What ISO 27001 certification costs in the UK

Written from the standards themselves · Editor-reviewed · Checked against the current editions on 25 October 2026

By the iso27001partners.co.uk editorial team · Published 20 September 2026 · Last reviewed 25 October 2026 · 11 min read

5 primary sources cited on this page. How we check what is on this site

The short answer (audit days exact, pounds estimated) £5,500 to £7,500 for 10 people

That is the certification audit (Stage 1 and Stage 2) at 5 auditor days. At 25 people it is £7,700 to £10,500; at 150, £14,300 to £19,500. The days come from ISO/IEC 27006 audit time table, reproduced in full in an accredited certification body's published audit-duration procedure (QSI-TL.04 rev 21), which every accredited certification body works to; the pounds apply our estimated day-rate band. Preparation and the yearly surveillance audits are on top — the table below adds them up.

Ask what ISO 27001 costs and you can be given a range so wide it tells you nothing. Part of that spread is honest. But it obscures something useful: the cost splits into four parts, and two of them are set by a published rule and can be stated exactly. The table below gives the totals for four company sizes; the rest of the page shows how each line is built.

Key points

Audit days are not negotiable in the way people assume. The rule allows adjustment of up to 30% either way for complexity and sites, and says audit time is never reduced by more than 30%.
Preparation has no published rule behind it, and on our estimates it can be the bigger number. That is why a cost question can come back as a form.
The audit never stops. Surveillance is one third of the initial audit each year and recertification is two thirds in year three, so the three years after you certify cost more audit time than certifying did.
How you prepare does not change the audit fee. Toolkit, consultant or platform, the day count is the same, because it is a function of your headcount and complexity and nothing else.
Every pound figure on this page is our estimate, built on a day-rate band we name on the methodology page. The day counts are not.

ISO 27001 certification cost at a glance

Single site, no adjusting factors, consultant-led preparation. The three-year column is the one worth comparing between certification bodies, because it is the one a headline quote leaves out.

Four sizes, end to end. Day counts exact; money estimated.
People	Band	Audit days	Certification audit	Preparation (consultant-led)	Surveillance, per year	First three years
10	1–10	5 days	£5,500 to £7,500	£3,600 to £16,800	£1,850 to £2,500	£12,800 to £29,300
25	16–25	7 days	£7,700 to £10,500	£6,000 to £26,400	£2,550 to £3,500	£18,800 to £43,900
60	46–65	10 days	£11,000 to £15,000	£12,000 to £54,000	£3,650 to £5,000	£30,300 to £79,000
150	126–175	13 days	£14,300 to £19,500	£18,000 to £78,000	£4,750 to £6,500	£41,800 to £110,500

Run it for your own headcount

The four parts

The audit is rarely the biggest number. Preparation is, and preparation is the part with no published rule behind it — which is exactly why every site in this market asks you to ring them about it.

The same diagram as a table

Cost parts for 25 people in scope, one site, no adjusting factors
Part	Low	High	Basis
Certification audit	£7,700	£10,500	7 days, from the published table
Preparation, consultant-led	£6,000	£26,400	10–22 consultant days
Surveillance, per year	£2,550	£3,500	2.33 days, one third of the initial audit
First three years	£18,800	£43,900	Audit + preparation + two surveillance years

Day counts come from ISO/IEC 27006-1:2024 Table C.1 and are exact. The money is our estimate built on a day-rate band, rendered as a range and never as a single figure.

Part 1 — the certification audit (exact days, estimated rate)

Stage 1 and Stage 2 together. Find your headcount in the table below, apply any adjustment, and multiply by a day rate. We use a band of £1100 to £1500 per day; the midpoint is what the only UK guide publishing a cost table implies.

Part 2 — getting ready (estimated)

Scope, risk assessment, risk treatment, the Statement of Applicability, the documented information, an internal audit and a management review, plus whatever Annex A treatment your risk assessment produced. No rule sets this. It is the whole reason the three delivery routes have different prices, and it is covered in toolkit, consultant or platform.

Part 3 — annual surveillance (exact days, estimated rate)

One third of the initial audit, every year, for as long as you hold the certificate. In year three it becomes recertification at two thirds. What the days are spent on is set out in surveillance audits and recertification.

Part 4 — your own people (not priced here)

Somebody in your organisation has to make decisions a consultant cannot make for you: what is in scope, what your risk appetite is, who owns each control, and what the management review concludes. On the toolkit route this is the dominant cost and nobody puts a number on it.

The audit-day table, in full

This is ISO/IEC 27006-1:2024 Table C.1, all 22 bands, with our fee band applied. Certification bodies work from this table; it is not a marketing estimate and it is not ours. The surveillance and recertification columns are derived from the initial column at one third and two thirds, and we check that arithmetic against every row on each build rather than trusting it.

ISO/IEC 27006-1:2024 Table C.1, priced. Days are exact; fees are estimates.
People in scope	Initial audit days	Surveillance days	Recertification days	Certification audit fee	Each surveillance audit
1–10	5	1.67	3.33	£5,500–£7,500	£1,850–£2,500
11–15	6	2	4	£6,600–£9,000	£2,200–£3,000
16–25	7	2.33	4.67	£7,700–£10,500	£2,550–£3,500
26–45	8.5	2.83	5.67	£9,350–£12,750	£3,100–£4,250
46–65	10	3.33	6.67	£11,000–£15,000	£3,650–£5,000
66–85	11	3.67	7.33	£12,100–£16,500	£4,050–£5,500
86–125	12	4	8	£13,200–£18,000	£4,400–£6,000
126–175	13	4.33	8.67	£14,300–£19,500	£4,750–£6,500
176–275	14	4.67	9.33	£15,400–£21,000	£5,150–£7,000
276–425	15	5	10	£16,500–£22,500	£5,500–£7,500
426–625	16.5	5.5	11	£18,150–£24,750	£6,050–£8,250
626–875	17.5	5.83	11.67	£19,250–£26,250	£6,400–£8,750
876–1,175	18.5	6.17	12.33	£20,350–£27,750	£6,800–£9,250
1,176–1,550	19.5	6.5	13	£21,450–£29,250	£7,150–£9,750
1,551–2,025	21	7	14	£23,100–£31,500	£7,700–£10,500
2,026–2,675	22	7.33	14.67	£24,200–£33,000	£8,050–£11,000
2,676–3,450	23	7.67	15.33	£25,300–£34,500	£8,450–£11,500
3,451–4,350	24	8	16	£26,400–£36,000	£8,800–£12,000
4,351–5,450	25	8.33	16.67	£27,500–£37,500	£9,150–£12,500
5,451–6,800	26	8.67	17.33	£28,600–£39,000	£9,550–£13,000
6,801–8,500	27	9	18	£29,700–£40,500	£9,900–£13,500
8,501–10,700	28	9.33	18.67	£30,800–£42,000	£10,250–£14,000

Above 10,700 people the published table stops and says the sequence continues; the certification body extends it. Fees assume £1100–£1500 per day and exclude VAT, travel and any application or certificate charge.

The table is a step function, not a line. Taking on one more person can move you a whole band and add half a day of audit; nothing in a quoted price makes that visible, which is why the table is here in full.

The same diagram as a table

ISO/IEC 27006-1:2024 Table C.1, first 11 of 22 bands. Audit days.
People in scope	Initial audit	Surveillance	Recertification
1–10	5	1.67	3.33
11–15	6	2	4
16–25	7	2.33	4.67
26–45	8.5	2.83	5.67
46–65	10	3.33	6.67
66–85	11	3.67	7.33
86–125	12	4	8
126–175	13	4.33	8.67
176–275	14	4.67	9.33
276–425	15	5	10
426–625	16.5	5.5	11

Surveillance is one third of the initial audit and recertification is two thirds, in every row of the published table. The full 22 bands run to 10,700 people.

What moves you up or down within the band

The table is a starting point, not a final answer. The rule lets a certification body adjust it for how complicated your scope genuinely is — but it caps the adjustment at 30% and states that time is never cut by more than 30%, which is the sentence to remember if a discount sounds too good.

Factors that move the day count, from the same published rule
Factor	Effect	Why
Multiple sites in scope	↑ more days	Each additional site adds audit time, subject to the square-root sampling rule.
Complex or numerous IT platforms	↑ more days	Several different platforms, networks and operating systems inside one scope.
Heavy reliance on outsourcing and cloud suppliers	↑ more days	The more of the scope that somebody else runs, the more supplier controls there are to test.
Significant in-house software development	↑ more days	Secure development controls have to be audited where development happens.
High-availability and disaster recovery sites	↑ more days	Alternate data centres are part of the scope and are audited as such.
A management system that has been running for years	↓ fewer days	A mature, evidenced ISMS is quicker to audit than one that was stood up last quarter.
Most staff performing the same activity	↓ fewer days	Repetitive, low-variation work can be sampled.
A single site and a simple IT estate	↓ fewer days	Less ground to cover.

Multiple sites are handled separately. Where several sites perform the same activity, the certification body samples them rather than visiting all of them, and the sample is the square root of the number of sites, rounded up. Sites doing genuinely different things are not sampled away. That is ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of information security management systems — Part 1, and it is why a four-site company is not four times the audit.

The only fee we accept is a fixed amount per enquiry, agreed before anyone sends one. It does not move with the size of your engagement or with which consultancy receives it, which is why this page can tell you that a narrower scope is cheaper, that preparation is where the saving is, and that some readers should buy Cyber Essentials instead.

The five costs that arrive after the quote

1. The internal audit, every year, from somebody else

Clause 9.2 requires internal audits at planned intervals, and you cannot sit Stage 2 without having run one. Your certification body cannot do it for you: BS EN ISO/IEC 17021-1:2015, clause 5.2 (Management of impartiality), full text clause 5.2.6 bars a certification body from providing internal audits to its certified clients, and says doing so locks it out of certifying that management system for 2 years. So this is a separate purchase, or a genuinely independent internal resource, every year for as long as you are certified.

2. Surveillance, which is permanent

A certification quote may cover only the initial certification audit. Add one third of it in year one, the same in year two, and two thirds in year three. Taken together, the three years after certification contain more audit time than the certification itself.

3. Fees that are not audit days

Application fees, certificate issue fees and annual registration or licence charges, where a body charges them, are not day-rate items, so they sit outside any calculation based on the table — including ours. Ask for the full schedule of charges, not the audit quote.

4. The follow-up visit after a major nonconformity

A major nonconformity at Stage 2 has to be closed before a certificate is issued, and closing it can need the auditor to come back: verification can take an additional full or limited audit. Ask how that visit is charged. It is the one real financial argument for preparing properly, and it is a probability rather than a certainty.

5. Scope changes

Adding a site, an acquisition or a new product line inside the scope re-runs the day calculation, including the multi-site sampling rule. A scope drawn to flatter a sales cycle is a scope you pay for again later.

Before you spend anything: is it ISO 27001 you need?

If a customer has asked for “security certification” without naming a standard, it is worth establishing which one before committing to the larger of the two. Cyber Essentials is a UK government-backed scheme with published fees and a verified self-assessment against five technical control areas. How the two compare sets out what each actually checks and which one UK procurement names.

Cyber Essentials self-assessment fees, by organisation size (excluding VAT)
Size	Employees	Fee
Micro	0–9 employees	£320
Small	10–49 employees	£440
Medium	50–249 employees	£500
Large	250 or more employees	£600

Published scheme fees, read 20 September 2026. Cyber Essentials Plus adds a technical audit and is priced separately by the assessment body. These are the certification fees only and exclude any help you buy to get through it.

Cyber Essentials is not a substitute where a contract names ISO 27001, and it is not a management system: it does not ask you to assess risk, set objectives or review anything. But it answers a real question for a fraction of the money, and for a ten-person company being asked for reassurance rather than for a specific certificate, it may be the proportionate answer — our reading.

Common questions

How much does ISO 27001 certification cost in the UK?

The certification audit (Stage 1 and Stage 2) is set in auditor days by the number of people in scope, from ISO/IEC 27006 audit time table, reproduced in full in an accredited certification body's published audit-duration procedure (QSI-TL.04 rev 21). At our estimated band of £1,100–£1,500 a day: 1–10 people: 5 auditor days, about £5,500–£7,500; 26–45 people: 8.5 auditor days, about £9,350–£12,750; 126–175 people: 13 auditor days, about £14,300–£19,500. The days are the published rule; the pound figures are our estimate. Add surveillance in years one and two, recertification in year three, and whatever preparation costs you. The full table and the calculator are below.

What is the cheapest ISO 27001 certification can be?

The audit has a floor. The smallest band in the published table is 5 days for 1 to 10 people, and audit time cannot be cut by more than 30% for any reason, so roughly £3,850 of audit is the realistic floor at UK day rates however the discount is presented. Preparation is where the genuine saving is: a documentation toolkit plus your own people's time can be a few hundred pounds of outlay, at the cost of a lot of internal effort. What you cannot do is buy a meaningfully cheaper audit from an accredited body without the day count falling below what the rule allows; check accreditation before comparing prices.

Why do two quotes for the same company differ so much?

Check the day count first. Both quotes should reconcile to the same band in ISO/IEC 27006 audit time table, reproduced in full in an accredited certification body's published audit-duration procedure (QSI-TL.04 rev 21), adjusted within 30% for your sites and complexity. If one quote has materially fewer days than the other for the same scope, either the scopes are not the same or the reduction exceeds what the rule allows. After that, check what is excluded: travel and expenses, application and certificate fees, and any annual registration charge can be billed on top of the day rate; ask whether they are in the headline number.

Is the surveillance audit included in the price I was quoted?

Check: a quote for certification may cover only Stage 1 and Stage 2. The published rule sets each annual surveillance audit at one third of the initial audit and recertification at two thirds. Over the three years after certification that adds up to more audit time than the initial certification audit itself. A three-year figure is the only honest way to compare two certification bodies, and it is worth asking for one in writing.

Does the number of employees mean everybody on the payroll?

No. ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of information security management systems — Part 1 counts everyone doing work under the organisation's control inside the certified scope. Part-time people count in proportion to the hours they work; contractors and outsourced staff working inside the scope count; people in a business unit genuinely outside the scope do not. This is why scope is a cost decision as well as a commercial one.

Can I reduce the audit cost by being well prepared?

Not much, and this surprises people. The day count comes from your headcount and complexity, not from how tidy your evidence is. Good preparation changes the probability that Stage 2 produces a major nonconformity and a chargeable follow-up visit, and it changes how much of your own staff time the audit consumes. It does not move you down a band. What does move the count is a genuinely narrower scope, a simpler estate, or an ISMS that has been running for years rather than months.

Are toolkit, consultant and platform routes all the same price at audit?

Yes, exactly the same, and that is worth knowing before anyone quotes you. The audit-day count is a function of your headcount, sites and complexity. It is not a function of how you built the management system. So the whole of the price difference between the three routes sits in preparation, which is the part with no published rule behind it.

What about VAT?

Every figure on this page is shown before VAT, because that is how certification bodies and consultancies quote. Add 20% for the cash figure if your organisation cannot recover it.

Should we do Cyber Essentials first?

It can be — and this is advice against spending money, which is worth noticing on a site whose only income can be a fee from consultancies. Cyber Essentials is a verified self-assessment with a published fee of £320 to £600 plus VAT depending on size, against five technical control areas. If what your customer actually asked for is evidence of basic security hygiene, it may be the proportionate answer, and it is a reasonable stepping stone. If the requirement names ISO 27001 specifically, or the contract is with a large enterprise or the public sector, it will not substitute.

Sources cited on this page

Every figure above was read from the source it is attributed to on 20 September 2026. Figures that are our own arithmetic rather than a published rule are labelled as estimates wherever they appear. How we check this.