Cost overview of ISO 27001 certification

For most SME and SaaS organizations, the total investment is between €16,000 and €28,000, spread across eight phases: from scoping up to and including the phase 2 audit. That amount includes guidance, the internal audit, the costs of the certifying body, and the hours your own people put in.

Across the market, we see costs ranging from around €10,000 for a small, straightforward organization to well over €50,000 for companies with multiple locations or a complex IT environment. The final cost depends on your scope, your current situation, and how much you handle yourself.

For an SME, expect the process to take four to nine months from scope definition to certification. Small, cloud-native companies with a narrow scope can sometimes complete the process in four months. Larger organizations or companies without existing security measures are more likely to take nine months or longer.

The implementation of the control measures is usually the phase that takes the longest and fluctuates the most. Also, schedule the external audit in a timely manner, because certification bodies often have a waiting time of several weeks to months.

On paper, yes; in practice, often not. Those who work without guidance don’t pay for consulting hours, but end up investing much more of their own time. Figuring out the standard, building all documents from scratch, and only discovering errors during the external audit can easily cost a small business 200 to 400 internal hours. For a medium-sized organization, that figure can double.

Furthermore, a re-audit following non-conformities means additional audit days with the certification body. With guidance and ready-to-use templates, the process is usually shorter and you know the costs in advance.

The certificate is valid for three years. In years one and two, the certifying body returns for a surveillance audit, which takes approximately half the time of the initial audit. In year three, a recertification audit follows, which is similar to the original phase 2 audit.

In addition, the standard requires an annual internal audit and a management review, and the ISMS must be kept up to date. For an SME, this amounts to approximately €4,000 to €8,000 per year in external costs, plus internal hours.

The certifying body charges per audit day. The number of days follows guidelines from the International Accreditation Forum and depends primarily on the number of employees within the scope, the number of locations, and the complexity of your processes and IT. An organization with 25 to 45 employees is indicatively at four to five audit days for phases 1 and 2 combined, at a daily rate of roughly € 1,000 to € 1,500.

Always request quotes from several accredited organizations. Rates and approaches vary, and an auditor with experience in your industry will understand your environment more quickly.

Yes, and that is often the greatest saving you can make. You do not have to certify the entire organization all at once. Many companies start with one product, one service, or one department and expand later. A smaller scope means fewer control measures to set up, fewer people to interview, and fewer audit days.

The scope must be logical and credible. A software company that certifies only its marketing department will face questions about this from customers and auditors. During the scoping phase, we’ll work with you to determine where to draw the line.

If you already have ISO 9001, or also need NEN 7510, ISO 27701 or ISO 42001, combining them is almost always more cost-effective than certifying them separately. The standards follow the same structure, meaning you only need to set up the management review, internal audit, document management, and non-conformity process once.

The external audit can also be combined. For most organizations, adding NEN 7510 to ISO 27001 requires only an additional half to one full audit day, and for an integrated management system, organizations often offer a discount on the combined audit.