How much does ISO 27001 cost, and how long does it take?

Where the money goes

ISO 27001 costs fall into four buckets:

1. Certification audits. An accredited certification body carries out a Stage 1 and Stage 2 audit, then a smaller surveillance audit each year. Their fee is mostly set by the number of audit days, which depends on how many people are in scope.
2. Implementation support. Help to scope the system, run the risk assessment, write policies and controls, train staff and get ready for audit.
3. Fixing gaps. Things like multi-factor authentication, device management, backups, a penetration test or supplier checks. Often small, sometimes not.
4. Your own time. Someone has to own it internally, usually a few hours a week during implementation, and less after.

Typical UK costs in 2026

These are rough ranges for organisations certifying for the first time, excluding VAT.

Organisation size	Certification audits, first year
Up to 15 people	£3,500 to £6,000
16 to 50 people	£5,000 to £9,000
51 to 150 people	£8,000 to £14,000

Surveillance audits in years two and three usually cost around a third to half of the first year's audit fee. Implementation support varies more than anything else, from a few thousand pounds for a small, well-run organisation to tens of thousands for a complex one.

Three worked examples

Illustrative only, not quotes. Every organisation is different, but these show how scope drives the numbers.

A 12 person recruitment agency

Fully cloud-based on Microsoft 365, already has Cyber Essentials, one office. A client contract requires ISO 27001.

Implementation support	£6,000 to £10,000
Certification audits	£4,000 to £6,000
Gap fixes	Under £1,500
First year total	£11,000 to £17,500

Timeline: 4 to 6 months.

A 40 person software company

Hosts customer data in the cloud, a development team, a handful of key suppliers, no Cyber Essentials yet.

Implementation support	£12,000 to £20,000
Certification audits	£6,000 to £9,000
Penetration test and gap fixes	£4,000 to £8,000
First year total	£22,000 to £37,000

Timeline: 6 to 9 months.

A 120 person professional services firm

Two offices, some on-premises systems, a mix of in-house and outsourced IT, sensitive client data.

Implementation support	£25,000 to £45,000
Certification audits	£9,000 to £14,000
Penetration test and gap fixes	£8,000 to £20,000
First year total	£42,000 to £79,000

Timeline: 9 to 12 months.

How long it takes

Most small and mid-sized organisations take 4 to 12 months from first conversation to certificate. The broad stages:

1. Scope and gap review, a few weeks.
2. Risk assessment, policies and controls, usually the longest stage.
3. Running the system for long enough to show it works, including an internal audit and a management review. Most certification bodies want to see a couple of months of evidence.
4. Stage 1 and Stage 2 audits, normally a few weeks apart.

The certificate lasts three years, with surveillance audits each year and a full recertification at the end.

What pushes the cost up or down

• Scope. Certifying one service or team is cheaper than the whole organisation, but make sure it covers what your customers actually care about.
• Where you're starting from. Cyber Essentials, good IT management and written processes all cut the work.
• Locations and systems. More sites, on-premises servers and suppliers mean more audit days and more controls.
• Deadline. A tender in eight weeks costs more than a plan over six months.

Watch out for cheap certificates

Some providers offer ISO 27001 certificates for a few hundred pounds. Check the certification body is accredited by UKAS (or another IAF member). Many customers and tenders won't accept a certificate that isn't, and finding that out after you've paid is expensive.

How I help

I'm a certified ISO 27001 implementation practitioner. I'll help you agree a sensible scope, build a system sized to your organisation, get you ready for the auditors and work with them through Stage 1 and Stage 2. Certification itself is done by an independent, accredited body. If ISO 27001 isn't right for you yet, I'll say so, and Cyber Essentials is often the better first step. Read more about how I help with ISO 27001.