ISO 27001 cost: what you pay and where it adds up

Certification is not a single invoice. On the classic route, the cost falls into five groups, and the audit is only one of them.

Consulting

External help to build the ISMS, run the risk assessment and write the policies. Optional, but common in companies without a security officer.

Certification audit

Stage 1 and stage 2 audits by a certification body, on site or partly remote.

Internal effort

Working hours of IT, management and HR. This cost never appears on an invoice.

Tools and measures

Annex A controls may require new tools or licences, for example backup, access management or awareness training.

Recurring audits

Surveillance audits in the years after certification and a recertification audit at the end of the cycle.

• Guide: what certification costs

Certification bodies set their own fees, so there is no list price. The ranges below are indicative for a company with a small team and one site. Your quote can sit well outside them.

Your own people carry the largest share of the work. The standard asks for six things, and none of them can be bought as a finished product.

1. 01

   Assess information security risks

   List your assets and threats. The result decides which Annex A controls you implement and why.

2. 02

   Define a security policy and objectives

   Management signs them, and they must match what the company actually does.

3. 03

   Implement the selected controls

   The 2022 edition covers cloud services, data protection and cyber risks, among others.

4. 04

   Prepare the Statement of Applicability

   Every control is marked as applied or excluded, with a reason.

5. 05

   Train employees

   Staff need to know the policy and their part in it.

6. 06

   Manage security incidents

   Record incidents, deal with them and feed the lessons back into the controls.

A classic ISO 27001 certificate runs on a three-year cycle. A surveillance audit takes place each year, and a recertification audit closes the cycle. Each brings an auditor's invoice and the staff time to prepare evidence.

Clause 9, performance evaluation, adds work of its own. The standard expects internal audits and a management review to be repeated, not completed once before the first audit.

A cost plan should therefore show years two and three next to year one.

Zertify costs CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. Customers in Switzerland and Liechtenstein pay 8.1% Swiss VAT, already included. You do not need an account to buy.

You answer 48 yes/no questions online. 13 of them are mandatory requirements of the standard and must all be yes. Of the other 35, at least 24 must be yes. After you pass and pay, the certificate arrives within 4 hours. G6 Agency AG issues it under licence from SICE, and SICE reviews every assessment before that. There is no on-site audit.

Each certificate has a number and a QR code. Your customer opens the public verification page and checks it. The certificate is valid for 3 years and is confirmed every year by the short online re-audit.

Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. Two standards earn a 20% discount and three or more earn 30%, also on the yearly fee.

• ISO 27001 certificate
• Pricing
• Start the free self-assessment

Read the request that made you look at ISO 27001. If a supplier questionnaire or tender asks for an on-site audit by a certification body, the classic route is the answer, and the budget above applies.

If it asks for a verifiable ISO 27001 certificate, the number, QR code and verification page are built for that. Where you are unsure, ask your customer's purchasing department before you spend on either route.

• Compare the certification routes
• Certification without an on-site audit