VaultISO 27001ISO 27001 certification cost in the UK: what 25–250 person firms pay
ISO 27001 · Guide

ISO 27001 certification cost in the UK: what 25–250 person firms pay

ISO 27001 certification cost

Harry WestFounder & CEO15 September 202310 min read
Inside This Article
How much does ISO 27001 certification cost in the UK?What drives the ISO 27001 certification audit fee?What are the four cost lines in ISO 27001 certification?What does the three-year ISO 27001 certification cycle cost?What does a worked ISO 27001 certification budget look like?What should an ISO 27001 certification quote include?How can you reduce ISO 27001 certification cost without weakening the certificate?Is ISO 27001 certification worth the cost?Frequently asked questions
Book a discovery call

Key takeaways

For a UK firm with 25–250 staff, the accredited certification audit usually runs 7 to 14 audit days, which is roughly £8,750 to £21,000 at the day rates quoted publicly in 2026. Surveillance audits then cost about a third of that each year. Implementation support, tooling and internal time sit on top, and internal time is the line most budgets underestimate.

Audit days
The certification body sets audit time from the number of people doing work under your control, using the ISO/IEC 27006-1 audit-time rules, then adjusts for complexity and risk.
Day rates
Accredited certification bodies in the UK quote rather than publish prices. Publicly reported 2026 market rates sit at roughly £1,250 to £1,500 per auditor day, before VAT.
Surveillance years
IAF guidance puts each annual surveillance audit at about one third of the initial audit time, with recertification at no less than two thirds of a fresh initial audit.
Accreditation
A UKAS-accredited certificate can be verified on UKAS CertCheck and is what buyers usually expect. A cheaper unaccredited certificate often fails procurement and must be replaced.

The board will approve ISO 27001 once someone puts a number in front of it. You have three quotes, each built differently, and none of them mentions the hours your team will spend. This guide is for UK founders, finance leads and accidental security owners at firms with 25 to 250 staff.

It explains what ISO 27001 certification cost is made of, how certification bodies price the audit, and what the three-year cycle adds up to. By the end you will have a defensible budget, not a guess.

How much does ISO 27001 certification cost in the UK?

For a UK firm with 25 to 250 staff, the accredited ISO 27001 certification audit typically runs 7 to 14 audit days. At the £1,250 to £1,500 day rates publicly quoted in 2026, that is roughly £8,750 to £21,000 for Stage 1 and Stage 2, before implementation support, tooling and your own team's time.

That range covers the certification body only. It is the most predictable line in the budget, because it follows a published method rather than a sales conversation.

The full first-year ISO 27001 certification cost has four lines:

  • The certification body, for the Stage 1 and Stage 2 audits.
  • Implementation support, if you bring in outside help to build the management system.
  • Tooling, for policy management, evidence collection and monitoring.
  • Internal time, for the people who design, run and evidence the controls.

The last line never appears on a quote, and it is the one most budgets get wrong.

What drives the ISO 27001 certification audit fee?

The ISO 27001 certification audit fee is audit days multiplied by the certification body's day rate. Audit days come from the audit-time rules in ISO/IEC 27006-1, which start from the number of people doing work under your control, then adjust for complexity and risk. Headcount sets the baseline; your scope and your readiness move it.

ISO/IEC 27006-1:2024 is the standard accredited certification bodies follow when they audit and certify an information security management system. It replaced ISO/IEC 27006:2015 and its 2020 amendment.

The headcount that matters is broader than your payroll. The European co-operation for Accreditation guidance on ISO/IEC 27006-1:2024 audit time quotes the standard's basis as the total number of persons doing work under the organisation's control, irrespective of location. Contractors and freelancers inside your scope count.

The table below shows the audit-time bands most UK certification bodies quote from for the initial audit. Treat it as a planning baseline, not a quote: a certification body can adjust the figure for documented reasons such as low complexity or a narrow scope.

People in scopeInitial audit days (Stage 1 + Stage 2)Indicative fee at £1,250–£1,500 a day
16–257£8,750–£10,500
26–458.5£10,600–£12,800
46–6510£12,500–£15,000
66–8511£13,800–£16,500
86–12512£15,000–£18,000
126–17513£16,300–£19,500
176–27514£17,500–£21,000

Day rates are the other variable. No UKAS-accredited certification body we know of publishes a rate card for ISO 27001; prices arrive as quotes. Publicly reported market rates for 2026 cluster between £1,250 and £1,500 per auditor day, usually before VAT and travel.

Three things move a quote within a band:

  • Scope. More services, entities or sites in scope means more to sample.
  • Complexity. Regulated data, heavy software development or many critical suppliers add time.
  • Readiness. A certification body that sees a mature, well-evidenced system at Stage 1 has no reason to plan extra days at Stage 2.
Free Resource - ISO 27001

The ISO 27001 readiness checklist

Ninety-eight controls mapped to what an assessor actually asks for, in the order they ask it. Written by practitioners who took our ISMS through certification.

AvailablePDF21 pages
  • how to define your ISMS scope
  • the risk-assessment and treatment evidence trail,
  • your Statement of Applicability and residual-risk positions, and
  • the supplier, access-control, and operational-evidence questions most teams miss.

DOC-27001-CHK · v2.4

We'll use your details to give you access to the resource you requested, plus occasional related content. Opt out any time — see our Privacy Notice.

What are the four cost lines in ISO 27001 certification?

The four cost lines in ISO 27001 certification are the certification body, implementation support, tooling and internal time. Only the first has a public pricing method. The other three depend on how much of the management system you already run, how much help you buy in, and whether evidence is collected by people or generated by systems.

Each line behaves differently, so budget them separately rather than as one number.

Cost lineWhat it pays forWhat drives itHow to estimate it
Certification bodyStage 1 and Stage 2 audits, then annual surveillancePeople in scope, complexity, day rateAudit days from the table above, multiplied by two or three accredited quotes
Implementation supportHelp designing the ISMS, the risk assessment, the policies and the internal auditHow much you build yourselvesA fixed scope of work agreed before you start, not open-ended days
ToolingPolicy management, evidence collection, monitoringNumber of systems and integrationsAnnual subscription quotes, set against the hours the tool removes
Internal timeOwners running controls, gathering evidence, sitting in auditsMaturity of existing practiceNamed owners with an agreed share of their week for the project

Implementation support is where quotes diverge most. Some firms buy a full build, others buy a gap analysis and run the rest themselves. The right answer depends on how much security practice you already have, not on headcount alone.

Tooling earns its place when it removes recurring work. A platform that stores policies but still needs someone to screenshot evidence every quarter adds a subscription without removing the hours.

Internal time is the cost nobody invoices. Someone has to own the ISMS scope, run the risk assessment, chase evidence and sit with the auditor. In our view, the projects that overrun are the ones where that person is given the title but not the hours.

What does the three-year ISO 27001 certification cycle cost?

An ISO 27001 certificate runs on a three-year cycle: the initial audit in year one, then a surveillance audit in each of the next two years. IAF guidance sets each surveillance audit at about one third of the initial audit time, and the recertification audit at no less than two thirds of a fresh initial audit.

The IAF ID 14 guidance on determining audit time records those proportions for information security management systems. UKAS guidance on IAF MD 5 adds that a surveillance or recertification audit is unlikely to take less than one audit day.

Applied to the headcount bands, the cycle looks like this:

People in scopeInitial audit (days)Each surveillance year (days)Recertification (days)Surveillance fee per year at £1,250–£1,500
16–2572.54.5£3,100–£3,800
26–458.535.5£3,800–£4,500
46–65103.56.5£4,400–£5,300
66–85113.57.5£4,400–£5,300
86–1251248£5,000–£6,000
126–175134.58.5£5,600–£6,800
176–275144.59.5£5,600–£6,800

Two practical points change the arithmetic:

  • Recertification is based on the organisation you are then, not the one you were. If headcount has doubled, the recertification audit is calculated from the larger number.
  • The certificate's cost does not end with the audits. Clause 9.2 requires an internal audit programme, and Clause 9.3 requires management review, every year of the cycle.

The internal audit can be run by your own people, provided they are competent and independent of the work they audit. Many firms at this size buy it in, because the person who built the controls cannot impartially audit them.

What does a worked ISO 27001 certification budget look like?

A worked ISO 27001 certification budget for a 60-person UK software firm starts with 10 initial audit days, then 3.5 surveillance days in each of the following two years. At £1,250 to £1,500 a day, the certification body costs roughly £21,250 to £25,500 across the full three-year cycle, before VAT and expenses.

Here is how that figure builds up, using the bands above:

  • Year one: 10 audit days for Stage 1 and Stage 2, or £12,500 to £15,000.
  • Year two: 3.5 surveillance days, or £4,375 to £5,250.
  • Year three: another 3.5 surveillance days, or £4,375 to £5,250.
  • Year four: recertification, calculated on the firm's headcount at that point. If the firm is still 60 people, about 6.5 days.

The certification body line is now fixed within a narrow range. The other three lines are where the firm's choices show up.

If the firm already runs single sign-on, managed devices, code review and a backup routine, most Annex A controls exist and need evidence rather than building. Implementation support then shrinks to the risk assessment, the Statement of Applicability, the policies and the internal audit. If those practices are missing, the controls have to be built first, and that is a technology and process cost before it is a compliance cost.

Tooling and internal time trade against each other. Every recurring evidence task a tool removes is an hour a control owner does not spend each quarter. Price the tool against those hours, not against the audit fee.

What should an ISO 27001 certification quote include?

An ISO 27001 certification quote should show the audit days for Stage 1, Stage 2, each surveillance audit and recertification, the day rate, and every additional charge. Without the day breakdown you cannot tell whether one quote is cheaper because the rate is lower or because the certification body has planned less audit time.

Ask every accredited certification body to itemise the same things, so the comparison is fair:

  • Audit days by stage, including how they were calculated from your headcount and scope.
  • The day rate, and whether it changes for surveillance years.
  • Expenses, including travel, subsistence and any remote-audit platform charges.
  • Administration fees, such as application, certificate issue or annual registration charges.
  • The accreditation, with the certification body's UKAS accreditation number and confirmation that ISO 27001 sits within its accredited scope.

A quote that cannot explain its own day count is not a cheaper quote. It is an unknown one.

How can you reduce ISO 27001 certification cost without weakening the certificate?

You reduce ISO 27001 certification cost by shrinking the work the auditor has to do, not by shrinking the assurance the certificate gives. That means a defensible scope, arriving at Stage 1 ready, evidence the systems generate themselves, and comparing accredited quotes on the same audit days. Cutting accreditation to save money usually costs more later.

The cuts that hold up under audit are these:

  1. Scope to what the buyer is buying. Cover the services and data your customers care about, and write a clear exclusion case for anything genuinely separate. A scope drawn too wide drags irrelevant systems through every audit.
  2. Arrive at Stage 1 ready. Run a gap analysis first and close the obvious gaps. Stage 1 findings that push back Stage 2 add calendar time and, often, extra audit days.
  3. Let the systems produce the evidence. Access reviews, change records, vulnerability scans and backups already leave records in your tools. Connect those to your ISMS instead of rebuilding them in spreadsheets each quarter.
  4. Compare quotes on the same audit days. A quote that is cheaper because it plans fewer days than the standard's method allows is a quote the certification body will have to justify.
  5. Fix nonconformities properly the first time. A major nonconformity at Stage 2 means follow-up audit time before the certificate is issued. A corrective action process that finds root causes stops the same finding recurring at surveillance.

The cheapest scope is the one your buyer accepts the first time.

Accreditation is the cut to avoid. UKAS explains that accreditation shows a certification body is technically competent to audit and certify, and that public and private organisations specify accredited certification in their contracts. Buyers can check an accredited certificate on UKAS CertCheck.

A certificate from an unaccredited body is a receipt, not an assurance.

Online certificates sold without an accredited audit look cheaper on the invoice. They tend to cost more when a procurement team rejects them and you pay for an accredited audit anyway.

Is ISO 27001 certification worth the cost?

ISO 27001 certification is worth the cost when trust is what stands between you and revenue. For B2B firms, it shortens security reviews and clears procurement gates. For regulated firms, it supports the licence to operate and insurability. The audit fee is modest next to one enterprise deal that stalls on a questionnaire.

The return rarely shows up as a line on the security budget. It shows up elsewhere in the business:

  • Sales cycles. A certificate answers dozens of due-diligence questions at once, so fewer deals wait on a questionnaire.
  • Tender eligibility. Contracts that specify accredited ISO 27001 certification are closed to firms without it.
  • Operational discipline. Named owners, a working risk register and tested incident response reduce the chance and cost of the incident itself.

The firms that get the most from the spend treat the ISMS as an operating system for trust, not a certificate to renew. If you are deciding whether to start, an implementation roadmap shows where the internal time goes, and the certification process shows what each audit stage asks of you.

Frequently asked questions

Usually not. Certification body quotes in the UK are normally stated before VAT, and travel and subsistence may be charged on top for on-site days. Ask each body to state VAT, expenses and any certificate or administration fees separately, so you compare like with like.

A remote audit removes travel and subsistence, but it does not reduce the audit days the certification body must plan. Audit time follows the people in scope and the complexity of the system, not the location of the auditor. The saving is in expenses, not the day count.

A narrower scope can reduce audit days, but only if the excluded part is genuinely separate and has no in-scope data or dependencies. Buyers also read the scope printed on the certificate. A scope that excludes the service they are buying will not clear their review, so the saving rarely survives contact with procurement.

A major nonconformity at Stage 2 blocks the certification decision until you have corrected it and the certification body has verified the fix. That verification usually means extra audit time, charged at the same day rate. Minor nonconformities need an accepted corrective action plan but do not normally stop certification.

Moving an accredited certificate to another accredited body is a recognised transfer rather than a fresh certification. The new body reviews your existing certificate, recent audit reports and any open nonconformities before taking it on. Price that review and the remaining audits in the cycle together when you compare offers.

Profile image for Harry West, Founder and CEO of GRCMANA
Author

Harry West

Harry is the founder of GRCMANA, he helps regulated service providers close the enterprise trust gap — turning GRC, cyber resilience and AI governance from paperwork exercises into shippable systems.

Standard engine

ISO 27001 reference directory.

Every control in this framework and the clause guides that sit above them, grouped by control domain. Open any entry for its control definition, implementation steps and the audit evidence it expects. Dimmed entries are planned.

ClausesThe management systemClause guides · 23 guides
Clause 4.1Understanding the organization and its context→Clause 4.2Understanding the needs and expectations of interested parties→Clause 4.3Determining the scope of the information security management system→Clause 4.4Information security management system→Clause 5.1Leadership and commitment→Clause 5.2Policy→Clause 5.3Organizational roles, responsibilities and authorities→Clause 6.1Actions to address risks and opportunities→Clause 6.2Information security objectives and planning to achieve them→Clause 7.1Resources→Clause 7.2Competence→Clause 7.3Awareness→Clause 7.4Communication→Clause 7.5Documented information→Clause 8.1Operational planning and control→Clause 8.2Information security risk assessment→Clause 8.3Information security risk treatment→Clause 9.1Monitoring, measurement, analysis and evaluation→Clause 9.2Internal audit→Clause 9.2Preparing for Your ISO 27001 Stage 2 Audit: A Practical Checklist→Clause 9.3Management review→Clause 10.1Continual improvement→Clause 10.2Nonconformity and corrective action→
A.5Organizational Controls37 guides
A.5.1Policies for information security→A.5.2Information security roles and responsibilities→A.5.3Segregation of duties→A.5.4Management responsibilities→A.5.5Contact with authorities→A.5.6Contact with special interest groups→A.5.7Threat intelligence→A.5.8Information security in project management→A.5.9Inventory of information and other associated assets→A.5.10Acceptable use of information and other associated assets→A.5.11Return of assets→A.5.12Classification of information→A.5.13Labelling of information→A.5.14Information transfer→A.5.15Access control→A.5.16Identity management→A.5.17Authentication information→A.5.18Access rights→A.5.19Information security in supplier relationships→A.5.20Addressing information security within supplier agreements→A.5.21Managing information security in the ICT supply chain→A.5.22Monitoring, review and change management of supplier services→A.5.23Information security for use of cloud services→A.5.24Information security incident management planning and preparation→A.5.25Assessment and decision on information security events→A.5.26Response to information security incidents→A.5.27Learning from information security incidents→A.5.28Collection of evidence→A.5.29Information security during disruption→A.5.30ICT readiness for business continuity→A.5.31Legal, statutory, regulatory and contractual requirements→A.5.32Intellectual property rights→A.5.33Protection of records→A.5.34Privacy and protection of PII→A.5.35Independent review of information security→A.5.36Compliance with policies, rules and standards for information security→A.5.37Documented operating procedures→
A.6People Controls8 guides
A.6.1Screening→A.6.2Terms and conditions of employment→A.6.3Information security awareness, education and training→A.6.4Disciplinary process→A.6.5Responsibilities after termination or change of employment→A.6.6Confidentiality or non-disclosure agreements→A.6.7Remote working→A.6.8Information security event reporting→
A.7Physical Controls14 guides
A.7.1Physical security perimeters→A.7.2Physical entry→A.7.3Securing offices, rooms and facilities→A.7.4Physical security monitoring→A.7.5Protecting against physical and environmental threats→A.7.6Working in secure areas→A.7.7Clear desk and clear screen→A.7.8Equipment siting and protection→A.7.9Security of assets off-premises→A.7.10Storage media→A.7.11Supporting utilities→A.7.12Cabling security→A.7.13Equipment maintenance→A.7.14Secure disposal or re-use of equipment→
A.8Technological Controls34 guides
A.8.1User endpoint devices→A.8.2Privileged access rights→A.8.3Information access restriction→A.8.4Access to source code→A.8.5Secure authentication→A.8.6Capacity management→A.8.7Protection against malware→A.8.8Management of technical vulnerabilities→A.8.9Configuration management→A.8.10Information deletion→A.8.11Data masking→A.8.12Data leakage prevention→A.8.13Information backup→A.8.14Redundancy of information processing facilities→A.8.15Logging→A.8.16Monitoring activities→A.8.17Clock synchronization→A.8.18Use of privileged utility programs→A.8.19Installation of software on operational systems→A.8.20Networks security→A.8.21Security of network services→A.8.22Segregation of networks→A.8.23Web filtering→A.8.24Use of cryptography→A.8.25Secure development life cycle→A.8.26Application security requirements→A.8.27Secure system architecture and engineering principles→A.8.28Secure coding→A.8.29Security testing in development and acceptance→A.8.30Outsourced development→A.8.31Separation of development, test and production environments→A.8.32Change management→A.8.33Test information→A.8.34Protection of information systems during audit testing→
OtherAdditional Guides7 guides
GuideISO 27001 Statement of Applicability: what it is, with a worked example→GuideISO 27001 implementation→GuideISO 27001 certification and audit process→GuideISO 27001 mandatory documents and records→GuideISO 27001 gap analysis→GuideISO 27001 certification cost→GuideISO 27001 Annex A controls→
ISO 27001 Accelerator

Ready to accelerate your path to certification?

Work with a Trust Architect to scope your ISMS, close the gaps, and get audit-ready — without stalling your roadmap.

Book a Call →
GRCMANA
  • About
  • Insights
  • Contact
Ask the Trust ArchitectBook a Call →
  • About
  • Insights
  • The Vault
    Compliance VaultCyber Essentials→ISO 27001→SOC 2→ISO 42001→
    Domain VaultGRC Fundamentals→Risk Management→AI Governance→GRC Engineering→
    Other ResourcesFree Tools→Templates→Newsletter→
  • Contact
Book a Call →Ask the Trust ArchitectFixed fee. ISO 27001 in as few as six weeks.
GRCMANA

Helping high-growth B2B tech startups close the Enterprise Trust Gap through security, governance, and AI resilience.

ISO 27001ISO 42001ISO 9001Cyber EssentialsEU AI Act ReadyNIST AI RMF

The Vault

GRC EngineeringAI GovernanceISO 27001ISO 42001All Vault Resources

Resources

BlogFree ToolsTemplatesNewsletter

Company

About GRCMANAContactPrivacy PolicyTerms & ConditionsCookie Policy
© 2025 GRCMANA · All rights reservedRegistered in England & Wales under company registration 16810805. VAT Registration 506308024