The short answer
ISO 27001 cost in the UK splits into consultancy, certification audits and internal effort. Published UK prices we reviewed in September 2026 put the Stage 1 and Stage 2 audit at £3,000 to £8,000, each annual surveillance audit at £1,000 to £3,000 and consultant packages at £8,000 to £25,000: roughly £13,000 to £39,000 over three years.
On this page
- How much does ISO 27001 certification cost?
- ISO 27001 cost estimator: work out your own budget
- What makes up the cost of ISO 27001 certification?
- ISO 27001 certification cost by company size
- How much does the ISO 27001 audit cost?
- What are the annual costs after certification?
- How much do ISO 27001 consultants charge?
- What hidden ISO 27001 implementation costs should you budget for?
- What affects the price of ISO 27001 certification?
- How long does ISO 27001 certification take?
- How can you reduce the cost of ISO 27001?
- Why Sovereign Secure
- Get a fixed ISO 27001 quote
ISO 27001 certification cost in the UK has three parts: the certification body’s audits, any consultancy you buy to get ready, and your own team’s time. In published prices from UK providers we reviewed in September 2026, the initial Stage 1 and Stage 2 audit ran £3,000 to £8,000, surveillance audits £1,000 to £3,000 a year, and consultancy packages £8,000 to £25,000.
Many cost guides show only half the bill: certification bodies publish audit fees, consultancies publish packages. You pay both, and the certification body again in years two and three. This guide puts every line item in one place.
How much does ISO 27001 certification cost?
Combining the published ranges, a consultant-led project costs roughly £13,000 to £39,000 in external fees over the first three years. A self-implemented project can cost far less in cash, but you pay for it in staff time.
| Route | Year 1 | Years 2 and 3 | Three-year external fees |
|---|---|---|---|
| Consultant-led, lower end | £8,000 package + £3,000 certification audit | 2 × £1,000 surveillance | about £13,000 |
| Consultant-led, upper end | £25,000 package + £8,000 certification audit | 2 × £3,000 surveillance | about £39,000 |
| Self-implemented | about £114 for the standard + £3,000 to £8,000 audit | 2 × £1,000 to £3,000 surveillance | about £5,100 to £14,100, plus significant staff time |
These totals are arithmetic from the published ranges, not a quote. They leave out staff time, new tools, penetration testing and remediation, and you should check whether any quote includes VAT. Large and multi-site organisations can sit well above them: one UK compliance platform’s published bands reach £30,000 to £100,000 for its largest size band.
ISO 27001 cost estimator: work out your own budget
You can build an indicative three-year budget from the same published UK ranges. Pick the row in each step that fits you best, then add up the figures.
| Step | Your situation | Figure to use |
|---|---|---|
| 1. The standard | Everyone | About £114 |
| 2. Initial audit (Stage 1 and 2) | Small team, one site, simple scope | Towards £3,000 |
| 2. Initial audit (Stage 1 and 2) | More people, several sites, or a complex scope such as software development, hosting or many suppliers | Towards £8,000 |
| 3. Two surveillance audits (years 2 and 3) | Small team, one site, simple scope | Towards £2,000 for both |
| 3. Two surveillance audits (years 2 and 3) | More people, several sites or a complex scope | Towards £6,000 for both |
| 4. Consultancy | An experienced security lead in-house who will run the project | No fees, but significant staff time |
| 4. Consultancy | A lead in-house who needs help with the hard parts | £400 to £1,000 for each consultant day you buy |
| 4. Consultancy | Starting from scratch, or a fixed customer deadline | £8,000 to £25,000 for a fixed package |
| 5. Security testing | Internet-facing systems or software you build (Annex A 8.8 and 8.29) | Add a penetration test; see our penetration testing cost guide |
Two worked examples, using only the figures above:
- Lower end: one site, a simple scope and ten consultant days: £114 + £3,000 + £2,000 + £4,000 to £10,000 = about £9,100 to £15,100 over three years.
- Upper end: several sites, a complex scope and a full package at the top of the range: £114 + £8,000 + £6,000 + £25,000 = about £39,100 over three years.
Your starting point moves the consultancy line most. If you already hold Cyber Essentials or PCI DSS, or already run security processes with records, you need fewer consultant days. An ISO 27001 gap analysis tells you which consultancy row you are really in before you commit budget. For a figure based on your actual scope rather than published ranges, ask us for a quote.
What makes up the cost of ISO 27001 certification?
Five line items appear on invoices; internal costs never do.
| Cost item | Who you pay | Published UK range | When |
|---|---|---|---|
| Copy of ISO/IEC 27001:2022 | Standards body | about £114 | Once |
| Consultancy (gap analysis, ISMS build, internal audit support) | Consultant | £8,000 to £25,000 packages, or £400 to £1,000 a day | Mostly year 1 |
| Initial certification audit (Stage 1 + Stage 2) | Certification body | £3,000 to £8,000 | Year 1 |
| Surveillance audits | Certification body | £1,000 to £3,000 each | Years 2 and 3 |
| Recertification audit | Certification body | No figure published in our review; longer than a surveillance audit, shorter than Stage 1 + 2 | Before the certificate expires |
| Staff time, tools, testing and training | Internal and suppliers | Varies with scope and gaps | Throughout |
You can buy the standard itself from ISO or a national standards body. The £114 figure is the price quoted in one UK guide we reviewed.
Stage 1 checks the design of your information security management system (ISMS): scope, risk assessment, Statement of Applicability, policies, and evidence that an internal audit and management review have taken place. It decides whether you are ready for Stage 2.
Stage 2 tests whether the ISMS actually works. Auditors interview staff, sample records and check the controls listed in your Statement of Applicability. Any major nonconformity must be closed before the certificate is issued, which can add follow-up audit time to the bill.
ISO 27001 certification cost by company size
Company size is one of the biggest cost drivers. Certification bodies set audit days from the number of people working within your ISMS scope, following ISO/IEC 27006, the standard that governs ISMS certification bodies.
| Company size | Published band (one UK compliance platform) | Why it costs what it does |
|---|---|---|
| Smaller organisations | £3,000 to £10,000 | Fewer people, systems and suppliers; audit days at the low end; often one site |
| Mid-sized organisations | £9,000 to £40,000 | More departments and suppliers to bring into the ISMS; more consultancy days to write and embed processes |
| Larger organisations | £30,000 to £100,000 | Multiple sites, more complex scope, longer Stage 2 with site sampling, often a dedicated ISMS manager |
| Surveillance, any size | £1,000 to £3,000 a year | Shorter annual audits that sample part of the ISMS each year |
Providers draw headcount thresholds differently, so treat these bands as a guide, not a price list.
How much does the ISO 27001 audit cost?
Every certified organisation pays for the initial certification audit. Published UK prices we reviewed ranged from £3,000 to £8,000 for Stage 1 and Stage 2 together, and one certification body’s own cost guide quoted £3,675 to £4,425 for initial certification.
ISO 27001 certification fees are driven by auditor days, which depend on:
- the number of people in scope;
- the number of sites, and whether audits are on site or remote;
- how complex your technology and outsourcing arrangements are.
Before you compare quotes, ask which accreditation body stands behind each certificate and check that it matches what your customers or tenders ask for. A cheap certificate that your largest customer will not accept is the most expensive option.
What are the annual costs after certification?
An ISO 27001 certificate lasts three years, provided you pass a surveillance audit in years two and three. In the published UK prices we reviewed, each surveillance audit cost £1,000 to £3,000.
| Year | Certification body | Your ongoing work |
|---|---|---|
| Year 1 | Stage 1 and Stage 2 audits (£3,000 to £8,000) | Implementation, internal audit, management review |
| Year 2 | Surveillance audit (£1,000 to £3,000) | Internal audit, management review, risk review, security testing |
| Year 3 | Surveillance audit (£1,000 to £3,000), then recertification before expiry | As year 2, plus preparing for recertification |
The standard requires internal audits (clause 9.2) and management reviews (clause 9.3) at planned intervals, and certification bodies expect to see both each year. You can run the internal audit yourself if you have a competent, impartial person, or outsource it; see our ISO 27001 internal audit service.
How much do ISO 27001 consultants charge?
UK ISO 27001 consultants charge £400 to £1,000 a day, according to published figures we reviewed. Fixed implementation packages from one UK provider came in three tiers: £8,000, £12,000 to £15,000 and £18,000 to £25,000.
| Model | Published range | Best for | Watch out for |
|---|---|---|---|
| Day rate | £400 to £1,000 a day | Teams with an in-house lead who need targeted help | Days that keep growing if scope drifts |
| Fixed package | £8,000 to £25,000 | Most first-time certifications | Check whether internal audit, audit-day support and surveillance years are included |
| Self-implementation | About £114 for the standard, plus tools and time | Organisations with an experienced security lead | Stage 1 findings that delay the certificate |
You do not need a consultant to certify. Certification bodies must stay impartial, so they will audit your ISMS but will not design it for you; that is the consultant’s job. A fixed-price ISO 27001 gap analysis is the cheapest way to find out how much help you actually need, and our ISO 27001 consultancy page explains how we take you from gap analysis to certificate.
What hidden ISO 27001 implementation costs should you budget for?
Invoices show only part of the cost of ISO 27001 implementation. Budget for these as well:
- Staff time. Someone has to own the ISMS, and IT, HR and leadership all give time to the risk assessment, policies, training, internal audit and the audit days themselves.
- Remediation and tools. Whatever gaps the risk assessment finds need fixing: device management, backups, logging, access reviews or supplier assessments. Some teams also buy a compliance platform to manage evidence.
- Security testing. Annex A 8.8 and 8.29 expect you to find and fix technical weaknesses. One UK provider published external infrastructure tests at £3,750 to £6,250+ and web application tests at £6,250 to £10,000+. Our penetration testing cost guide explains what drives these prices, and our ISO 27001 penetration testing page covers what auditors expect to see.
- Training and awareness. Clause 7.3 and control 6.3 require staff awareness, and you need records to prove it.
- Travel and follow-up. On-site audit days can carry travel costs, and major nonconformities can mean a return visit.
What affects the price of ISO 27001 certification?
| Cost driver | Why it changes the price | How to keep it down |
|---|---|---|
| People in scope | Sets auditor days and the number of staff to train | Scope the ISMS to what your customers actually need certified |
| Number of sites | More locations to visit or sample | Ask whether parts of the audit can be remote |
| Scope complexity | Software development, hosting and many suppliers bring more Annex A controls into play | Agree a clear scope statement early |
| Existing controls | Mature IT and existing certifications mean fewer consultancy days | Reuse evidence you already have |
| Deadline | A compressed timeline needs more consultant days at once and an early audit booking | Start before a tender deadline forces you to |
| Documentation approach | Generic template packs look cheap but take rework to fit how you operate | Write policies for how you actually work |
How long does ISO 27001 certification take?
For a small or mid-sized organisation, expect three to nine months from gap analysis to certificate. A rushed project concentrates consultant days; a longer one spreads the work.
| Phase | What happens | Who you pay |
|---|---|---|
| 1. Gap analysis | Assess against clauses 4 to 10 and the 93 Annex A controls | Consultant, or internal time |
| 2. Scope, risk assessment and Statement of Applicability | Decide what is in scope and which controls apply | Consultant and internal time |
| 3. Implementation | Policies, procedures and controls put in place | Internal time, tools, consultant |
| 4. Operate the ISMS | Generate the records auditors will sample | Internal time |
| 5. Internal audit and management review | Mandatory before Stage 2 | Internal time or outsourced auditor |
| 6. Stage 1 and Stage 2 audits | Documentation review, then effectiveness audit | Certification body |
| 7. Surveillance, years 2 and 3 | Annual sampling audits | Certification body |
How can you reduce the cost of ISO 27001?
- Start with a gap analysis so you only pay consultants to close the gaps you actually have.
- Scope sensibly. Certify the services your customers buy rather than the whole group, as long as the scope still makes sense to the people asking for the certificate.
- Reuse Cyber Essentials evidence. The five Cyber Essentials controls (firewalls, secure configuration, user access control, malware protection and security update management) feed straight into Annex A controls such as 8.7, 8.8, 8.9 and 8.20. See our Cyber Essentials certification prices and the Cyber Essentials vs ISO 27001 comparison.
- Reuse PCI DSS work. Risk assessments, policies, logging and penetration test reports produced for PCI DSS can support your ISMS evidence. Our comparison of PCI DSS vs ISO 27001 maps each PCI DSS requirement to Annex A.
- Plan ISO 27001 and SOC 2 together. If US customers also want a SOC 2 report, one risk assessment and one control set can serve both, and most of your ISO 27001 evidence carries over to the CPA firm’s examination. See ISO 27001 vs SOC 2 for how the two compare, our guide to SOC 2 compliance for what the examination adds and what drives its cost, and SOC 2 Type 1 vs Type 2 for which report to start with.
- Start from free templates, then tailor them. Our free ISO 27001 toolkit has a policy template and spreadsheets for the checklist, Statement of Applicability and risk register, which saves drafting days as long as you adapt them to how you work.
- Build internal audit skills so each year’s internal audit does not need outside help.
- Get one quote for both halves. Pricing consultancy and certification audits together shows you the whole cost before you commit.
Why Sovereign Secure
Sovereign Secure Ltd is an ISO 27001 certified UK consultancy and an IASME-licensed Cyber Essentials certification body. ISO certification audits are carried out by our partner certification body, MQA International.
- We hold the certificate ourselves. We go through the same surveillance audits we prepare you for.
- Consultancy and audit, kept separate. We prepare you; MQA International audits you. We can quote both together so you see the full cost up front, while the audit stays independent.
- Evidence that works across standards. As a PCI SSC Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, and a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, we map ISO 27001 to PCI DSS and Cyber Essentials so one set of evidence serves several.
- UK-based since 2012, headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.
Get a fixed ISO 27001 quote
We do not publish ISO 27001 prices, because headcount, sites and scope change the answer more than anything else. For a fast, fixed quote, tell us:
- how many people work within the scope you want certified;
- how many sites or offices are involved;
- which products, services or systems the certificate must cover;
- any existing certifications, such as Cyber Essentials or PCI DSS;
- your deadline, for example a tender or customer contract date.
Request your ISO 27001 quote or call +44 161 523 5276.
- The standard
- £114
- Initial audit (Stage 1 and 2)
- £3,000
- Two surveillance audits (years 2 and 3)
- £2,000
- Consultancy (10 days at £400 to £1,000)
- £4,000 to £10,000
Your next step
- ISO 27001 checklistClause-by-clause readiness and a Stage 1 and Stage 2 audit checklist, free in Excel.Get the checklist
- Statement of Applicability templateAll 93 Annex A controls in a free spreadsheet, with a worked example.Get the SoA template
- Get an ISO quoteConsultancy from an ISO 27001-certified firm, with audits through our partner certification body, MQA International.Get an ISO quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
