nobody has, a consultant tends to pay for themselves in avoided rework, particularly on scope definition and risk methodology, which are the two decisions most expensive to reverse.

What a consultant cannot be is your certification body. Those roles are separate for good reason, and any organisation offering to both prepare and certify you should be treated with caution.

What people forget to budget for

Surveillance audits, annually, for the life of the certificate.
Recertification every three years, close to the cost of the original.
The internal audit, which has to be conducted by someone independent of the area being audited. For a small organisation that usually means paying an external party to act as your internal auditor, which sounds contradictory and is entirely normal.
Tooling, whether a platform, a set of templates, or the cost of maintaining spreadsheets somebody has to keep current.
Remediation, the gap between where you are and what the standard requires. The most variable of all, and the hardest to estimate before the risk assessment is done.

Is a cheaper certification body a saving?

Look at accreditation before price.

In the UK, UKAS accreditation is the mark to look for. In Ireland, INAB performs the equivalent function. Both belong to the international arrangement that makes certificates recognised across borders.

A non-accredited certificate costs less and is worth considerably less in procurement. A client who checks will notice, and clients increasingly check.

The honest summary

The certification body fee is the number you can get quoted today. It is also the number least likely to determine whether this project succeeds.

The cost that decides that is internal time, and the biggest variable within it is how much of the work has to be built from nothing rather than made visible from what already exists.

Get started

How mature is your compliance today?

Our team built a free, practical health check so you can see your maturity across governance, risk, evidence, ownership and operations, which one is holding you back, and what to do about it first. Start the Health Check.