ISO/IEC 27001 certification cost: what moves the price, and what does not

Two invoices from two independent organisations

ISO/IEC 17021-1 prohibits certification bodies from offering management system consultancy, so the firm that helps build your ISMS can never be the one that certifies it.

The consulting fee pays for building an ISMS that holds up under audit: scope, gap analysis, risk method, Statement of Applicability, treatment plan, policies, awareness, internal audit, management review and audit support. Nothing in the certification rules requires a consultant; the fee depends on how much is missing and who does the building.

The certification body's fee pays for audit time: application review, the Stage 1 readiness review, the Stage 2 audit and the decision, then surveillance in each of the next two years and recertification before the certificate expires.

The third cost is never invoiced: hours from IT, HR, facilities and service owners, and any remediation the treatment plan demands, such as backup, logging or access tooling. A sound gap analysis sizes both before a date is agreed.

Eight drivers that move the price of an ISMS

How the certification body sizes an ISMS audit

Audit time is a calculation, not a sales figure. ISO/IEC 17021-1 requires a documented procedure and a record of each audit's duration and its justification, weighing among other things the organisation's complexity, its technological and regulatory context, outsourcing, earlier audit results, sites and their locations, risks and whether audits are combined.

ISO/IEC 27006-1:2024, which replaced ISO/IEC 27006:2015, applies this to information security: it contains a normative annex on audit time, an informative annex on calculation methods and rules for multi-site sampling. The 2024 edition addresses remote audits and organisations with few or no physical sites, introduces the concept of people performing identical activities, and aligns its guidance on reviewing implemented Annex A controls with the 2022 controls.

Because accredited bodies share the method, their days for one scope should be comparable, and a quotation far below the rest has left something out.

What leaves the price unchanged

• The certificate as a document. The fee pays for the assessment, not the paper; an accredited certificate records the same kind of decision whichever body issues it.
• Who built the ISMS. With or without a consultant, under Design™ or Drive™, the same organisation gets the same audit time, and nobody can negotiate it down.
• The size of the policy set. More policies do not shorten the audit; each must be kept current and followed, and the auditor checks that it is.
• The price of your security products. A premium tool neither reduces audit time nor satisfies a control by itself; the auditor wants a configured, owned and reviewed control that produces records.
• The edition you certify against. New certificates are issued against ISO/IEC 27001:2022, and Amendment 1:2024 asks you to determine whether climate change is a relevant issue, not to rebuild the ISMS.

Hidden costs that surface after the quotation

• Certificates from unaccredited bodies. They are cheap for a reason, and they tend to fail at the worst moment: an enterprise client's vendor-risk review or a tender evaluation. You then start accredited certification from scratch, on top of what was already spent.
• Tooling nobody uses. Platforms and scanners acquired before the risk assessment often cover the wrong controls or sit unconfigured while the licence renews. Let the treatment plan decide what technology you need.
• Re-audits and extra visits. Every major nonconformity needs corrections the certification body has verified, occasionally through a follow-up visit, before it can decide; miss the deadline in ISO/IEC 17021-1 and Stage 2 is carried out again. Adding a service or site later, or a short-notice audit to investigate a complaint, means further audit time.
• Missing evidence periods. Access reviews, backup restore tests, log reviews, supplier assessments and incident records exist only once controls have run. Book Stage 2 too early and the audit either records the gaps or moves, and preparation is paid for twice.

How to compare ISO/IEC 27001 quotations

Questions for certification bodies

• Is the body accredited for ISMS certification by a Global ACI signatory, as that accreditation body's own register shows?
• Does every offer cover the same services, sites, headcount, systems and cloud platforms?
• How many days are planned for each audit in the cycle, on what calculation, and how were remote auditing and identical roles treated?
• What will the whole cycle cost, including travel, application and annual fees, and any follow-up visit or moved date?

Questions for consultants

• Is the fee fixed against a written scope, or billed by the day until the work ends?
• Which deliverables are named, from risk method and Statement of Applicability to internal audit and management review, and who produces each?
• Are software, vulnerability assessment, penetration testing and internal auditor training in or out?
• Are certification-body fees listed apart? A bundled price, or a certificate promised in days, signals a route enterprise clients reject.

ISO/IEC 27001 certification cost: questions buyers ask