ISO 27017 cost: what you pay and where the money goes

There is no list price for ISO 27017. The total depends on the route you choose, the size of your company and how much of your cloud security is already documented. A software company with one hosted product has a different bill from a hosting provider with several data centres.

Five items make up the cost: the audit itself, external consulting, your own staff time, technical measures you still have to put in place, and the recurring fees in the years after the first certificate. Most budgets underestimate the third and the fifth.

The ranges in this guide are indicative. They describe the order of magnitude, not an offer from any certification body. Ask for written quotes before you commit to the classic route.

• Guide: what ISO certification costs
• ISO 27017 at a glance

In the classic route a certification body sends auditors to your premises or into your systems. ISO 27017 is usually assessed together with ISO 27001, as an extension of the information security management system. The quote therefore depends on the combined scope.

Certification body audit

Indicative range: CHF 4,000 to 12,000 for a small or medium company. Auditor days, travel and the certificate fee are billed separately in many quotes.

Consulting

Indicative range: CHF 5,000 to 20,000 if you hire help for the cloud risk analysis, the shared responsibility matrix and the policies. Companies with in-house security staff often skip this item.

Technical measures

Unknown until the gap analysis is done. Tenant segregation, logging of administrator access, a deletion procedure for customer data and hardened virtualisation can each trigger engineering work.

Internal effort

Indicative range: 15 to 40 working days spread over the project. Section 3 explains who carries them.

A consultant invoice is easy to see. The hours of your own people are not. Someone has to write down who handles what between you and your cloud provider or your customers, gather evidence for the auditor and sit through interviews.

In a typical small company that someone is the IT lead or the managing director, next to the daily work. Ten days of an IT lead cost more than they look on a timesheet, because the tickets and releases wait.

If you provide cloud services, the cloud-specific risk analysis and the clear split of responsibilities between you and your customers take the most thought. If you only use cloud services, the work is smaller but still has to be documented.

• ISO for small and medium businesses

A classic certificate is valid for three years, but it is not paid for once. The certification body returns for surveillance audits in between, normally every year. Indicative range: CHF 2,500 to 8,000 per visit, depending on scope.

After three years the certificate has to be renewed through a recertification audit. Its effort is comparable to the first audit, indicative CHF 4,000 to 10,000, and your staff must again prepare evidence.

Add the maintenance that sits behind every audit: reviewing risks, updating the responsibility matrix when a provider changes, and keeping incident records. These are working hours, not invoices, but they recur every year.

Zertify costs CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. Over the three years of validity that is CHF 1,857 (€1,857). Swiss VAT of 8.1% is included for customers in Switzerland and Liechtenstein, and you do not need an account to buy.

The certificate is based on an online self-assessment. There is no on-site audit and no consultant. G6 Agency AG issues it under licence from SICE, and SICE reviews every assessment before the certificate is issued.

1. 01

   Answer 34 yes/no questions

   Twelve of them are mandatory requirements of the standard and must all be answered yes. Of the other 22, at least 15 must be yes.

2. 02

   Pay once the assessment is passed

   The subscription starts with the first-year price. You can cancel at any time in the customer account, effective at the end of the current year.

3. 03

   Receive the certificate within 4 hours

   The PDF carries a number and a QR code. Anyone, for instance a purchasing department, can check it on the public verification page.

• Start the free self-assessment
• See all prices
• The ISO 27017 standard page

The table sets the indicative classic figures next to the Zertify price. Classic figures are ranges, not quotes, and depend on scope.

• Compare the certification routes
• Certification without an on-site audit