ISO 27018 cost: what certification costs a cloud provider

The invoice from the certification body is only one part. Anyone budgeting for ISO 27018 should count four items, because the others often exceed the audit fee.

Consulting

Optional, but common. A consultant helps you map your processing of personal data, write the procedures and prepare for the audit.

Certification audit

The fee of the certification body for the initial audit, including auditor days and travel.

Internal effort

Time of your own people: IT, the data protection lead, management. It does not appear on any invoice, but it is real money.

Recurring costs

Yearly surveillance audits and a recertification once the certificate cycle ends.

ISO 27018 adds privacy controls for processors to an information security system, and in the classic route it is normally audited as an extension of ISO 27001. If you do not yet run such a system, the build-up is part of your bill.

The following figures are indicative ranges for a small or medium cloud provider. Quotes from certification bodies differ by scope, number of sites and employees. For a certification audit, expect roughly CHF 4,000 to 12,000. Consulting, if you use it, often falls between CHF 5,000 and 25,000. A surveillance audit in the following years is typically cheaper than the first audit, roughly CHF 2,000 to 6,000.

Request at least two written quotes and ask what is included. Auditor days, report writing and travel are sometimes priced separately.

• Guide on certification cost

The table sets the cost items side by side. Figures for the classic route are indicative ranges, not offers.

A certificate is not a purchase you make once and then forget. In the classic route, the three-year cycle looks like this:

1. 01

   Year 1: certification audit

   Stage 1 and stage 2 audits, followed by the report and the certificate.

2. 02

   Years 2 and 3: surveillance audits

   The certification body returns every year to check that the controls still work. Each visit is invoiced.

3. 03

   After year 3: recertification

   A fuller audit starts a new cycle. Plan the budget and the internal time for it early.

Zertify charges CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. For customers in Switzerland and Liechtenstein, the price includes 8.1% Swiss VAT.

You start with the self-assessment: 32 yes/no questions. Eleven of them are mandatory requirements of the standard and must all be answered yes. Among the other 21 questions you need at least 14 yes answers. If you pass and pay, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment first. Every certificate can be checked publicly by number and QR code, so your customer sees it on the verification page.

Payment is an automatic yearly subscription. You can cancel it at any time in your customer account, effective at the end of the current year. The certificate then ends with the paid year. Buying needs no account. If you also want ISO 27001 or ISO 27017, you get 20% off for two standards and 30% off for three or more, on the yearly fee as well.

• ISO 27018 at Zertify
• Pricing
• Start the free self-assessment

Some customers write into the contract that an auditor must visit your premises. If a tender or a customer audit demands exactly that, the classic route with an on-site audit by a certification body is the answer, and its cost belongs in your price calculation.

In other cases the supplier questionnaire only asks for a certificate that the purchasing department can verify. Then an online certificate with a public verification page can meet the requirement at a fraction of the cost. Check the wording of the request before you decide.

• Compare the certification routes
• Certification without an on-site audit