What ISO 27001 certification actually costs in 2026
UK-based organisations of 50 to 250 staff pursuing first-time ISO 27001 certification typically spend £18,000 – £55,000 in year one. The page below breaks down where that range comes from, what drives the variance, and how surveillance audits in years two and three change the picture.
Ranges are practitioner-sourced from public certification body disclosures, partner-programme price lists and engagement histories. The full sourcing notes are on the methodology page.
Where the budget goes
Five components account for almost all year-one ISO 27001 spend. The relative share shifts with company size: under 50 staff, tooling and remediation dominate; over 250 staff, audit and implementation effort scale faster than tooling. Each card below links through to the driver page where the assumptions and worked examples sit.
Day rate × day count, body tier (UKAS top vs mid).
SME range. Multi-site or complex scope shifts the upper band materially.
ISMS lead time, policy authoring, internal audit programme.
Falls 25 to 30 percent where SOC 2 or ISO 9001 is already in place.
Per-FTE platform contracts, scaling with company size.
Year 2 spend largely persists at this rate, not just year 1.
Findings from gap assessment, weighted toward technical controls.
The line item that most often overruns the original budget paper.
30 to 40 percent of initial Stage 2 fee, plus tooling persistence.
Recertification in year 4 returns close to the original Stage 2 figure.
Sanity-check your scenario
Enter a few facts about the organisation and the calculator returns a defensible year-one range, the surveillance cost in years two and three, and the three-year total. Math is transparent on the methodology page and the full version with multi-site and certification-body tier inputs lives on the calculator page. No email is captured to release the result.
- Stage 1 + Stage 2 audit fees£5,800 – £17,600
- Implementation effort£6,100 – £18,700
- Tooling (GRC, evidence)£3,200 – £9,900
- Remediation£2,900 – £8,800
The three-year cost view
Most public cost guidance quotes year one only and treats the ongoing audit cycle as a footnote. The certification cycle is in fact three years, with an additional recertification audit in year four. The shape below is the typical pattern for a 50 to 250 staff UK organisation with a mid-tier UKAS-accredited body. See the annual maintenance page for the full picture.
Two contexts that move the number meaningfully
Bundling with SOC 2
Teams pursuing ISO 27001 alongside SOC 2 Type II typically save 30 to 40 percent on the combined engagement, because the two frameworks share roughly 90 percent of their control overlap. The shared evidence base, shared policy authoring and shared internal audit effort compound across the year-one programme. The SOC 2 side of that calculation, including how Type I and Type II audits price separately, is detailed at soc2certificationcost.com. The bundling math, with worked examples, sits on the multi-standard page.
Existing operational maturity
Organisations with mature ITIL-aligned operations typically reach ISO 27001 readiness with around 30 to 40 percent less remediation work, because change management, incident response and access provisioning are already documented to a level the auditor can test against. The ITIL training and operational maturity cost picture is at itilcertificationcost.com. If you are not yet at that maturity level, the largest remediation line items are mapped on the remediation page.
A reference, not a sales asset
This site exists because every other top-ranking page on the ISO 27001 cost question is owned by someone selling something. The intent here is the opposite: publish defensible ranges, show the assumption set, source the figures, and let the reader make the decision. There is no email gate on the calculator. There is no chat widget. There is one advisory contact form on the methodology page, and one sentence about who runs the site.
If the quote in front of you sits inside the band on the page you have arrived at, it is reasonable. If it sits a long way outside, the cost-drivers page will tell you which assumption is moving the number. If you want a single defensible budget figure for a CFO conversation, the calculator will produce one and the methodology page will tell you how it was derived.