What does ISO 27001 certification cost? How to calculate the full cost

What does ISO 27001 certification cost? How to calculate the full cost

The cost of ISO 27001 consists of consulting support, an objective internal audit, the certification body's fees and your own time. How to calculate the full cost and how to keep it down.

Published

Summary: The cost of becoming certified to ISO 27001 has four parts: consulting support, an objective internal audit, the certification body’s fees and your own time. Consulting support can range from a few hours a week on average, when you do most of the work yourselves, to several days a week. More consulting time is not always better: a management system only works if the organisation itself carries the implementation, so we aim for the level where support does the most good. Our normal hourly rate is SEK 800–1,600 excluding VAT, and the gap analysis that is the first step costs from about SEK 25,000 excluding VAT.

Four cost items

Consulting support

Gap analysis, risk method and risk work, governing documents and the Statement of Applicability, support during implementation and preparation for the certification audit. The effort varies more than anything else: from a few hours a week on average, when your organisation does much of the work itself, to several days a week when you need someone to drive the work.

There is a limit to how much consulting time helps. Procedures, responsibilities and controls have to be put in place by the organisation itself, and a management system built for you without your involvement rarely holds up at the audit or after it. So we try to find the level where consulting support does the most good, and no more.

Internal audit

Before Stage 2 and the certification decision, the organisation needs to have completed its internal audit programme and management review, so that the management system can be shown to be implemented and working. The internal audit must be carried out with sufficient objectivity and impartiality: the auditor must not audit their own work. It can be carried out by a competent person internally who was not involved in what is being audited, by another independent consultant or by an external audit resource. Also allow time to fix what the audit finds.

The certification body

For an accredited certification you choose a certification body accredited for ISO 27001, in Sweden by Swedac or through an equivalent internationally recognised accreditation body. The audit time, and therefore the price, is calculated under specific rules for ISO 27001 certification in ISO/IEC 27006-1. The number of people within the scope of the management system is an important starting point, but the time is also affected by the complexity of the operations, the technology environment, outsourcing, the number of sites and the control environment, among other things. After certification there is a surveillance audit every year, taking roughly a third of the original audit time, and a recertification in the third year, taking roughly two thirds. Ask two or three bodies for a quote and compare what is included.

Your own time

Management, process owners, IT and the people who will work to the new procedures. It is often the largest item and the one that rarely shows in a quote. It is also the investment that makes the management system work after certification.

What drives the cost

  • Scope: how many business units, sites, services and systems are included.
  • Maturity: how much already exists, such as governing documents, risk work or work towards the Swedish Cybersecurity Act.
  • Size and complexity, which also drive the timeline.
  • Own capacity: how much you can do yourselves.
  • The timeline: a compressed timeline requires more consulting time per week.

Measures identified by the gap and risk work

The ISO work itself may show that the organisation needs to make investments that are not costs of the certification as such. Examples are multi-factor authentication, central logging, backup, network changes, vulnerability management, new tools or changes at suppliers.

Those costs vary considerably between organisations and should be kept separate from the consulting and certification costs. They are also why one company can reach certification cheaply while another needs to make significant technical investments along the way.

What is usually outside

  • Tools and licences, for example a system for maintaining the management system.
  • Employee training beyond what is included in the implementation.

How to keep the cost down

  • Delimit the scope wisely, but not so narrowly that the certificate does not answer what your customers ask for.
  • Start with a gap analysis, so that the work is done in the right order. What it costs is described in What does a gap analysis against ISO 27001 and the Cybersecurity Act (NIS2) cost?.
  • Reuse what you have: existing governing documents, risk assessments and procedures.
  • Build for the Swedish Cybersecurity Act at the same time if it applies to you, so that one management system answers both.
  • Appoint an internal owner who drives the work between consulting sessions.

Time affects the cost

Consulting support and your own time are spread over the whole period, so the timeline and the cost go together. It depends above all on the size and complexity of the organisation. The standard sets no timetable, but in our experience a smaller organisation can at best be ready within twelve months, a medium-sized or more complex organisation needs twelve to twenty-four months and a larger one usually twenty-four to thirty-six months. The independent internal audit, the remediation and the certification audit come on top of that. An organisation that already has working risk management, clear responsibilities, established security controls and available internal resources ends up nearer the shorter end. Within those ranges, the timeline is mainly affected by:

  • how much is already in place,
  • the scope of the management system,
  • how many organisational and technical changes are required,
  • how much of its own time the organisation can set aside,
  • how quickly identified gaps can be closed,
  • available dates at the chosen certification body.

We therefore set the first realistic timeline after the gap analysis, when it is possible to see what actually needs to be done. The steps are described under ISO 27001 from gap analysis to certification.

ISO 27001 from gap analysis to certificateFive steps: gap analysis and scope, risk work and policies, implementation, independent internal audit with remediation and management review, and a two-stage certification audit. The certificate is valid for three years. In our experience, building and implementation take a smaller organisation at best up to 12 months, a medium-sized or more complex one 12 to 24 months and a larger one usually 24 to 36 months; internal audit, remediation and certification come on top.ISO 27001 from gap analysis tocertificate1Gap analysis and scopea few days to a week2Risk work, policies and Statement of Applicability3Implementation in the businessthe part that varies most4Independent internal audit, remediation andmanagement review5Certification audit in two stagesstage 1: documentation and readiness · stage 2: that it works inpracticeCertificatevalid for three years, with a surveillance audit every year andrecertification in the third yearHow long do building and implementation take?Our experience from engagements; the standard sets no timetableSmaller organisationat best within 12 monthsMedium-sized or more complex12–24 monthsLarger organisationusually 24–36 months0122436 monthsThe independent internal audit, the remediation and the certification auditcome on top. The timeline for an individual organisation is set in the gapanalysis.

Frequently asked questions

Can we get certified without a consultant?

Yes. The standard does not require a consultant, and organisations with in-house expertise often do most of the work themselves. Consulting support does the most good where experience is lacking, for example in the risk method, in the Statement of Applicability and in preparing for the audit.

What does it cost after certification?

The surveillance audits every year and the recertification in the third year, plus the internal work of maintaining the management system. Risk work, internal audit, management review and follow-up continue at the organisation’s planned intervals. Many organisations build their maintenance around an annual main cycle.

Why can you not give a fixed price straight away?

The price depends on scope, maturity and how much you do yourselves. After the gap analysis we know that, and can then give an estimated cost proposal and, where possible, a fixed price for the next step.

Is the certification body’s fee included?

No. The certification audit is performed by an independent certification body and invoiced by them.

Want to know what ISO 27001 would require of you? Read more about our work on information security and governance or contact us.

The prices in this text are our normal price level at the time of publication and do not replace a cost proposal. Sources: ISO/IEC 27001 · ISO/IEC 27006-1:2024 on audit time for ISMS certification · Swedac: accreditation. Verified 2 October 2026.

This text is general information, not legal advice.