---
title: "ISO 27001 certification cost in the UK: what 25–250 person firms pay"
canonical: https://www.grcmana.io/vault/iso-27001/certification-cost
published: 2023-09-15
updated: 2026-10-20
author: "Harry West"
framework: "ISO 27001"
control: "Guide ISO 27001 certification cost"
journeyStage: fundamentals
---

# ISO 27001 certification cost in the UK: what 25–250 person firms pay

## Key takeaways

For a UK firm with 25–250 staff, the accredited certification audit usually runs 7 to 14 audit days, which is roughly £8,750 to £21,000 at the day rates quoted publicly in 2026. Surveillance audits then cost about a third of that each year. Implementation support, tooling and internal time sit on top, and internal time is the line most budgets underestimate.

- **Audit days** — The certification body sets audit time from the number of people doing work under your control, using the ISO/IEC 27006-1 audit-time rules, then adjusts for complexity and risk.
- **Day rates** — Accredited certification bodies in the UK quote rather than publish prices. Publicly reported 2026 market rates sit at roughly £1,250 to £1,500 per auditor day, before VAT.
- **Surveillance years** — IAF guidance puts each annual surveillance audit at about one third of the initial audit time, with recertification at no less than two thirds of a fresh initial audit.
- **Accreditation** — A UKAS-accredited certificate can be verified on UKAS CertCheck and is what buyers usually expect. A cheaper unaccredited certificate often fails procurement and must be replaced.

The board will approve ISO 27001 once someone puts a number in front of it. You have three quotes, each built differently, and none of them mentions the hours your team will spend. This guide is for UK founders, finance leads and accidental security owners at firms with 25 to 250 staff.

It explains what [ISO 27001](https://www.grcmana.io/vault/iso-27001) certification cost is made of, how certification bodies price the audit, and what the three-year cycle adds up to. By the end you will have a defensible budget, not a guess.

## How much does ISO 27001 certification cost in the UK?

For a UK firm with 25 to 250 staff, the accredited ISO 27001 certification audit typically runs 7 to 14 audit days. At the £1,250 to £1,500 day rates publicly quoted in 2026, that is roughly £8,750 to £21,000 for Stage 1 and Stage 2, before implementation support, tooling and your own team's time.

That range covers the certification body only. It is the most predictable line in the budget, because it follows a published method rather than a sales conversation.

The full first-year ISO 27001 certification cost has four lines:

- **The certification body**, for the Stage 1 and Stage 2 audits.
- **Implementation support**, if you bring in outside help to build the management system.
- **Tooling**, for policy management, evidence collection and monitoring.
- **Internal time**, for the people who design, run and evidence the controls.

The last line never appears on a quote, and it is the one most budgets get wrong.

## What drives the ISO 27001 certification audit fee?

The ISO 27001 certification audit fee is audit days multiplied by the certification body's day rate. Audit days come from the audit-time rules in ISO/IEC 27006-1, which start from the number of people doing work under your control, then adjust for complexity and risk. Headcount sets the baseline; your scope and your readiness move it.

[ISO/IEC 27006-1:2024](https://www.iso.org/standard/82908.html) is the standard accredited certification bodies follow when they audit and certify an information security management system. It replaced ISO/IEC 27006:2015 and its 2020 amendment.

The headcount that matters is broader than your payroll. The [European co-operation for Accreditation guidance on ISO/IEC 27006-1:2024 audit time](https://european-accreditation.org/sp_accordion_faqs/question-48-5-audit-time-determination-to-iso-iec-27006-12024-for-multisite-c-6/) quotes the standard's basis as the total number of persons doing work under the organisation's control, irrespective of location. Contractors and freelancers inside your scope count.

The table below shows the audit-time bands most UK certification bodies quote from for the initial audit. Treat it as a planning baseline, not a quote: a certification body can adjust the figure for documented reasons such as low complexity or a narrow scope.

| People in scope | Initial audit days (Stage 1 + Stage 2) | Indicative fee at £1,250–£1,500 a day |
| --- | --- | --- |
| 16–25 | 7 | £8,750–£10,500 |
| 26–45 | 8.5 | £10,600–£12,800 |
| 46–65 | 10 | £12,500–£15,000 |
| 66–85 | 11 | £13,800–£16,500 |
| 86–125 | 12 | £15,000–£18,000 |
| 126–175 | 13 | £16,300–£19,500 |
| 176–275 | 14 | £17,500–£21,000 |

Day rates are the other variable. No UKAS-accredited certification body we know of publishes a rate card for ISO 27001; prices arrive as quotes. Publicly reported market rates for 2026 cluster between £1,250 and £1,500 per auditor day, usually before VAT and travel.

Three things move a quote within a band:

- **Scope.** More services, entities or sites in scope means more to sample.
- **Complexity.** Regulated data, heavy software development or many critical suppliers add time.
- **Readiness.** A certification body that sees a mature, well-evidenced system at Stage 1 has no reason to plan extra days at Stage 2.

## What are the four cost lines in ISO 27001 certification?

The four cost lines in ISO 27001 certification are the certification body, implementation support, tooling and internal time. Only the first has a public pricing method. The other three depend on how much of the management system you already run, how much help you buy in, and whether evidence is collected by people or generated by systems.

Each line behaves differently, so budget them separately rather than as one number.

| Cost line | What it pays for | What drives it | How to estimate it |
| --- | --- | --- | --- |
| Certification body | Stage 1 and Stage 2 audits, then annual surveillance | People in scope, complexity, day rate | Audit days from the table above, multiplied by two or three accredited quotes |
| Implementation support | Help designing the ISMS, the risk assessment, the policies and the internal audit | How much you build yourselves | A fixed scope of work agreed before you start, not open-ended days |
| Tooling | Policy management, evidence collection, monitoring | Number of systems and integrations | Annual subscription quotes, set against the hours the tool removes |
| Internal time | Owners running controls, gathering evidence, sitting in audits | Maturity of existing practice | Named owners with an agreed share of their week for the project |

Implementation support is where quotes diverge most. Some firms buy a full build, others buy a [gap analysis](https://www.grcmana.io/vault/iso-27001/gap-analysis) and run the rest themselves. The right answer depends on how much security practice you already have, not on headcount alone.

Tooling earns its place when it removes recurring work. A platform that stores policies but still needs someone to screenshot evidence every quarter adds a subscription without removing the hours.

Internal time is the cost nobody invoices. Someone has to own the [ISMS scope](https://www.grcmana.io/vault/iso-27001/clause-4-3-determining-the-scope-of-the-information-security-management-system), run the risk assessment, chase evidence and sit with the auditor. In our view, the projects that overrun are the ones where that person is given the title but not the hours.

## What does the three-year ISO 27001 certification cycle cost?

An ISO 27001 certificate runs on a three-year cycle: the initial audit in year one, then a surveillance audit in each of the next two years. IAF guidance sets each surveillance audit at about one third of the initial audit time, and the recertification audit at no less than two thirds of a fresh initial audit.

The [IAF ID 14 guidance on determining audit time](https://iaf.nu/iaf_system/uploads/documents/IAF_ID14_2022_Issue1_25052022.pdf) records those proportions for information security management systems. [UKAS guidance on IAF MD 5](https://www.ukas.com/resources/technical-bulletins/iaf-md5-update/) adds that a surveillance or recertification audit is unlikely to take less than one audit day.

Applied to the headcount bands, the cycle looks like this:

| People in scope | Initial audit (days) | Each surveillance year (days) | Recertification (days) | Surveillance fee per year at £1,250–£1,500 |
| --- | --- | --- | --- | --- |
| 16–25 | 7 | 2.5 | 4.5 | £3,100–£3,800 |
| 26–45 | 8.5 | 3 | 5.5 | £3,800–£4,500 |
| 46–65 | 10 | 3.5 | 6.5 | £4,400–£5,300 |
| 66–85 | 11 | 3.5 | 7.5 | £4,400–£5,300 |
| 86–125 | 12 | 4 | 8 | £5,000–£6,000 |
| 126–175 | 13 | 4.5 | 8.5 | £5,600–£6,800 |
| 176–275 | 14 | 4.5 | 9.5 | £5,600–£6,800 |

Two practical points change the arithmetic:

- **Recertification is based on the organisation you are then, not the one you were.** If headcount has doubled, the recertification audit is calculated from the larger number.
- **The certificate's cost does not end with the audits.** Clause 9.2 requires an [internal audit programme](https://www.grcmana.io/vault/iso-27001/clause-9-2-internal-audit), and Clause 9.3 requires [management review](https://www.grcmana.io/vault/iso-27001/clause-9-3-management-review), every year of the cycle.

The internal audit can be run by your own people, provided they are competent and independent of the work they audit. Many firms at this size buy it in, because the person who built the controls cannot impartially audit them.

## What does a worked ISO 27001 certification budget look like?

A worked ISO 27001 certification budget for a 60-person UK software firm starts with 10 initial audit days, then 3.5 surveillance days in each of the following two years. At £1,250 to £1,500 a day, the certification body costs roughly £21,250 to £25,500 across the full three-year cycle, before VAT and expenses.

Here is how that figure builds up, using the bands above:

- **Year one:** 10 audit days for Stage 1 and Stage 2, or £12,500 to £15,000.
- **Year two:** 3.5 surveillance days, or £4,375 to £5,250.
- **Year three:** another 3.5 surveillance days, or £4,375 to £5,250.
- **Year four:** recertification, calculated on the firm's headcount at that point. If the firm is still 60 people, about 6.5 days.

The certification body line is now fixed within a narrow range. The other three lines are where the firm's choices show up.

If the firm already runs single sign-on, managed devices, code review and a backup routine, most Annex A controls exist and need evidence rather than building. Implementation support then shrinks to the risk assessment, the Statement of Applicability, the policies and the internal audit. If those practices are missing, the controls have to be built first, and that is a technology and process cost before it is a compliance cost.

Tooling and internal time trade against each other. Every recurring evidence task a tool removes is an hour a control owner does not spend each quarter. Price the tool against those hours, not against the audit fee.

## What should an ISO 27001 certification quote include?

An ISO 27001 certification quote should show the audit days for Stage 1, Stage 2, each surveillance audit and recertification, the day rate, and every additional charge. Without the day breakdown you cannot tell whether one quote is cheaper because the rate is lower or because the certification body has planned less audit time.

Ask every accredited certification body to itemise the same things, so the comparison is fair:

- **Audit days by stage**, including how they were calculated from your headcount and scope.
- **The day rate**, and whether it changes for surveillance years.
- **Expenses**, including travel, subsistence and any remote-audit platform charges.
- **Administration fees**, such as application, certificate issue or annual registration charges.
- **The accreditation**, with the certification body's UKAS accreditation number and confirmation that ISO 27001 sits within its accredited scope.

A quote that cannot explain its own day count is not a cheaper quote. It is an unknown one.

## How can you reduce ISO 27001 certification cost without weakening the certificate?

You reduce ISO 27001 certification cost by shrinking the work the auditor has to do, not by shrinking the assurance the certificate gives. That means a defensible scope, arriving at Stage 1 ready, evidence the systems generate themselves, and comparing accredited quotes on the same audit days. Cutting accreditation to save money usually costs more later.

The cuts that hold up under audit are these:

1. **Scope to what the buyer is buying.** Cover the services and data your customers care about, and write a clear exclusion case for anything genuinely separate. A scope drawn too wide drags irrelevant systems through every audit.
2. **Arrive at Stage 1 ready.** Run a gap analysis first and close the obvious gaps. Stage 1 findings that push back Stage 2 add calendar time and, often, extra audit days.
3. **Let the systems produce the evidence.** Access reviews, change records, vulnerability scans and backups already leave records in your tools. Connect those to your ISMS instead of rebuilding them in spreadsheets each quarter.
4. **Compare quotes on the same audit days.** A quote that is cheaper because it plans fewer days than the standard's method allows is a quote the certification body will have to justify.
5. **Fix nonconformities properly the first time.** A major nonconformity at Stage 2 means follow-up audit time before the certificate is issued. A [corrective action process](https://www.grcmana.io/vault/iso-27001/clause-10-2-nonconformity-and-corrective-action) that finds root causes stops the same finding recurring at surveillance.

The cheapest scope is the one your buyer accepts the first time.

Accreditation is the cut to avoid. [UKAS explains](https://www.ukas.com/accreditation/standards/certification-body-accreditation/) that accreditation shows a certification body is technically competent to audit and certify, and that public and private organisations specify accredited certification in their contracts. Buyers can check an accredited certificate on [UKAS CertCheck](https://www.ukas.com/certcheck).

A certificate from an unaccredited body is a receipt, not an assurance.

Online certificates sold without an accredited audit look cheaper on the invoice. They tend to cost more when a procurement team rejects them and you pay for an accredited audit anyway.

## Is ISO 27001 certification worth the cost?

ISO 27001 certification is worth the cost when trust is what stands between you and revenue. For B2B firms, it shortens security reviews and clears procurement gates. For regulated firms, it supports the licence to operate and insurability. The audit fee is modest next to one enterprise deal that stalls on a questionnaire.

The return rarely shows up as a line on the security budget. It shows up elsewhere in the business:

- **Sales cycles.** A certificate answers dozens of due-diligence questions at once, so fewer deals wait on a questionnaire.
- **Tender eligibility.** Contracts that specify accredited ISO 27001 certification are closed to firms without it.
- **Operational discipline.** Named owners, a working risk register and tested incident response reduce the chance and cost of the incident itself.

The firms that get the most from the spend treat the ISMS as an operating system for trust, not a certificate to renew. If you are deciding whether to start, an [implementation roadmap](https://www.grcmana.io/vault/iso-27001/implementation) shows where the internal time goes, and the [certification process](https://www.grcmana.io/vault/iso-27001/certification-process) shows what each audit stage asks of you.

## Frequently asked questions

### Is VAT and auditor travel included in an ISO 27001 certification quote?

Usually not. Certification body quotes in the UK are normally stated before VAT, and travel and subsistence may be charged on top for on-site days. Ask each body to state VAT, expenses and any certificate or administration fees separately, so you compare like with like.

### Does a remote ISO 27001 audit cost less?

A remote audit removes travel and subsistence, but it does not reduce the audit days the certification body must plan. Audit time follows the people in scope and the complexity of the system, not the location of the auditor. The saving is in expenses, not the day count.

### Can we lower the ISO 27001 certification cost by certifying only part of the business?

A narrower scope can reduce audit days, but only if the excluded part is genuinely separate and has no in-scope data or dependencies. Buyers also read the scope printed on the certificate. A scope that excludes the service they are buying will not clear their review, so the saving rarely survives contact with procurement.

### What happens to the cost if we fail the Stage 2 audit?

A major nonconformity at Stage 2 blocks the certification decision until you have corrected it and the certification body has verified the fix. That verification usually means extra audit time, charged at the same day rate. Minor nonconformities need an accepted corrective action plan but do not normally stop certification.

### Does the ISO 27001 certification cost change if we switch certification body?

Moving an accredited certificate to another accredited body is a recognised transfer rather than a fresh certification. The new body reviews your existing certificate, recent audit reports and any open nonconformities before taking it on. Price that review and the remaining audits in the cycle together when you compare offers.