The certification audit is only one line in an ISO 27001 budget, and for a small company it is often the smallest. For a small US organization, the initial audit by an accredited certification body usually lands between $2,000 and $5,000 and climbs with headcount, according to Factorial’s 2026 cost guide. Consulting, tooling and your own team’s hours are what move the total. This guide splits the cost into its real parts, shows what drives each one and gives you a method for building a budget you can defend to finance.
TL;DR
- Budget four buckets, not one: the certification audit, implementation help, tools, and internal staff time.
- For small US organizations, the initial audit typically runs $2,000 to $5,000 and rises with headcount. Consulting runs from about $4,000 for a very small business to more than $40,000 for a mid-sized one (Factorial).
- Internal time is the most underestimated line. A company of 15 to 30 people can expect several hundred hours.
- Year one is not the whole bill. Annual surveillance audits and upkeep follow, so plan a three-year view.
- Get quotes on the same scope and the same audit-day count, or you will compare offers that are not equivalent.
Table of Contents
- The four buckets behind every ISO 27001 budget
- Certification audit fees: Stage 1, Stage 2 and what sets the price
- Surveillance audits and recertification: the cost after year one
- Implementation costs: the biggest swing factor
- Internal time: the line item no quote shows
- A worked example of a three-year budget
- How to lower the bill without cutting corners
- Our perspective
- Build your own estimate
- FAQ
- Sources
The four buckets behind every ISO 27001 budget
Most “ISO 27001 cost” articles quote one big range. That range hides four different kinds of spending, each with its own logic and its own owner inside your company.
| Bucket | What it pays for | Who controls it | Typical behavior |
|---|---|---|---|
| Certification audit | Stage 1 and Stage 2 audits by an accredited certification body, then yearly surveillance | Certification body | Priced by audit days, driven by headcount and scope |
| Implementation support | Gap analysis, risk assessment, policy drafting, training, internal audit prep | Consultant or your own team | Widest range; depends on how much you do yourself |
| Tools and technology | Compliance or evidence-collection software, security controls you were missing | You | Recurring subscription or one-off purchase |
| Internal time | Hours from IT, HR, legal, operations and leadership | You | Rarely appears in any quote |
Factorial’s cost breakdown draws the same three-way line between consulting, the audit and internal team time, and warns that lumping them together is the most common mistake. It leads buyers to compare quotes that are not equivalent. Keep them separate from the first spreadsheet row.
Certification audit fees: Stage 1, Stage 2 and what sets the price
The certification audit is done by a certification body. In the US, the bodies that certify to ISO 27001 are accredited through the ANSI National Accreditation Board (ANAB). Using an accredited body matters because that accreditation is what gives your certificate weight with customers and procurement teams. If you want to see who is on the list and how to compare them, our guide to ISO 27001 certification bodies in the USA walks through it.
The audit happens in two stages:
- Stage 1 is a documentation and readiness review. The auditor checks that your ISMS is designed properly: scope, risk assessment, Statement of Applicability, policies.
- Stage 2 is the main audit. The auditor checks that the controls you documented are actually operating, through interviews, records and sampling.
A small organization will usually see a total of $2,000 to $5,000 for the initial audit, per Factorial. Published ranges for larger or more complex organizations are much higher, and different sources disagree, which is why you should not rely on a single number from a blog. The reliable answer is a written quote from two or three accredited bodies.
What drives the audit quote
Certification bodies price by auditor days. Everything below changes the number of days:
- Headcount in scope. More people and more roles to interview means more days.
- Number of sites. Each extra office or data center in scope adds sampling work.
- Scope complexity. A single SaaS product with one cloud environment is simpler than a company with on-premises systems, development, support and outsourced operations.
- Maturity at audit time. Findings that need follow-up visits cost extra.
- Remote or on-site delivery. Travel and expenses can show up as a separate line.
Ask each body for the audit days they have assigned and the daily rate, not just the total. That is the only way to compare quotes fairly.
Surveillance audits and recertification: the cost after year one
Certification is not a one-time purchase. After the initial audit, the certification body returns for surveillance audits in the years that follow, and the certificate then has to be renewed through a fuller recertification audit. Surveillance audits are usually smaller than the initial one because they sample part of the ISMS rather than all of it, but they still carry a fee every year.
The less visible cost is the work between audits: internal audits, management reviews, risk reassessment, access reviews, supplier checks, training refreshes and fixing nonconformities. Our three-year TCO analysis of ISO 27001 maintenance puts that ongoing cost in a range of $8,000 to $50,000, depending on organization size and how much of the upkeep is automated.
Practical consequence: when someone asks “what does ISO 27001 cost?”, the honest answer is a three-year figure. A budget that stops at the Stage 2 invoice will be short by the time the first surveillance audit arrives.
Implementation costs: the biggest swing factor
Before any auditor arrives, you have to build the ISMS. That means defining scope, running a risk assessment, writing or adapting policies, selecting controls, training staff and running an internal audit. Most first-time companies pay for outside help with part or all of it.
Factorial puts US consulting costs from roughly $4,000 for a very small business to more than $40,000 for a mid-sized company. The spread is wide because the work is wide. A consultant who gives you templates and reviews your work is a different purchase from one who runs the whole project.
Three common ways to buy help
- Advisory only. An expert reviews your gap analysis, risk method and documents, and coaches your lead. Lowest spend, highest internal effort.
- Guided implementation. The consultant drafts documents and runs workshops while your team supplies the facts. Middle cost, middle effort.
- Done-for-you. The consultant carries most of the work. Highest spend, lowest internal effort, but you still need people in the room for interviews and evidence.
If you are weighing these, our breakdown of a 6 to 12 month plan and the real costs of outsourcing shows which tasks tend to be worth handing off. A practical cybersecurity guide for small and mid-sized businesses can also help you decide which basic controls you should already have in place before you pay anyone to write policies around them.
Tools and technology
Some organizations buy compliance software to track controls, collect evidence and manage policies. Others run the ISMS in shared documents and a ticketing system. Neither is automatically right. What matters is that the tool budget is explicit and that the subscription is counted for all three years, not just the first.
Separately, the gap analysis may show missing technical controls: multi-factor authentication coverage, endpoint management, logging, backup testing, vulnerability scanning. Those are real purchases, but they improve your security whether or not you certify, so label them clearly as “remediation” and keep them out of the certification line.
Internal time: the line item no quote shows
Your own staff hours rarely appear in a vendor proposal, yet they can outweigh the audit fee. Factorial says a company of 15 to 30 employees should expect several hundred hours, and calls internal time the line item that gets underestimated the most.
Where the hours go:
- Project lead: coordinating, chasing owners, keeping the plan on track.
- IT and engineering: access reviews, asset inventory, logging, backup evidence, technical fixes.
- HR: onboarding and offboarding procedures, screening, training records.
- Leadership: approving scope, risk appetite and policies, attending management review.
- Everyone: security awareness training and being available for audit interviews.
Put a loaded hourly rate on those hours. If a project lead spends a quarter of their time for six months, that is a real cost even though no invoice arrives. Our guide to IT team roles in ISO 27001 helps you assign the work so it does not all land on one person.
A worked example of a three-year budget
The figures below are an illustration of the method, not a quote or a benchmark. Swap in your own numbers. Imagine a 40-person SaaS company with one product and one cloud environment.
| Line | Year 1 | Year 2 | Year 3 |
|---|---|---|---|
| Certification body fees | Initial audit quote | Surveillance quote | Recertification quote |
| Consulting | Quoted scope | Light advisory, if any | Light advisory, if any |
| Tooling | Subscription | Subscription | Subscription |
| Remediation purchases | From gap analysis | Small | Small |
| Internal hours x loaded rate | Highest | Lower | Medium |
The shape is what to notice. Year one carries the build. Year two is the cheapest. Year three rises again because recertification is a larger audit than a surveillance visit. Finance teams like seeing this curve on paper before the project starts.
How to lower the bill without cutting corners
- Narrow the scope honestly. Certify the product and the teams that run it, not every system the company owns. A smaller scope means fewer audit days and fewer documents. It must still reflect what customers care about.
- Reuse existing work. Companies that already hold a SOC 2 Type 2 report have documented many of the same controls. One industry compilation estimates savings of 20% to 40% on first-year cost, though that is a rough figure, so confirm it with your own gap analysis.
- Run a gap analysis first. It tells you which controls exist, which are partial and which are missing, so you buy only the help you need.
- Get at least two audit quotes on the same scope. Specify headcount, sites, and the audit days you expect.
- Plan upkeep from day one. Assign owners and calendar the recurring tasks so surveillance year is routine, not a scramble.
For a deeper look at the variables, see our breakdown of ISO 27001 cost drivers for small and mid-sized businesses, and for a mid-sized organization, the effort estimate and timeline.
Our perspective
Most budget overruns we see in ISO 27001 planning do not come from the audit. They come from a plan that never separated the four buckets, so nobody noticed that internal time, tooling and year-two upkeep were missing.
We built ISMS Calculator around that problem. You enter company size, industry and security maturity, and the estimate updates in real time. The assumptions are visible and editable, so you can challenge any number instead of trusting a black box. The methodology is versioned and traceable, which matters when a CFO asks where a figure came from.
Our advice: start with the estimate, then validate it against model reference comparisons, then take quotes from certification bodies and consultants to confirm it. Done in that order, quotes become a check on a plan you already understand, and the three-year view is built in from the first day.
Martin
Build your own estimate
If you would rather see your numbers than read ranges, start with our ISO 27001 cost calculator. It breaks the estimate down by company size, industry and security maturity, lets you save and compare scenarios, and exports a PDF you can hand to finance. No signup is needed for the first calculation.
Not sure how ready you are? The free 2-minute readiness check gives you an instant read, and the full ISO 27001 readiness assessment goes domain by domain so the gaps feed straight into your budget. You can also see how the model works on our methodology page.
FAQ
How much does an ISO 27001 audit cost for a small company?
For a small US organization, the initial certification audit usually falls between $2,000 and $5,000 and rises with headcount, according to Factorial. The final figure depends on the audit days the certification body assigns. Ask for the day count and rate in writing.
Is the audit the biggest part of the cost?
Usually not. Implementation support and internal staff time tend to outweigh the audit fee for first-time certifiers. Consulting alone can run from about $4,000 for a very small business to more than $40,000 for a mid-sized one, per the same source.
What do I pay after the first year?
You pay for annual surveillance audits, a recertification audit at the end of the certificate cycle, any tooling subscriptions, and the staff time for internal audits and management reviews. Our maintenance cost analysis frames this over three years.
Can I compare quotes from different certification bodies?
Yes, if every quote covers the same scope, headcount, number of sites and audit days. Confirm each body is accredited for ISO 27001 through ANAB or an equivalent accreditation body. Differences in scope are the usual reason two quotes look far apart.