How much does ISO 27001 certification cost? A 2026 UK guide
What ISO 27001 certification actually costs in the UK — audit fees, consultancy, tooling and internal time — with indicative ranges by company size and practical ways to bring the number down.
The Obligara team ·
"How much does ISO 27001 cost?" is the first question most teams ask, and the honest answer is: it depends — mostly on your size, your scope, and how you choose to get there. But "it depends" is not useful when you are trying to build a business case, so this guide breaks the cost into its real parts, gives indicative UK ranges, and shows where the money actually goes.
Indicative figures only
The numbers below are realistic UK ranges to help you budget — not quotes. Actual cost varies with headcount, the number of sites, the scope you certify, and your starting maturity. Always get quotes from two or three UKAS-accredited certification bodies.
The four costs of ISO 27001
Certification is not a single invoice. Budget for four buckets:
- Certification body (CB) audit fees — the accredited auditor who assesses you and issues the certificate. Priced on auditor-days, which scale with your headcount and scope.
- Getting ready — how you build the ISMS: a consultant, compliance software, or internal effort (usually a mix).
- Internal time — your team's hours writing policies, running the risk assessment, and gathering evidence. The largest hidden cost, and the easiest to underestimate.
- Remediation — the security tools or fixes the gap analysis surfaces (MFA, logging, backup, endpoint protection). Highly variable; often you already have most of it.
Certification body audit fees
The CB audit happens in two stages — Stage 1 (a documentation and readiness review) and Stage 2 (the main certification audit) — followed by shorter surveillance audits in years one and two, then recertification in year three. Fees are driven by auditor-days, which scale with your employee count and the complexity of your scope.
| Organisation size | Indicative Stage 1 + Stage 2 (initial) | Indicative annual surveillance |
|---|---|---|
| Micro (1–10 staff) | £3,000 – £6,000 | £1,000 – £2,500 |
| Small (11–50 staff) | £5,000 – £10,000 | £2,000 – £4,000 |
| Medium (51–250 staff) | £8,000 – £16,000+ | £3,000 – £6,000+ |
These are for UKAS-accredited certification — the kind buyers and tenders trust. Non-accredited "certificates" are cheaper and are generally not worth having.
Getting ready: consultant vs software vs DIY
This is the bucket you control, and the choice drives most of the total.
- Consultant-led — a specialist builds the ISMS with you. Typical UK engagements run £5,000 – £20,000+ depending on size and how much they do versus advise. Fastest hand-holding; the most expensive, and the knowledge can walk out of the door with them.
- Compliance software — a platform instantiates the framework, tracks evidence and readiness, and keeps the system live after certification. Usually an annual subscription rather than a project fee, and it keeps paying back at surveillance and recertification time.
- Fully DIY — cheapest in cash, most expensive in internal time and risk of false starts. Viable for a very small, security-mature team.
Most teams land on software plus a light-touch consultant or internal owner — enough structure to move fast without paying project rates for the whole build.
The three-year cost, not just year one
The classic budgeting mistake is pricing only the initial audit. ISO 27001 runs on a three-year cycle: initial certification, a surveillance audit in year one, another in year two, and recertification in year three. Factor the surveillance fees and the ongoing internal effort of keeping the ISMS live — which is exactly where a platform that maintains evidence continuously earns its keep versus a consultant project that ends when the certificate arrives.
How to bring the cost down
- Tighten your scope. Certify the part of the business that needs it, not everything. A smaller, well-defined scope means fewer auditor-days.
- Measure the gap first. A free ISO 27001 readiness check shows what you already have and what is missing, so you do not pay a consultant to discover it.
- Reuse evidence across frameworks. If you will also pursue SOC 2, Cyber Essentials or ISO 42001, the controls overlap — our ISO 27001 → SOC 2 cross-walk shows 71 mappings that avoid rebuilding the same evidence twice.
- Keep the ISMS live, not frozen. Evidence that stays current is cheaper to surveil than a system you rebuild before each audit.
Frequently asked questions
How much does ISO 27001 cost for a small business in the UK?
For a small UK company (roughly 11–50 staff), a realistic all-in first-year figure — accredited audit plus getting ready — commonly lands somewhere between £10,000 and £30,000, depending heavily on how you prepare and how mature your controls already are. The certification-body audit itself is usually the smaller share; preparation is the larger one.
How long does ISO 27001 certification take?
Typically three to twelve months from a standing start, depending on your maturity and how much time you can commit. Well-prepared teams using software often reach Stage 2 in a few months.
Is UKAS-accredited certification worth the extra cost?
Yes. Accredited certification is the version buyers, auditors and tenders recognise. A cheaper non-accredited certificate rarely satisfies a procurement requirement, so it is usually money wasted.
Does compliance software replace a consultant?
Often, yes — or it shrinks the consultant's role. Software instantiates the framework, tracks evidence and readiness, and keeps the ISMS live, which is most of what a consultant charges for. Some teams keep a consultant for a short review before Stage 2.
Get a realistic picture of your position
Before you ask for quotes, find out how far you actually are. The free ISO 27001 readiness check scores you against the standard in a few minutes with no account. Then see how our ISO 27001 module turns that into tracked work, or book a walkthrough on your own scope.
This article is general budgeting guidance, not a quote or certification advice. Costs vary by certification body, scope and organisation.