What does ISO 27001 cost?
By Alfred Obeng. Reviewed by Alfred Obeng on .
ISO 27001 has two separate costs. The first is the work to get ready, which Goldline prices as a fixed fee. The second is the certification body's fee, which you pay to that body and which depends on the number of people doing work inside your scope.
Cost 1: getting ready
For a single entity with up to 50 people in scope on one site or cloud hosted, the ISO 27001 Sprint is £7,000 fixed, plus VAT. The internal audit is included and carried out by an independent internal auditor appointed by Goldline, never by the team that built your system.
If you are not sure whether you need the full Sprint, there are smaller starting points, all on the pricing page: the ISO 27001 Readiness Assessment from £1,950 plus VAT, and the ISO 27001 Alignment Pack at £3,500 fixed, plus VAT. Every readiness service credits in full against a Sprint if you take one within six months.
A larger or multi-entity scope is scoped on the free 45-minute diagnostic, and the fee is fixed after it.
ISO 27001 with ISO 42001 as one management system is the Integrated Sprint at £12,500 fixed, plus VAT, same scope limit.
How long the work takes is set out in how long ISO 27001 takes.
Cost 2: the certification body
The certification body charges for its audits: the Stage 1 and Stage 2 audit, then surveillance audits in the following years and a recertification audit at the end of the three-year cycle. You pay it directly, so it is separate from Goldline's fee.
What sets the fee: the number of people doing work inside the scope, the complexity of the scope, and the body's own day rate. ISO/IEC 27006 sets the audit time on that basis. Because the figure is the body's to set, this page does not state one. Ask three UKAS-accredited bodies for a quotation that covers Stage 1 and Stage 2 and the following years, and compare like with like.
Cost 3: running it afterwards
Certification is not the end of the work. The management system has to keep running: an annual internal audit, a management review, risk reviews and evidence collected through the year. You can do that yourself or buy it as a monthly package. The current monthly packages and their prices are on the pricing page.
Software
You can run the system in a spreadsheet, in a compliance platform you already own, or in our UK-hosted GRC workspace at no extra subscription.
Work out your own number
The ISO 27001 cost calculator asks how many people work inside your scope, where you are starting from, who will do the work on your side and what makes it more complicated, and returns the Goldline route that fits with its published fee or a diagnostic scoping result, plus a separate estimate of the certification body's audit days and cost.