Why is ISO 27001 so expensive?

A customer sends over a security questionnaire. Somewhere on page three is the question nobody wants to see: are you ISO 27001 certified?

So you ring round for quotes, and the numbers come back somewhere between uncomfortable and ridiculous.

I've worked with security standards for longer than I care to admit. The question small businesses ask me most isn't "how do we do it?" It's "why does it cost so much?" The honest answer: the standard isn't the expensive part. The way the market delivers it is.

Where does the money actually go?

ISO 27001 costs come in three layers. If you want the line-by-line figures, our ISO 27001 certification cost guide breaks them down. Here's the short version.

The certification body. This is the UKAS-accredited firm that audits you and issues the certificate. Their fees are largely fixed, and I'll come back to why.

The consultant. Someone has to build your Information Security Management System (ISMS). Consultant-led implementations typically run from £5,000 to £20,000, depending on size.

Software or document packs. Compliance platforms, template toolkits, policy packs. Some are useful. Some are a folder of Word documents with your logo missing.

Add those together and it's a big number. But the bigger problem is what happens after the certificate arrives.

Why are certification audits so long for small businesses?

Auditors don't decide how long your audit takes. Certification bodies work from the IAF mandatory day tables, which UKAS-accredited bodies have to follow. Headcount drives most of the calculation.

In practice, even a small business is looking at around 4.5 days of external auditor time across Stage 1 and Stage 2. Call it £4,500 before you've spent a penny on anything else. Stage 1 alone is often 1.5 days.

For a simple system in a small company, 1.5 days of Stage 1 is massive overkill. Stage 1 is a readiness check. Is the system scoped, documented and ready for the main audit? A one or two hour pre-review would tell an auditor most of what they need to know, and could bring Stage 1 down to half a day.

To be fair, I understand why the tables look the way they do. They have to cover the worst case: a poorly designed, overly complex system that takes days to unpick. There is some room to adjust for low complexity, but in my experience it rarely moves the number much.

There's also no reduction for a system built and managed by an experienced consultant, even though that's exactly where an auditor has the least to dig through. I think there should be.

We can't change the tables. Neither can you. So the savings have to come from everywhere else.

The real cost driver: systems you can't run yourself

This is where most small businesses lose money.

A consultant builds your ISMS. It has dozens of policies, a risk methodology that needs its own training course, and a register nobody outside the project understands. You pass the audit. The consultant leaves.

Then year two arrives. The surveillance audit is booked, an internal audit is due, and the risk register hasn't been touched since certification. So the consultant comes back to run the internal audit, refresh the risk assessment and sit in on the external audit, because they're the only person who can explain how the system works.

Across the three-year cycle, that can easily add another £10,000 to £20,000.

That isn't a security programme. It's a subscription you didn't know you'd signed up for.

A complex ISMS doesn't make you more secure. It makes you more dependent. A good system should be simple enough for the people running the business to run it. If it isn't, the complexity is a cost, not a sign of quality. If you're comparing providers, here's how to choose an ISO 27001 consultant.

What does ISO 27001 cost over three years?

Comparing implementation quotes is the wrong comparison. Your certificate lasts three years. Over that time you'll have annual surveillance audits, a recertification audit at the end, and an internal audit programme to keep running.

So compare the full three years. For a typical consultant-led route, before certification body fees:

• Implementation: £5,000 to £20,000
• Internal audits, ongoing support and audit attendance in years two and three: £10,000 to £20,000
• Software or document packs: often several thousand over the cycle

That puts most small businesses somewhere between £15,000 and £40,000 or more, with certification body fees on top. Those fees are the same whichever route you take.

Is there a cheaper way to get ISO 27001?

For small businesses, yes. Not by cutting corners on the audit. By cutting the complexity.

That's why we've launched ISO 27001 on ComplyOrbit, for teams under 100. Your ISMS is built and run on the platform. Our team carries out your internal audits. Your system is kept certification ready every month, with three years of expert oversight included.

It's a fixed monthly fee that tops out at £649 a month for teams of up to 99, plus a one-off £1,000 setup fee, on a 36-month plan. Over three years that's around £24,400 for implementation, the platform, every internal audit and ongoing support.

For new implementations, we guarantee you pass first time or you don't pay. We have a 100% success rate in UKAS audits.

What it doesn't include is the certification body's fees. Nobody can make those disappear, and anyone who suggests otherwise is selling something.

It's also not for everyone. If you have more than 100 people, multiple sites or a complicated scope, a tailored implementation will probably suit you better.

Frequently asked questions

Why does a small business need 4.5 days of ISO 27001 audit time?

Certification bodies calculate audit days from the IAF mandatory day tables, mainly based on headcount. The tables are designed to cover complex systems, so simple systems in small companies often get more audit time than they need. There is limited room to adjust it.

What is the cheapest way to get ISO 27001 certified?

Keep the system simple enough to run yourself, and compare total cost over the three-year certification cycle rather than the implementation quote. Most hidden cost comes from paying consultants to maintain systems that are too complex to run in-house.

Is a compliance platform enough on its own?

Usually not. A platform gives you structure, but it doesn't decide your risks, run your internal audits or fix your controls. Platforms work best with experienced people behind them.

Are certification body fees included in fixed-price ISO 27001 plans?

Normally not. UKAS-accredited certification bodies charge you directly, and their fees apply whichever implementation route you choose. Always check what a quote includes before you compare prices.

Doing it differently

If you're under 100 people and the quotes you've had so far made you wince, see how ISO 27001 on ComplyOrbit works. If you're not sure it fits, book a short call and we'll tell you straight.