Where do the audit-day numbers come from?

ISO/IEC 27006 audit time table, reproduced in full in an accredited certification body's published audit-duration procedure (QSI-TL.04 rev 21). It is the rule that governs how long an ISMS certification audit takes, and it is what accredited certification bodies work to. The standard is not free to read, so we verified the table against a certification body's own published audit-duration procedure, which reproduces all 22 rows. The two agree exactly, including the derived surveillance and recertification columns.

Why is every price on this site a range?

Because a single figure would be a false claim. No UK certification body publishes a day rate and no compliance platform publishes a subscription price. What we can do honestly is take the day count, which is published, multiply it by a rate band we name, and show the result as a range with the arithmetic beside it. A site that gives you one confident number for something nobody publishes has made it up.

How do you decide what counts as a fact and what counts as an estimate?

Every figure in our source module carries one of three labels. Primary means it was read out of the standard, the statutory instrument or the accreditation rule itself, or out of a document that reproduces it verbatim. Secondary means it came from a published price list or vendor guide, which is real but is somebody's commercial position rather than a rule. Estimated means it is our arithmetic on top of the other two, and those are always shown as ranges. This page prints that classification for the whole site.

What did you decide not to publish?

The number of ISO 27001 certificates held in the United Kingdom. The ISO Survey's worldwide totals were read from a document that reproduces them, but the UK country row was not, and a country figure that is out by a thousand is worse than no figure at all. It is left out rather than guessed. The same applies to compliance-platform pricing: we report that none of them publishes a price, and we do not invent one.

The editorial team behind the site. We are not consultants, auditors or certification body staff, and we do not claim to be: everything here is traceable to a source you can open yourself, which is a stronger basis for trusting a number than a biography would be. Where we quote a clause, we quote it rather than paraphrasing, so you can check that the paraphrase would have been fair.

How do I report an error?

Write to contact@iso27001partners.co.uk with the page and the figure. Corrections that change a number get the figure changed and the review date on the affected pages moved. We would rather be corrected than consistent.

About iso27001partners.co.uk

Independent publication · No provider rankings · Fixed fee per enquiry

Edited by Callum Reid · Last reviewed September 27, 2026

How we verify what is on this site

iso27001partners.co.uk is an independent publication. It explains ISO/IEC 27001 certification in the UK from the standards themselves, UKAS accreditation rules and published government procurement policy.

Who writes this

Pages here are written and reviewed by Callum Reid, who edits iso27001partners.co.uk. Every page carries three dates in the same place: when it was published, when it was last reviewed, and the date the underlying rule was checked against its source. When a figure changes, the page is rewritten and the review date moves. When we get something wrong, we correct it on the page rather than quietly deleting it.

What this site is not

We are not a certification body, an accreditation body, an auditor or a consultancy, and nothing here is certification advice. We do not rank, score, recommend or endorse any provider, and there are no reviews, star ratings or “best of” lists anywhere on this site, because we could not substantiate them.

How this site makes money

We sell advertising to providers in this field at a fixed fee per enquiry. That fee does not vary with the outcome of your matter, with anything you are quoted, or with anything you eventually pay. Nobody can buy a better position in our content, because there are no positions to buy — we do not list providers.

How we source

The sourcing rules are published in full, separately, so you can hold us to them: how we verify what is on this site. In short: primary sources, quoted rather than paraphrased, linked to the official page, and dated. Where we could not reach an official source we say so on the page instead of estimating.

Corrections and questions

If something here is wrong, tell us and we will fix the page. Use the enquiry form on any page and write Correction at the start of your message — it reaches the same inbox. Tell us the page, the sentence, and the source you think is right; that is usually enough to settle it.