ISO 27001 Budget Forecasting: A Three-Year Planning Guide

An ISO 27001 budget forecast is a three-year number, not a one-time quote. It has four parts: the certification audits, the work of building your management system, the tools and people you add, and the surveillance cycle that keeps the certificate alive. Most forecasts that miss do so because they price the first audit and stop there.

This guide shows how to build the forecast line by line, which inputs you can control and which you can’t, and how to pressure-test the result before you take it to finance.

TL;DR

• Forecast over three years. Certification runs on a three-year cycle of initial audits followed by annual surveillance audits, so years two and three belong in the budget from day one.
• Audit fees follow audit days, and audit days follow headcount and complexity. You can rarely negotiate that formula down, so model headcount first.
• Internal effort (risk assessment, policies, evidence, remediation) is usually the least visible cost and the one most often left out.
• Build a base, a likely and a high case, then compare each with model reference comparisons before you commit.
• Revisit the forecast after your gap assessment, because maturity moves the numbers more than any vendor quote.

Table of Contents

• Why a one-year number fails
• The five lines of an ISO 27001 forecast
• Build the forecast in six steps
• A worked example: a 60-person SaaS company
• What moves the number most
• Perspective: what we see in budgets that fail
• Pressure-test your forecast before you present it
• Turn the forecast into numbers
• FAQ
• Sources

Why a one-year number fails

Certification is not a purchase. It is a commitment. The accreditation body ANAB describes the path as an initial certification (a Stage 1 and a Stage 2 audit) followed by ongoing surveillance. That means a recurring audit fee, recurring internal time and recurring tooling costs after the certificate is issued.

The typical failure looks like this. A team budgets for the certification audit and the consultant, celebrates the certificate, and then discovers in year two that nobody owns the internal audits, the management review or the risk register updates. The surveillance audit arrives with no money and no time behind it.

Treat the forecast as an operating budget with a one-time project on top. Our own published figures reflect this split: we put initial SMB budgets in a range of $6,000 to $54,000 and the maintenance years at $8,000 to $50,000 over a three-year total cost of ownership view. Both ranges are wide, and the rest of this article explains why.

The five lines of an ISO 27001 forecast

Every credible forecast contains the same five lines. What differs is the amount in each.

Certification audits

This is the line you can forecast most precisely, because it is not an hourly rate. Certification bodies price by the day, and the number of days is set by rules. The International Accreditation Forum publishes mandatory provisions for how certification bodies determine audit time for clients of differing size and complexity. In practice, the number of people within your scope and the complexity of your operations drive the days, and the days drive the fee.

Two consequences for your forecast:

1. Headcount inside the scope is a core input. A 40-person company and a 400-person company will not receive similar quotes, even with identical tooling.
2. Narrowing the scope is the legitimate lever. If one product, one business unit or one site can honestly carry the certificate your customers ask for, a tighter scope reduces both audit days and implementation work. Narrowing it just to cut a quote, when customers expect broader coverage, only moves the cost to a later re-scope.

Get quotes from at least two accredited certification bodies, and ask each to state the audit days they assumed. The days should be comparable even if the daily rates are not.

Implementation support

This line depends on how much of the standard you already meet. A company with documented access control, a working incident process and a vendor review routine needs light guidance. A company with none of these needs help building the management system itself.

Analysts who follow the standard note that high initial implementation costs and resource demands are a recognized challenge, and that organizations often respond by engaging specialist consultants, training internal teams and folding certification into wider enterprise planning. That matches what we see: the forecast should state up front whether you plan to build with internal staff, with outside help, or with a mix.

Internal labor

This is the line that surprises finance. Someone has to run the risk assessment, write or revise policies, collect evidence and fix gaps. If that person is your IT manager, the cost is real even though no invoice arrives.

Put a number on it. Estimate hours per role per month during implementation, multiply by a loaded hourly cost, and show it as its own row. Our guide to IT team roles in ISO 27001 breaks down who typically carries what. Even if finance does not treat internal time as cash, showing it prevents the project from being starved of hours.

Tools and technical controls

Annex A does not tell you to buy specific products. ISO 27001 does not hand you a fixed checklist either. ANAB’s description of the standard frames it as a management system model for establishing, operating, monitoring and improving information security, and controls are chosen from your risk assessment. So your tool budget should come out of your risk treatment plan, not the other way around.

A practical approach: list each control you have decided to implement, mark what you already own, and price only the gaps. Separate one-time costs (a penetration test, a configuration project) from subscriptions that renew every year.

Ongoing operations

Internal audits, management reviews, risk register updates and annual awareness training must happen every year. They are modest individually but they are what the surveillance auditor checks. This is also where the most common budgeting error sits, which we cover in common ISO 27001 budgeting mistakes.

Build the forecast in six steps

1. Fix the scope. Write down the products, locations, systems and people the certificate will cover. Every later number depends on it.
2. Count effective personnel. Include employees and long-term contractors who work inside the scope. This is the input your certification body will ask for first.
3. Run a gap assessment. Score yourself against the standard’s requirements and Annex A themes. The size of the gap sets the size of the implementation line.
4. Decide the build model. Internal only, advisor-supported or fully outsourced. Each shifts cost between the consultant line and the internal labor line.
5. Price years one, two and three separately. Year one carries the project and the initial audits. Year two carries a surveillance audit and operations. Year three carries a surveillance or recertification audit as your certification body schedules it, plus operations.
6. Add a contingency. Findings from the Stage 2 audit can require corrective work. A reserve of your own choosing, stated openly, is better than a surprise request mid-year.

A worked example: a 60-person SaaS company

The figures below are illustrative assumptions, not quotes and not market averages. Replace each with your own numbers. The point is the shape of the model.

Assume a 60-person software company, one product in scope, some existing controls (single sign-on, endpoint management) but no formal risk assessment.

The pattern is more useful than any single total. Year one is front-loaded, year two is the lowest, and year three often rises again because recertification preparation needs real work. A flat annual number hides all of this, and finance teams that see the real curve are less likely to cut year-two funding.

For a larger organization, the same logic holds with more moving parts. Our three-year cash flow model for enterprise ISO 27001 shows how to phase spending by quarter.

What moves the number most

Maturity

Security maturity is the biggest swing factor, because it determines how much you build versus document. A company with strong engineering practices but no paperwork spends mostly on writing and evidence. A company starting from scratch spends on design, tooling and training as well.

Headcount and complexity

As covered above, these feed the audit-day formula. Multiple sites, multiple cloud environments and outsourced processes all add complexity. Remote teams often simplify site audits but can add scope questions about endpoints and contractors.

Adjacent frameworks

Many US buyers ask for SOC 2 first and ISO 27001 second, or the reverse. Overlap is real but it is not total. A well-phased plan can save effort when the two share evidence, and a six-month SOC 2 plan for U.S. biotech startups is a useful example of how another framework’s budget and timeline get staged. If you also use NIST CSF internally, mapping it to ISO 27001 can streamline the eventual certification, as Microsoft describes in its submission to NIST. We compare the two in ISO 27001 vs NIST CSF.

Business continuity

If continuity planning is in scope, it adds exercises, documentation and sometimes tooling. See our business continuity budget guide before you assume it is free.

Perspective: what we see in budgets that fail

We built ISMS Calculator because the same question kept arriving with no good answer: how much will this cost us? Honest answers depend on company size, industry and security maturity, and a static table cannot hold all three.

Here is our view, and it is opinionated.

First, the risk assessment is the heart of the work, and it deserves the budget. Teams that spend their money on tools before they understand their risks tend to buy the wrong things twice. ANAB’s description of the standard is clear that a management system, not a list of products, is what gets assessed.

Second, assumptions should be visible. A forecast you cannot trace is a forecast you cannot defend to a CFO. That is why our calculator exposes its assumptions, lets you edit them, and documents the approach on a methodology page. If a figure looks wrong for your company, you should be able to change it and see what happens.

Third, forecast three scenarios, not one. A single number invites a single argument. A base, likely and high case invites a conversation about risk, which is what finance leaders actually want.

Fourth, benchmarks are a sanity check, not a target. Comparing your plan with model reference values tells you whether you are far outside the norm. It does not tell you that you must match it.

— Martin

Pressure-test your forecast before you present it

Run these checks before the budget goes to finance.

• Does year two have a line? If surveillance audits and internal audits are missing, the forecast is incomplete.
• Is internal time shown? Even as a non-cash row, it protects the project.
• Are audit days stated? Ask each certification body for the days assumed, and compare days rather than totals.
• Is scope written down? A forecast without a scope statement cannot be audited.
• Does the plan treat the audit as recurring? ANAB’s guidance warns that certificates are maintained through surveillance, so a one-off view risks losing the certificate later.
• Are the outer cases stated? Show what happens if findings need corrective work, or if headcount grows 25% before the audit.

If you want a second opinion on the shape of your numbers, our guide on ISO 27001 cost drivers and the general cost overview walk through each driver in more depth. If your plan has a finance-facing angle, the guide on security budget percentage and three-year bands helps you frame the ask.

Turn the forecast into numbers

The fastest way to get a first-pass forecast is to enter your company size, industry and maturity into our ISO 27001 cost calculator. It returns estimates in real time and needs no signup for the initial calculation. You can save several scenarios, compare them, edit the assumptions, plan phases on a timeline and export a PDF for finance.

Not sure where your maturity sits? Take the free 2-minute check first, or run the full ISO 27001 readiness assessment to score yourself across the four Annex A control themes. A better maturity score gives you a better forecast.

FAQ

How much does an ISO 27001 audit cost?

It depends on audit days, which are set by headcount in scope and organizational complexity under IAF rules for certification bodies. Ask two or more accredited certification bodies for a quote and for the days they assumed. Then add surveillance audits for years two and three.

Does ISO 27001 require audits every year?

Yes, in practice. After the initial certification audits, certificates are maintained through surveillance audits, and your own internal audits must also run. Budget both every year.

Is there an ISO 27001 checklist I can budget against?

Not a fixed one. The standard asks for a management system built around your own risk assessment, and ANAB’s overview of ISO/IEC 27001 describes it as a model for establishing, operating and improving that system. Budget for the risk assessment and the controls it selects, not a generic list.

Which is better, ISO 27001 or NIST?

They do different jobs. ISO 27001 is a certifiable standard that gives outside parties independent assurance, while NIST CSF is a voluntary framework for improving security posture. Many organizations build on NIST internally and map to ISO 27001 later, as discussed in our comparison of the two.

Sources

• IAF Mandatory Document on audit time determination (MD 5)
• ANAB: How to seek certification to a management systems standard
• ANAB: ISO/IEC 27001 information security accreditation
• ISO/IEC JTC 1/SC 27 Journal, 2026 Issue 1
• NIST: Microsoft comments on the Cybersecurity Framework

Recommended

• Finance Ready ISO 27001 Security Budget Percentage and 3 Year Bands
• Three Year Cash Flow: Enterprise ISO 27001 Budget With ISMS Calculator
• $6,000–$54,000 ISO 27001 Budget for SMBs: Cost Drivers 2026
• Common ISO 27001 Budgeting Mistakes and How to Fix Them