What does ISO 27001 cost in total?
A small UK organisation, up to about 50 staff on a single site, should typically budget £13,000 to £26,000 in cash costs in year one. A mid-sized or more complex organisation should budget £25,000 to £45,000.
Anyone quoting you a single figure without asking about your scope is guessing. I will give you a figure once I understand your scope.
What are the three costs of ISO 27001 certification?
Most confusion about ISO 27001 pricing comes from mixing together costs that are paid to different people for different things.
| Cost | Paid to | Typical UK range (small organisation) |
|---|---|---|
| Implementation and consultancy | Your consultant, if you use one | £7,500–£25,000 depending on support level |
| Certification audit (Stage 1 and Stage 2) | An independent certification body | Roughly £3,000–£10,000 |
| Internal time and any control improvements | Your own organisation | Commonly 100–200 hours, plus any tooling or testing you need |
The certificate is always issued by the certification body. Your consultant helps you prepare, and the body makes its own decision.
That independence is the point of the scheme. For that reason, the second cost can never be bundled into the first.
What does ISO Security charge for ISO 27001?
I quote implementation as a fixed fee once scope is established, so you know the investment before committing. The bands below are what most organisations of each size pay.
The readiness discussion that establishes scope is undertaken without charge. We need to know and understand each other before any contractual or financial commitment is entered into.
| Organisation | Implementation, typically | What shapes it |
|---|---|---|
| Up to 50 staff, single site, straightforward systems | £10,000–£16,000 | Existing policies and controls, cloud-based systems, one main service |
| 50–150 staff | £16,000–£24,000 | More departments, suppliers and systems inside the scope |
| 150–500 staff, multi-site or regulated | £25,000–£38,000 | Several sites or services, regulatory oversight, complex supplier chains |
| Larger or unusually complex | Quoted individually | Established after a readiness discussion |
Related services, where they are commissioned separately:
| Service | Fee |
|---|---|
| Gap analysis and prioritised roadmap | From £2,400 |
| Standalone internal audit | From £1,950 |
| Ongoing ISMS and virtual CISO support | From £1,250 a month; £2,400–£3,600 a month where I lead the programme |
| Ad-hoc senior support outside a programme | £1,250 a day |
These bands reflect direct work with a certified Lead Implementer and Lead Auditor. They price senior time: building a system around your business, and standing alongside you at the audit.
What do other UK ISO 27001 consultants charge?
Few providers publish real numbers. Those that do, checked in November 2026, give a useful sense of where the market sits, and fees change, so follow the links for current figures.
| Provider | Published implementation fees | Other published fees |
|---|---|---|
| Precursor Security | From £8,000 (under 50 staff); £12,000–£15,000 (50–150); £18,000–£25,000 (150–500) | Certification-body fees quoted separately |
| Oxford Infosec | £12,000–£18,000 simple; £20,000–£28,000 standard; £30,000–£46,000 complex | Maintaining the system afterwards from £1,400 a month |
| Intelance | Full programmes from £25,000 | Gap assessment from £8,500; internal audit from £4,500; managed ISMS from £2,500 a month |
| ISEO Blue | £7,500 fully assisted (fixed); £3,500 coaching route | UKAS-accredited audit quoted at £6,800–£10,000 for a small organisation |
The spread is genuine. At the lower end you buy templates and guidance, and your team does most of the work.
At the upper end you buy senior consultants doing the work with you. Compare who does what on each quote, because price-only comparisons are how organisations end up paying twice.
What does the certification body charge?
An accredited certification body prices the audit from the people in your scope, your sites and the complexity of the work. For an organisation under about 100 people, expect roughly £3,000 to £10,000 for the initial two-stage audit.
Surveillance in each of the following two years is smaller, commonly £1,500 to £3,000, with a larger recertification audit at the end of the three-year cycle. I help you select and engage an accredited body, and its fees are contracted with, and paid to, the body itself.
What makes an ISO 27001 quote higher or lower?
- Scope. The single biggest factor. A certificate covering one service from one site costs a fraction of one covering everything you do.
- What already exists. Documented policies, access reviews and supplier checks you already perform reduce the build considerably.
- People and sites in scope. Both consultancy effort and audit days scale with them.
- Complexity and regulation. Handling payment, health or other regulated data raises the bar for evidence.
- Timescale. A tender deadline that compresses the programme into weeks costs more than the same work over six months.
- Internal ownership. A named person with time to work with the consultant reduces external effort. Nobody owning it increases it.
Which ISO 27001 costs do people forget?
- Your team's time. Workshops, evidence gathering, an internal audit and a management review all take diaries as well as budget.
- Control improvements. Most organisations need some: multi-factor authentication everywhere, a tested backup restore, a vulnerability scan or a penetration test.
- Years two and three. Surveillance audits, and keeping the system alive between them. My guide to maintaining certification sets out the rhythm, and ongoing CISO support exists for organisations with nobody to own it.
- Doing it twice. The most expensive outcome is a system built only to pass the audit. It then has to be rebuilt before the first surveillance visit.
How can you reduce the cost of ISO 27001?
Start with an honest scope, because a narrow scope your customer rejects saves nothing. Use what you already have before buying anything new, and give one internal owner protected time.
Fix the technical basics early: access control, backups, patching, joiners and leavers. They generate the evidence everything else rests on.
Be realistic about timescale. A system needs a period of operating evidence before Stage 2, so starting earlier is almost always cheaper than going faster, and my implementation guide explains the programme stage by stage.