---
title: "ISO 27001 Certification Cost in the UK (2026)"
description: "ISO 27001 certification cost for UK firms: implementation typically £10k-£38k by size, certification-body fees £3k-£10k, plus internal time. Prices compared."
canonical: https://www.isosecurity.co.uk/resources/iso-27001-cost-uk
updated: 2026-11-10
---

# How much does ISO 27001 certification cost in the UK?

By Alan Hutson, Certified ISO 27001 Lead Implementer, Lead Auditor, CISSP · Reviewed November 2026 · All figures exclude VAT

For most UK organisations the first-year cash cost falls between £13,000 and £40,000 excluding VAT. Three separate costs make up that figure: implementation support, the certification body's audit fees, and your own team's time.

## What does ISO 27001 cost in total?

A small UK organisation, up to about 50 staff on a single site, should typically budget **£13,000 to £26,000** in cash costs in year one. A mid-sized or more complex organisation should budget **£25,000 to £45,000**.

Anyone quoting you a single figure without asking about your scope is guessing. I will give you a figure once I understand your scope.

## What are the three costs of ISO 27001 certification?

Most confusion about ISO 27001 pricing comes from mixing together costs that are paid to different people for different things.

| Cost                                       | Paid to                           | Typical UK range (small organisation)                        |
| ------------------------------------------ | --------------------------------- | ------------------------------------------------------------ |
| Implementation and consultancy             | Your consultant, if you use one   | £7,500–£25,000 depending on support level                    |
| Certification audit (Stage 1 and Stage 2)  | An independent certification body | Roughly £3,000–£10,000                                       |
| Internal time and any control improvements | Your own organisation             | Commonly 100–200 hours, plus any tooling or testing you need |

The certificate is always issued by the certification body. Your consultant helps you prepare, and the body makes its own decision.

That independence is the point of the scheme. For that reason, the second cost can never be bundled into the first.

## What does ISO Security charge for ISO 27001?

I quote implementation as a fixed fee once scope is established, so you know the investment before committing. The bands below are what most organisations of each size pay.

The readiness discussion that establishes scope is undertaken without charge. We need to know and understand each other before any contractual or financial commitment is entered into.

| Organisation                                         | Implementation, typically | What shapes it                                                           |
| ---------------------------------------------------- | ------------------------- | ------------------------------------------------------------------------ |
| Up to 50 staff, single site, straightforward systems | £10,000–£16,000           | Existing policies and controls, cloud-based systems, one main service    |
| 50–150 staff                                         | £16,000–£24,000           | More departments, suppliers and systems inside the scope                 |
| 150–500 staff, multi-site or regulated               | £25,000–£38,000           | Several sites or services, regulatory oversight, complex supplier chains |
| Larger or unusually complex                          | Quoted individually       | Established after a readiness discussion                                 |

Related services, where they are commissioned separately:

| Service                                   | Fee                                                                   |
| ----------------------------------------- | --------------------------------------------------------------------- |
| Gap analysis and prioritised roadmap      | From £2,400                                                           |
| Standalone internal audit                 | From £1,950                                                           |
| Ongoing ISMS and virtual CISO support     | From £1,250 a month; £2,400–£3,600 a month where I lead the programme |
| Ad-hoc senior support outside a programme | £1,250 a day                                                          |

These bands reflect direct work with a certified Lead Implementer and Lead Auditor. They price senior time: building a system around your business, and standing alongside you at the audit.

## What do other UK ISO 27001 consultants charge?

Few providers publish real numbers. Those that do, checked in November 2026, give a useful sense of where the market sits, and fees change, so follow the links for current figures.

| Provider                                                                                               | Published implementation fees                                                     | Other published fees                                                                     |
| ------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| [Precursor Security](https://www.precursorsecurity.com/services/compliance/iso-27001-consultancy/cost) | From £8,000 (under 50 staff); £12,000–£15,000 (50–150); £18,000–£25,000 (150–500) | Certification-body fees quoted separately                                                |
| [Oxford Infosec](https://www.oxfordinfosec.com/insights/iso-27001-certification-cost)                  | £12,000–£18,000 simple; £20,000–£28,000 standard; £30,000–£46,000 complex         | Maintaining the system afterwards from £1,400 a month                                    |
| [Intelance](https://www.intelance.co.uk/iso-27001-consulting/)                                         | Full programmes from £25,000                                                      | Gap assessment from £8,500; internal audit from £4,500; managed ISMS from £2,500 a month |
| [ISEO Blue](https://iseoblue.com/iso-27001/certification-guides/certification-costs/)                  | £7,500 fully assisted (fixed); £3,500 coaching route                              | UKAS-accredited audit quoted at £6,800–£10,000 for a small organisation                  |

The spread is genuine. At the lower end you buy templates and guidance, and your team does most of the work.

At the upper end you buy senior consultants doing the work with you. Compare who does what on each quote, because price-only comparisons are how organisations end up paying twice.

## What does the certification body charge?

An accredited certification body prices the audit from the people in your scope, your sites and the complexity of the work. For an organisation under about 100 people, expect roughly £3,000 to £10,000 for the initial two-stage audit.

Surveillance in each of the following two years is smaller, commonly £1,500 to £3,000, with a larger recertification audit at the end of the three-year cycle. I help you [select and engage an accredited body](/iso-27001-implementation), and its fees are contracted with, and paid to, the body itself.

## What makes an ISO 27001 quote higher or lower?

- **Scope.** The single biggest factor. A certificate covering one service from one site costs a fraction of one covering everything you do.
- **What already exists.** Documented policies, access reviews and supplier checks you already perform reduce the build considerably.
- **People and sites in scope.** Both consultancy effort and audit days scale with them.
- **Complexity and regulation.** Handling payment, health or other regulated data raises the bar for evidence.
- **Timescale.** A tender deadline that compresses the programme into weeks costs more than the same work over six months.
- **Internal ownership.** A named person with time to work with the consultant reduces external effort. Nobody owning it increases it.

## Which ISO 27001 costs do people forget?

- **Your team's time.** Workshops, evidence gathering, an internal audit and a management review all take diaries as well as budget.
- **Control improvements.** Most organisations need some: multi-factor authentication everywhere, a tested backup restore, a vulnerability scan or a penetration test.
- **Years two and three.** Surveillance audits, and keeping the system alive between them. My guide to [maintaining certification](/resources/how-to-maintain-iso-27001-certification) sets out the rhythm, and [ongoing CISO support](/virtual-ciso-services) exists for organisations with nobody to own it.
- **Doing it twice.** The most expensive outcome is a system built only to pass the audit. It then has to be rebuilt before the first surveillance visit.

## How can you reduce the cost of ISO 27001?

Start with an honest scope, because a narrow scope your customer rejects saves nothing. Use what you already have before buying anything new, and give one internal owner protected time.

Fix the technical basics early: access control, backups, patching, joiners and leavers. They generate the evidence everything else rests on.

Be realistic about timescale. A system needs a period of operating evidence before Stage 2, so starting earlier is almost always cheaper than going faster, and my [implementation guide](/resources/iso-27001-implementation-guide) explains the programme stage by stage.

## Frequently asked questions about ISO 27001 costs

### How much does ISO 27001 certification cost a small UK business?

For up to roughly 50 staff on a single site, budget £13,000 to £26,000 in year one, excluding VAT: implementation support (typically £10,000 to £16,000 with ISO Security) plus certification-body fees of roughly £3,000 to £10,000. Your own staff time sits on top of that, and it is often the largest hidden cost.

### Are certification-body fees included in a consultant's price?

The auditor must stay independent of the person who built the system, so you contract and pay the certification body separately for Stage 1 and Stage 2. Treat any quote that bundles the certificate into consultancy with caution.

### Why do ISO 27001 quotes vary so much?

Because the work varies: headcount in scope, sites, systems, suppliers, what already exists and how fast you need to move. A £7,500 fixed-fee offer and a £25,000 programme are rarely the same product; the difference is senior time, writing around your business, and support at the audit itself.

### How much does ISO 27001 cost after the first year?

The certification body charges a smaller surveillance fee in years two and three, typically £1,500 to £3,000 a year for a small organisation, with a larger recertification audit at the end of the cycle. Ongoing support to keep the ISMS running starts from £1,250 a month with ISO Security, though many organisations assign an internal owner and buy help only for internal audit and audit preparation.

### Can we do ISO 27001 ourselves to save the consultancy fee?

Yes: for a very small organisation with time and confidence it can be the right route, and the cash saving is real. The cost moves into staff time (commonly 100 to 200 hours) and into risk, because a weak risk assessment or Statement of Applicability causes avoidable audit findings; a middle route is doing the work yourselves with periodic senior review and an independent internal audit.

### Does ISO Security charge a day rate?

Implementation is quoted as a fixed fee once scope is established, so you know the investment before committing, and ad-hoc senior support outside a programme is £1,250 a day. The readiness discussion that establishes scope is undertaken without charge, because both sides need to understand each other before any financial commitment.

## Contact

Want an informed view of what it would cost you? Arrange a readiness discussion ([contact ISO Security](/contact) or email info@isosecurity.co.uk) and I will explain the requirements, understand your objectives, likely scope and timescale, and give you a fixed view of the investment required.