For a company of 26 to 125 people, ISO 27001 certification costs roughly €50,000 to €150,000 in the first year, all in. The certification audit itself is €12,000 to €22,500 of that, set by headcount. The rest is consultant support, your own staff time and fixing what the gap analysis finds. After year one, the audit costs about a third of that each year.
This guide covers the audit fee by company size, the three-year cycle, what consultants charge, the four costs no quote includes, three realistic budgets, and how to spend less.
| Cost line | Typical range | When you pay it |
|---|---|---|
| Certification body (Stage 1 and Stage 2) | €7,000 to €26,000, by headcount | Year one, then surveillance every year |
| Consultant or external support | €6,000 to €45,000 | Mostly year one |
| Your own people (0.3 to 0.6 FTE) | €25,000 to €65,000 | Year one, then less |
| Remediation and tooling | A few thousand to €35,000 and up | Year one, licences after |
| Internal audit, if bought in | €4,000 to €12,000 | Every year |
| Penetration test | €4,000 to €10,000 | Every year |
How much does the ISO 27001 certification audit cost?
The audit is the one cost with a published structure behind it. Audit duration is set by the accreditation rules your certification body works under (ISO/IEC 27006), and it scales with the number of people in scope.
| Employees in scope | Certification audit days | Typical fee at European day rates |
|---|---|---|
| 1 to 10 | 5 | €7,000 to €9,000 |
| 11 to 15 | 6 | €8,500 to €11,000 |
| 16 to 25 | 7 | €10,000 to €13,000 |
| 26 to 45 | 8.5 | €12,000 to €16,000 |
| 46 to 65 | 10 | €14,500 to €19,000 |
| 86 to 125 | 12 | €17,500 to €22,500 |
| 176 to 275 | 14 | €20,500 to €26,000 |
Auditor day rates in Western Europe sit at roughly €1,200 to €1,600 and have risen sharply in the last two years. Stage 1 takes 20 to 30 per cent of the days, Stage 2 the rest.
Headcount, not revenue, sets the price. A forty-person company with ten million in revenue pays the same audit fee as a forty-person company with two million. If you are hiring through the certification year, the band you are quoted in January may not be the band you are audited in.
Scope reduces days. Audit duration is calculated on the people inside the ISMS scope, not the whole company. It is the largest lever you control, and it is decided months earlier when you draw the boundary, which is why scope and the Statement of Applicability deserve more attention than they usually get.
Is ISO 27001 a one-time cost?
No. A certificate runs on a three-year cycle, and the honest number to take to a board is the three-year total.
| Year | Audit | Cost relative to year one |
|---|---|---|
| 1 | Stage 1 and Stage 2 | 100% |
| 2 | Surveillance | about 33% |
| 3 | Surveillance | about 33% |
| 4 | Recertification | about 67% |
A company of 50 people quoted €16,000 for certification is really looking at about €27,000 of certification body fees over the first three years, and around €10,700 more for recertification in year four. The internal audit and management review also come round every year, so the programme never drops to zero.
How much does an ISO 27001 consultant cost?
Consultant support for an SME runs from about €6,000 for coaching and templates to €45,000 for someone managing the whole programme. The range is mostly about how much of the work stays with you, not about quality.
A consultant quote reliably includes the gap analysis, the risk assessment method, the Statement of Applicability, the policy set and preparation for the audit. It reliably excludes fixing anything the gap analysis finds. That is why budgets built from a consultant quote come in at half the eventual cost.
What costs are not in any ISO 27001 quote?
1. Your own people, the largest line
A programme in a company of this size takes 0.3 to 0.6 of a full-time equivalent across the certification year, spread over an ISMS owner, process owners, IT and management. At a loaded cost of €80,000 to €110,000 per head, that is €25,000 to €65,000 of internal time.
It never appears on an invoice, so it rarely appears in a budget. It is also the line that decides whether the project finishes on time, because it is the one that gets deprioritised when a customer escalation lands in month four.
2. The remediation the gap list produces
The gap analysis is priced. Closing the gaps is not. In companies without a security function the same items come back: multi-factor authentication beyond the main identity provider, centralised logging, endpoint management, backups that have been restored in a test, and a joiner and leaver process that runs every time.
This line runs from a few thousand euros of licences to a serious infrastructure project. It has the widest variance, so quantify it before you sign anything. That is what a Security Audit ahead of the programme is for.
3. Internal audit, and the independence problem
Clause 9.2 requires internal audits, and auditors must not audit their own work. In a company of forty people, the person who built the management system is often the only one who understands it, and therefore the one person who cannot audit it.
You can train a second person, use another function or group entity, or buy it in. External internal audit for an SME scope runs €4,000 to €12,000 a year, every year.
4. Penetration testing and technical assurance
ISO 27001 does not mandate a penetration test. Auditors do ask about technical vulnerability management under control A.8.8, and for most software and service companies a test is the practical answer, especially when customers ask for the report anyway. Budget €4,000 to €10,000 a year.
How much does ISO 27001 cost in total?
Year one, all in, for a company of 26 to 125 employees:
| Budget shape | Certification body | External support | Internal time | Remediation and tooling | Year one total |
|---|---|---|---|---|---|
| Lean, strong starting position | €14,000 | €8,000 | €25,000 | €5,000 | about €52,000 |
| Typical SME | €16,000 | €22,000 | €40,000 | €18,000 | about €96,000 |
| Consultant-led, weak starting position | €18,000 | €45,000 | €55,000 | €35,000 | about €153,000 |
Internal audit and a penetration test, if you buy them in, add €8,000 to €22,000 a year on top.
The figure people quote each other for a mid-market SME is €50,000 to €80,000. It is roughly the middle row with internal time left out. Whether that spend is the right one is a separate question, answered in is €50K for ISO 27001 worth it.
How can you reduce the cost of ISO 27001?
Most overspend comes from three patterns.
- Paying consultants to write, then paying again to redo. Policies written by someone outside the business describe a company that does not exist. At Stage 2 the auditor asks the people named in them what they do, and the gap becomes a finding. Writing takes hours. Rewriting takes months.
- Running the calendar in the wrong order. The management system has to have run for about three months before Stage 2 for the evidence to exist. Teams that polish the documents first and start the evidence clock afterwards add a quarter. The sequence is in how long ISO 27001 really takes.
- Treating 93 controls as 93 projects. Most of Annex A is already partly happening and needs recording rather than building. Sorting the controls by the kind of work they need removes weeks, as set out in the Annex A controls grouped for real work.
There is also a version of the programme that comes in at the bottom of every range: a hard-narrowed scope, a template set, the minimum evidence period, the cheapest accredited body, and no technical remediation. It works, and the certificate is genuine. What it leaves is a control set that is documented rather than operating: a monthly scan nobody reads satisfies A.8.8, logs nobody queries satisfy A.8.15, and a written procedure can satisfy A.8.16 while nothing is watching. The certificate answers the customer’s question. It does not tell you whether you would notice an intrusion.
The cheaper route is to separate documentation gaps from technical gaps before the programme starts, close the technical ones with tooling that produces its own evidence, and let the audit record what is running. That is how we run ISO 27001, and the version for a company with no security team is in ISO 27001 without a security team.
Does NIS2 change the ISO 27001 budget?
Only if you run them as two projects. NIS2 asks for the cybersecurity risk-management measures in Article 21, and most of them map onto Annex A controls you are implementing for ISO 27001 anyway. Run one programme, keep one set of evidence, and the second framework costs a fraction of the first. The mapping is in ISO 27001 and NIS2, once instead of twice.
ISO 27001 budget checklist
- Count the people inside the scope, not the company, and find your audit-day band.
- Get at least two quotes from bodies accredited for ISO/IEC 27001.
- Budget three years: the certification audit, two surveillance audits at about a third each, recertification at about two thirds.
- Put a number on internal time: 0.3 to 0.6 FTE for the certification year.
- Price the remediation before you sign a consultant, with a gap analysis or a security audit.
- Decide who runs the internal audit, and budget it every year.
- Budget a penetration test if customers ask for the report.
- If NIS2 applies to you, plan one programme for both.
Frequently asked questions
How much does ISO 27001 certification cost for a small company?
The certification audit for a company of 1 to 10 people is about 5 audit days, or €7,000 to €9,000 at Western European day rates. The total depends far more on internal time and remediation than on the audit fee.
Is ISO 27001 a one-time cost?
No. A certificate runs on a three-year cycle: the certification audit in year one, a surveillance audit in years two and three at about a third of the initial audit time each, and a recertification audit in year four at about two thirds. Internal audit and management review happen every year.
How much does an ISO 27001 surveillance audit cost?
About a third of the initial certification audit, because accreditation rules set surveillance time at roughly one third of the initial audit time. A company that paid €16,000 for certification should budget around €5,300 for each surveillance year.
Does NIS2 require ISO 27001 certification?
No. NIS2 requires the cybersecurity risk-management measures in Article 21, not a certificate. ISO 27001 is the most common way to put those measures in place and show it, so a company doing both can budget one programme rather than two.
Is an ISO 27001:2013 certificate still valid?
No. The transition period for certificates issued against the 2013 edition ended on 31 October 2025. Every valid certificate is now issued against ISO/IEC 27001:2022.
