How much does ISO 27001 certification cost a small company? There is no official price list. Certification bodies price their own audit days, and most of the real cost sits in your own team's time. What is fixed is the structure of the bill, and the rule certification bodies use to decide how many audit days you need. This guide walks through both, so you can budget and compare quotes properly. For budgeting ranges based on your headcount, use our free ISO 27001 cost and timeline estimator.
The four parts of the cost
Only one part of the cost buys the certificate itself. The four parts are:
- The certification audit: Stage 1, where the auditor reviews your ISMS documents and readiness, and Stage 2, where they check the ISMS is actually working. An accredited certification body charges by the audit day.
- Surveillance audits: shorter audits by the same body in each of the two years after certification.
- Internal effort: defining the scope, the risk assessment, the Statement of Applicability, policies, the internal audit and the management review. This is your team's time, or a consultant's.
- Fixing gaps: the controls you do not have yet, such as MFA everywhere, logging, access reviews, supplier reviews and secure development practices.
How audit days are set
Certification bodies calculate ISMS audit time using ISO/IEC 27006-1:2024. The main input is the number of people working within the scope, adjusted for the complexity of your business and IT and the number of sites. As a rough guide, it starts at about five audit days for fewer than ten people and rises to fourteen or more at around 200 people. An audit day is eight hours, and a certification body cannot cut below 80% of the calculated time.
That makes the audit-day count the most useful number in any quote. A cheaper quote with fewer days is a shorter audit, not a discount. Ask every body how many days it is quoting and how it got there.
How to compare certification body quotes
Quotes from different certification bodies can look very different. Compare them on the same points:
- Accreditation: the body should be accredited for ISO 27001 by a national accreditation body that is a member of the IAF, such as NABCB in India, ANAB in the US or UKAS in the UK. You can check certificates on IAF CertSearch.
- Audit days for Stage 1, Stage 2 and each surveillance audit, and how they were calculated.
- Whether the quote covers the full three-year cycle or only the first year.
- Travel costs, and how much of the audit can be remote.
- What happens, and what it costs, if Stage 2 finds a major nonconformity.
What is optional
Compliance automation platforms can save a lot of evidence-gathering time, especially for cloud-first teams, but ISO 27001 does not require one, and plenty of small companies certify without one. Buy one for the time it saves you, after you know your scope.
Consultancy is also optional. A certification body cannot help you build the ISMS it then audits, so implementation help, if you want it, comes from a separate firm or a vCISO.
Where the internal effort goes
For a small team, internal time is usually the largest part of the real cost, and it is easy to underestimate because it never arrives as an invoice. The work splits into three kinds. Management work: setting the scope, the risk appetite and the objectives, and holding the management review. Documentation: the risk assessment, the Statement of Applicability, policies and procedures. Engineering: closing technical gaps and producing records that controls run, such as access reviews, backups and vulnerability fixes.
Name one owner for the ISMS early, even if they spend only part of their week on it. Projects without a named owner tend to stall between Stage 1 and Stage 2.
Do you need a penetration test?
ISO 27001 does not require an annual penetration test by name. Annex A control 8.8 (management of technical vulnerabilities) and control 8.29 (security testing in development and acceptance) require you to find and fix technical weaknesses and to show evidence that you do. A recent penetration test is a common way to provide that evidence, and many enterprise customers ask for one anyway, but scanning, code review and patch records count too. Decide based on your risks and your customers, not because someone told you the standard demands it.
A realistic timeline
From a standing start, a small team usually moves through these stages:
- Readiness: scope, asset inventory, risk assessment, Statement of Applicability and policies. From a few months with good existing practice to most of a year without it.
- Operating the ISMS: the controls running for long enough to produce records, plus an internal audit and a management review. The standard sets no fixed minimum period, but the certification body needs to see evidence that the ISMS is working before Stage 2.
- Stage 1, then Stage 2: usually a few weeks apart, with time between to fix what Stage 1 finds.
- The certificate: valid for three years, with surveillance audits in the two following years and a recertification audit before it expires.
Where small teams overspend
The common mistakes are avoidable:
- Scoping the whole company when customers only care about one product. People in scope drive audit days.
- Buying tooling before the scope and risk assessment are clear.
- Leaving technical gaps until after Stage 1, which compresses the fixes into the weeks before Stage 2.
- Building ISO 27001 and SOC 2 separately. The two share most of their evidence, so build the controls once.
Which edition to certify against
Certify against ISO/IEC 27001:2022 with its 2024 amendment. Annex A has 93 controls in four themes: organisational, people, physical and technological. The transition period for the 2013 edition ended on 31 October 2025, so control numbers from the old edition, such as A.12.6.1, no longer apply.
Frequently asked questions
How long does ISO 27001 take for a 20-person company?
Can a small company get ISO 27001 without automation software?
What is the difference between Stage 1 and Stage 2?
Is a penetration test mandatory for ISO 27001?
What does ISO 27001 cost after the first year?
Plan your ISO 27001 project
We implement the technical controls and get your ISMS ready for the certification body, with a clear split of who does what.