An ISO 27001 cost model is a structured estimate that breaks the program into cost lines (gap assessment, remediation, tooling, internal hours, certification audits, and yearly upkeep) and ties each line to a driver such as headcount, scope, or security maturity. Published first-year figures for US organizations run from roughly $30,000 to $120,000, so a single “average” is useless. The useful number is yours, built from your scope and your starting point.
TL;DR
- Model ISO 27001 as five cost lines: assessment, remediation, tooling, internal labor, and external audits. Then add a separate line for years two and three.
- Published US first-year ranges are wide ($30,000 to $120,000), because size, scope, and existing controls move the total more than any price list.
- Internal staff time is the line most budgets miss. Estimates run from 400 to over 1,000 hours in year one.
- Certification runs on a three-year cycle, so model three years, not one invoice.
- Keep every assumption visible and editable, so finance can challenge it and you can update it.
Table of Contents
- What a cost model is and why a quote is not one
- The five cost lines
- What moves the total
- Year one versus the three-year cycle
- Building the model, step by step
- Where the model can shrink
- A note on the 2022 standard
- Our perspective
- Get your own numbers
- FAQ
- Sources
What a cost model is and why a quote is not one
A quote from a consultant or certification body covers their part of the work. A cost model covers the whole program: what you pay vendors, what you pay in staff time, what you spend on tools, and what recurs after the certificate arrives.
That difference matters because the biggest surprises sit outside quotes. Internal labor is often underestimated, with published estimates of 400 to 1,000+ hours for first-year implementation. Nobody invoices you for those hours, so they rarely appear in a budget request until the project is already late.
A good model has three properties:
- Every number has a driver. “Audit fee: $X” is a guess. “Audit fee: based on N employees in scope at one site” is an assumption someone can check.
- It separates one-time from recurring costs. Year one looks very different from years two and three.
- It produces a range, not a point. Low, expected, and high scenarios show finance what could go wrong before it does.
The five cost lines
1. Gap assessment and scoping
You start by deciding what the information security management system (ISMS) covers and how far you are from the requirements. The standard itself, ISO/IEC 27001:2022, is built to apply to organizations of any size and sector, which is exactly why scope decisions swing cost so much. A scope limited to one product and its supporting team is a different project from the whole company.
The gap assessment can be done internally, by an outside consultant, or with a structured self-assessment. Its output is the input to everything below: a list of controls and processes you already have, and a list you do not.
2. Remediation
Remediation is closing the gaps: writing policies, setting up risk assessment and treatment, access reviews, logging, supplier management, training, and incident response. This is the most variable line. An organization that already runs mature access management and change control will spend little here. One starting from spreadsheets and informal habits will spend a lot, and remediation costs tend to spike when the assessment reveals gaps in foundational areas.
3. Tooling
Tooling can include a compliance automation platform, endpoint management, logging, vulnerability scanning, and security awareness training. Some of these you already own. Model only the incremental spend. Compliance automation has materially reduced engineering and operational time for implementing and evidencing controls, but it does not remove that work, so do not budget a platform as a replacement for staff hours.
4. Internal labor
Put a number on it. Take the hours range above, multiply by a loaded hourly rate for the people involved (security lead, IT, HR, engineering managers, an executive sponsor), and show it as its own line. Even if finance treats it as “free” because the people are already on payroll, the opportunity cost is real, and it explains why timelines slip.
5. Certification audits
Certification is a two-stage audit by an accredited certification body. Stage 1 is a readiness and documentation review. Stage 2 verifies that the system is implemented and working. The full process typically takes three to six months from audit readiness to certificate. Fees depend on the certification body, headcount in scope, number of sites, and ISMS complexity. Ask for written quotes from at least two accredited bodies and enter the quotes as the line item, rather than any benchmark.
What moves the total
When two organizations quote very different budgets, the cause is almost always one of these drivers.
| Driver | Why it changes cost | How to model it |
|---|---|---|
| Headcount in scope | More people means more training, more access reviews, and a higher audit fee | Count only employees and contractors inside the ISMS scope |
| Scope and sites | Each additional site, product, or system adds evidence and audit time | Define scope in one sentence before estimating |
| Security maturity | Existing controls shrink remediation; missing ones expand it | Score maturity by control domain, not as one overall grade |
| In-house capacity | Without a dedicated owner, you pay for outside help | Decide who owns the ISMS before pricing consulting |
| Timeframe | Compressed timelines raise outside spend and risk | Model a realistic 6 to 12 month plan and a rushed one |
| Other obligations | Customer contracts and other frameworks add requirements | List them and note overlaps |
The first four drivers are consistent with the factors listed in published guidance: size and scope, ISMS maturity and gaps, in-house capacity, and timeframe.
The point on industry deserves its own note. A fintech or healthcare vendor often faces stricter customer questionnaires, more sensitive data, and more contractual obligations than a design agency of the same size. That raises scope depth and evidence requirements, even though the standard is the same.
Year one versus the three-year cycle
A certificate is not a one-off purchase. The cycle runs like this, per a certification body’s overview:
- Year 1: initial certification (Stage 1 and Stage 2).
- Year 2: first surveillance audit.
- Year 3: second surveillance audit.
- Year 4: recertification, and a new cycle begins.
This is why a three-year view is the honest unit for a budget. A first year that looks affordable can hide a heavier recurring load. Internal resource use is one example: firms running the program entirely in-house have been reported at 550 to 600 hours a year on upkeep, against roughly 75 hours for those using managed services. Treat those figures as a reminder to price upkeep, not as a forecast for your company.
Our own published analyses put numbers on both ends for smaller organizations: a $6,000 to $54,000 budget range for SMBs, and a three-year TCO view with maintenance costs of $8,000 to $50,000. The gap between low and high in both cases comes from the drivers above.
Building the model, step by step
- Write the scope statement. Which products, locations, teams, and systems are in? Everything else follows.
- Run a gap assessment. Score each control domain so remediation is priced by area, not by feel. Our readiness assessment covers the four Annex A control themes for this purpose.
- List remediation work packages. Policies, risk register, access control, logging, supplier reviews, training, business continuity. Give each an owner, hours, and any spend.
- Price tooling incrementally. Only what you do not already have.
- Add internal hours at a loaded rate. Show low, expected, and high.
- Enter audit quotes. Real written quotes from accredited certification bodies replace any benchmark.
- Add years two and three. Surveillance audits, internal audits, management review, training refreshers, and the toolset’s renewals.
- Add a contingency. Because remediation is the most variable line, hold a reserve against it rather than inflating every line.
- Write the assumptions on one page. Headcount, scope, hourly rates, vendor choices. This is the page your CFO will actually read.
If you want to see how a structured estimate handles these steps, our methodology page shows how the inputs map to cost and effort.
Where the model can shrink
Some savings are real and some are false economies. The safe ones:
- Tighter scope. Certify the product or business unit customers actually ask about, then expand later.
- Reusing existing controls. Organizations that already hold a SOC 2 report can reduce ISO 27001 effort by building on foundational controls, and the operational controls such as encryption and access management are largely shared. For a view of how evidence and controls carry across frameworks, see this piece on SOC 2 engineering controls. ISO 27001 is still more prescriptive about documentation, such as the risk treatment process, so budget for that part.
- A named owner. One accountable person is cheaper than a committee.
- Planning the project timeline. A realistic plan avoids paying for rushed outside help. Our 6 to 12 month plan walks through what to budget before you outsource.
The unsafe ones are choosing a certification body for the lowest fee without checking accreditation, and skipping the gap assessment. Certification should come from an accredited body, since recognition depends on accreditation under the international framework.
A note on the 2022 standard
If you read older cost articles, check which version they describe. ISO/IEC 27001:2022 was published on October 25, 2022, and the transition period ended on October 31, 2025, when remaining 2013 certifications expired or had to be withdrawn. Any new project is assessed against the 2022 edition, and price pages written before that may reflect different transition work.
For a US company, also remember that most published pricing blends US and UK data and varies by provider. Use it for orders of magnitude, then replace it with quotes.
Our perspective
We built ISMS Calculator because most ISO 27001 budgets fail for the same reason: someone asks for one number, and someone else supplies it without showing the assumptions behind it.
A cost model earns trust when every driver is visible. Headcount, scope, industry, and security maturity each shift the result, and the person approving the budget should be able to change any of them and see what happens. That is why our estimates are real-time, the assumptions are editable, and the methodology is traceable and versioned.
We also think the first estimate should be cheap to get. No signup is needed for the initial calculation, and a two-minute readiness check gives you a starting maturity picture before you commit time. From there you can save scenarios, compare them, and export a report for finance.
Our advice to compliance officers and IT managers: model three years, price your own hours, and compare your result with model reference comparisons before the first meeting with an auditor. You walk in with a defensible range instead of a hope.
Martin
Get your own numbers
The fastest way to turn this framework into a figure is to run it. Start with the free 2-minute readiness check to see where your controls stand, then open the ISO 27001 cost calculator to enter company size, industry, and maturity and get an estimate of cost and effort.
You can save several scenarios (for example, a narrow scope against a company-wide one), compare them, switch currency, and export a PDF for your finance team. If you want a deeper domain-by-domain view first, the full readiness assessment feeds a timeline and cost estimate, and our guide to estimating costs from an assessment explains how.
FAQ
How much does ISO 27001 cost for a US company?
Published estimates for the first year in the US run from about $30,000 to $120,000, depending on size, existing security maturity, and use of consultants. Where you land in that range depends on your scope and gaps. Build the estimate from your own drivers rather than adopting the middle of a range.
How long does certification take?
From audit readiness to certificate, the process typically takes three to six months. Preparing the ISMS beforehand takes additional time, so many organizations plan a 6 to 12 month project overall. Gaps found in the assessment decide where you fall.
What recurring costs follow certification?
Expect annual surveillance audits in years two and three, a recertification audit in year four, and the internal work to keep the system running: internal audits, management reviews, training, and tool renewals. Model these as their own three-year lines so they do not surprise you later.
Can I estimate costs before talking to a consultant or auditor?
Yes. Estimating from company size, industry, and current security maturity gives you a working range before any vendor conversation. Use it to set expectations, then replace benchmark lines with written quotes as they arrive.
Sources
- ISO/IEC 27001:2022, information security management systems (ISO)
- ISO/IEC 27001 transition: what you should know (SGS)
- ISO 27001 certification process: Stage 1 vs Stage 2 guide (GLOCERT)
- ISO 27001 certification cost: complete breakdown for 2026
- Cybersecurity audit cost in 2026
- ISO 27001 vs SOC 2: which compliance path for US and UK SaaS
- ISO 27001 certification cost in 2024
- ISO 27001 compliance services pricing guide
- Make chatbots audit ready: SOC 2 engineering controls