How much does ISO27001 Cost

How much does ISO 27001 cost?

ISO 27001 Shouldn’t Cost the Earth. Go about it the wrong way – it just might.

Let us take a look at the costly mistakes that people always make for ISO 27001 and how to avoid them.

You must read this before you implement ISO 27001.

I am Stuart Barker the ISO 27001 Ninja and this is how much does ISO 27001 really cost?

What ISO 27001 Costs Are There?

Let’s shed some light on the ISO 27001 costs you can expect. You have 2 lots of cost being

The cost of implementing ISO 27001

Putting in place the documents, templates, policies and processes of the management system and the associated controls will take a combination of time and money. Some of the costs are known and explicit. Some of the costs are hidden and implicit.

Either you are going to pay in your time to do it your self or in money for someone to do it for you.

The costs of taking the ISO 27001 certification test

To get the ISO 27001 certification you must become ISO 27001 certified. To be ISO 27001 certified you must pass and ISO 27001 audit which to all intents and purposes is a test. The test comes at a cost.

ISO 27001 Implementation Costs

How much does it cost to implement ISO 27001?

Thee costs for implementing ISO 27001 range from a few hundred pounds to buy an ISO 27001 templates toolkit with step by step guides to 10’s of thousands pounds to get external help.

The number 1 most costly ISO 27001 Implementation mistake people make

The number 1 mistake most people make is not knowing what they need and what their options are.

They get sucked in by fancy marketing.

They believe the hype that it is hard.

They accept the high prices that are banded around without question.

How should you implement ISO 27001?

It sounds simple but work out what you actually need.

Fundamentally it will come down to your costs verses your time.

ISO 27001 implementation costs will vary considerably depending on if you do it yourself, employ someone full time, employ a contractor or engage a consultant.

A Comparison of ISO 27001 Implementation Options and Costs

Considering the approaches of doing it yourself, getting a contractor or employing High Table let us compare typical expected costs side by side.

Do It Yourself

circa £500

30 to 90 days duration

Comes with all templates, policies, guides

Track record of delivery and certification

Consultant

Circa £5k to £15k

5 to 15 days duration

Comes with all policies

Track record of delivery and certification

Employee

min £40k per year

6 to 12 months duration

Needs to write all policies

Contractor

£39k to £160k

3 to 12 months duration

Will write all policies

Do it Yourself ISO 27001: Save thousands in consulting fees and months of effort

ISO 27001 Templates Toolkit Business Edition
ISO27001 Policy Templates Pack

The cheapest, most cost effective way for a small business to implement ISO 27001 and get ISO 27001 certification is to do it yourself. They just do not realise that it is an option. It is.

It is not hard.

It is not complicated.

The costly mistake of not implementing ISO 27001 yourself

I am not saying that consultants, contractors or full time employees do not have their place.

They do.

If you use a contractor or a full time employee the costs can soon mount up. The main reason being that you are paying for their time irrespective of the outcome. We often see projects that should take 10 days stretch to 3, 6 and even 12 months.

Of the options of getting help it is our experience that working with a consultant on a fixed price basis is the most cost effective way to implement ISO 27001. The benefits are

  • Fixed and know cost
  • Often includes all required documentation and policies

ISO 27001 Certification Costs

How much does ISO 27001 certification cost?

ISO 27001 Certification costs are set by the certification body. To have meaning you will want a UKAS accredited certification. It is worth shopping around. The UKAS website lists all the accredited bodies.

The costs vary depending on your size and the ‘risk’ the certification body assigns to your business.

For a small business expect to pay £6k to £8k typical as a year 1 cost.

For a medium size business expect to pay £12k to £18k typical as a year 1 cost.

You then have on going yearly costs.

The number 1 most costly ISO 27001 Certification mistake people make

The number 1 mistake most people make is not shopping around.

An accredited certification is an accredited certification.

Whilst you might belief the hype that they are not in it for profit, they are.

The reality is costs vary wildly.

Do your research.

Get at least 3 quotes.

Choose the ISO 27001 Certification Body that meets your finance requirements, your values and your needs.

What will affect your ISO 27001 certification costs?

ISO 27001 certification costs can vary based on a number of factors. The consequences of getting these wrong means that costs can up quickly and steeply.

The scope of your ISO 27001 certification

You should spend time on defining your scope for certification including what is in scope and what is out of scope. The more that is in scope the more work you have to do and the more you need to be audited. Read our How to Define ISO 27001 Scope as a guide.

The size of your organisation

The bigger you are the more the certification body will charge you. It is a simple as that. This one is outside your control of influence but be prepared for it.

The number of locations that are in scope

Once you have defined your scope work out how many locations are included. If they are your physical locations then an auditor will need to visit them. This will incur costs. More sites, more visits, more costs.

The certification body you choose

Not all certification bodies are equal in what they charge. As a rule, the larger the certification body, the more they will charge.

The on going costs of ISO 27001

You would be forgiven for thinking that the costs for ISO 27001 end at certification. Sadly this is not the case. ISO 27001 is a management system that is based on continual operation and continual improvement. As a result of this there are several ongoing costs that you should consider. They include:

Annual recertification audit costs

To maintain the certification the certification body is going to audit you every year. It is actually a cycle of audits over 3 years but be prepared for audit costs for the next 2 years of around 25% of your year one cost. Then on the 3rd year you do the whole thing again from scratch with a full audit and at the full audit cost.

Annual operational costs

The ISMS and associated controls have to be operated. This will come at a cost. The cost will either be in hiring new resources or in people’s time who will be diverted from their day job to complete the mandatory tasks required.

The biggest operational cost from the perspective of the standard will be the internal audit costs. I raise this here for special consideration as this is the one area that you are likely to require specialist resource that is independent of the areas being audited. Not only does the certification body audit you but you are expected to audit yourself on an ongoing basis. You can learn more about ISO 27001 Clause 9.2 Internal Audit to understand more on the requirement and read our guide on How to Conduct an Internal Audit to see what is involved and how you can do it yourself.

Free ISO 27001 Implementation Checklist

To give you a head start and understand what is involved I am going to provide you here with a free ISO 27001 implementation checklist. This is both a free ISO 27001 checklist excel sheet that you can use practically, with simple step by step instructions, and a free ISO 27001 checklist PDF.

Free 30 minute ISO 27001 strategy session

I know it can be daunting and no doubt you still have questions. To help navigate the mine field and offer practical answers to questions with practical guidance I offer a free 30 minute ISO 27001 strategy session. Just click on the link below.

Free ISO 27001 Strategy Call

ISO 27001 Costs FAQ

What ISO 27001 Certification costs are there?

There are several ISO 27001 Certification costs. They are
1. The cost of the actual ISO 27001 Certification and Taking the Test
2. The cost of implementing ISO 27001 and building your information security management system
3. The cost of running the ISO 27001 Information Security Management System
4. The ongoing annual cost of external certification audit

How much does and ISO 27001 certification cost?

The cost of the ISO 27001 certification cost audit will be in the region of £6,000 to £12,000 depending on the size of your organisation.

How much does the ISO 27001 on going annual external certifications cost?

You have a year 1 cost of £6,000 to £12,000
You have a year 2 and year 3 cost of £2,000 to £5,000
You then start the process over again and go back to Year 1.

How much does it cost to build and implement ISO 27001?

ISO 27001 implementation costs range from as low as £500 if you do it yourself through to £20,000+ for a fully managed service. You should definitely shop around.

How much is the ongoing cost to run the ISO 27001 information security management system?

There are many factors to consider but in brief, if you employ someone full time expect to pay £40,000 to £60,000 per year. If you outsource it expect to pay £12,000 to £36,000 per year. If you get an existing staff member to do it expect to pay training fees for them of around £2,000 to £5,000 per year.

How much do online ISO 27001 platforms cost?

Expect to pay a set up fee and an ongoing maintenance fee. Budget for between £10,000 and £20,000 per year on going costs. Be sure to shop around and get quotes.

How much does an ISO 27001 consultant charge?

An ISO 27001 consultant will charge between £12,000 and £60,000 per year depending on what they do for you.

What is an ISO 27001 consultants day rate?

An ISO 27001 consultant day rate will range between £400 and £1,500 per day depending on experience.

What is an ISO 27001 consultants hourly rate?

An ISO 27001 consultants hourly rate will range from £50 per hour to £250 per hour depending on experience.

What is the cost of the ISO 27001 standard?

The actual ISO 27001 standard costs around £150. Shop around. It is also only 14 pages long.

Can I get ISO 27001 certified for free?

No.

Is it possible to download ISO 27001 for free?

No.

Where can I get free ISO 27001 templates?

There are no free ISO 27001 templates that are any good. Google is your friend but ‘buyer’ beware.

We are a small company, why does ISO 27001 cost so much?

Partly because the ISO 27001 standard has been built in such a way that it excludes small business on cost. The ‘official’ framework of certification bodies is bureaucratic and doesn’t take into account the size of your organisation. They work on audit days not company size. It is not designed to be in your favour but, as they say, it is what it is.

Do different ISO 27001 certification bodies charge different amounts?

Yes. They will tell you that they do not work on a day rate but they do. As a result, the number of audit days will be fairly consistent between the certification bodies but the rate they charge will differ. The product at the end, the ISO 27001 certification, is exactly the same. In fact they often outsource the certification audit itself to a small pool of independent contractor auditors. This means that irrelevant of who you pay you can end up with the same auditor and will get the same product and the same outcomes. Get at least 3 quotes and shop around. Whilst the standard is the standard the amount that you are quoted or charged will be different depending on the ISO 27001 certification body that you choose.

What can affect the ISO 27001 Certificaiton Costs?

The ISO 27001 certification costs are affected by
1. The size of your organisation
2. The scope of your information security management system
3. The risk that the certification body thinks your organisation is exposed to
4. The actual certification body that you choose

Why do different ISO 27001 certification bodies charge different amounts?

Different ISO 27001 certification bodies charge different amounts as they have different costs to account for. The amount that they pay their staff or consultants, the amount they charge for their processes, additional services that they provide, spend on marketing all contribute to the certification bodies charging different amounts.

Do ISO 27001 certification bodies use the same auditors but charge different amounts?

Yes, sometimes. The industry relies on a pool of freelance consultants to perform that ISO 27001 audits working for multiple ISO 27001 certification bodies at the same time. Sometimes a certification will have full time, permanent staff, usually in an attempt to reduce costs. You should ask when you engage with the ISO 27001 certification body what staffing model they adopt.

ISO 27001 Templates Toolkit Business Edition Black
ISO27001 Policy Templates Pack Green

FREE 30 minute ISO 27001 strategy session.

Claim your 100% FREE no-obligation 30 minute strategy session call (£1000 value). This is strictly for small businesses who are hungry to get ISO 27001 certified up to 10x faster and 30x cheaper.

ISO27001 Certification Stragey Call

Shopping Basket