Every price Goldline charges, published. Fixed after scoping, no setup fees, readiness assessments credit in full against a Sprint. Your certification body's audit fee is separate and paid to it directly.
Your first certificate. A named owner and four hours a week.
One management system for ISO 27001 with ISO 42001.
The AI half, for teams that already hold ISO 27001.
ISO 27001 holders adding privacy
Half at the start, half on delivery, or spread across the programme in instalments agreed on the diagnostic. The fixed fee covers a single legal entity, up to 50 people in scope, one site or cloud hosted. A larger or multi-entity scope is scoped on the free diagnostic.
Runs on your compliance platform if you have one, or in our UK-hosted GRC workspace at no extra subscription.
| Service | From | Scope | Best for | Action |
|---|---|---|---|---|
| ISO 27001 SprintA single entity, up to 50 people in scope, one site or cloud hosted.Runs on your compliance platform if you have one, or in our UK-hosted GRC workspace at no extra subscription. | £7,000, plus VAT | 8 to 12 weeks | A single entity under 50 people needing ISO 27001 | Enquire → |
| ISO 42001 SprintA single entity, up to 50 people in scope, one site or cloud hosted.Runs on your compliance platform if you have one, or in our UK-hosted GRC workspace at no extra subscription. | £7,000, plus VAT | 8 to 12 weeks | A single entity under 50 people needing ISO 42001 | Enquire → |
| SOC 2 Readiness SprintA single entity, up to 50 people in scope, one site or cloud hosted.Readiness through to a Type 1 report, on the AICPA security criteriaRuns on your compliance platform if you have one, or in our UK-hosted GRC workspace at no extra subscription.Type 2 observation support through Evidence EssentialsThe CPA firm's fee is separate and paid to the firm | £7,000, plus VAT | Agreed on the diagnostic | For selling to US customers | Enquire → |
| Integrated Sprint (ISO 27001 with ISO 42001)A single entity, up to 50 people in scope, one site or cloud hosted.Runs on your compliance platform if you have one, or in our UK-hosted GRC workspace at no extra subscription. | £12,500, plus VAT | 8 to 12 weeks | Two certificates, one management system | Enquire → |
| ISO 27001 added to your ISO 9001 | £7,000, as ISO 27001 Sprint, plus VAT | 8 to 12 weeks | You already hold ISO 9001 and are asked for ISO 27001. The work is adding ISO 27001 to your existing system. | Enquire → |
| ISO 27701 added to your ISO 27001 | £5,500, plus VAT | Agreed on the diagnostic | ISO 27001 holders adding privacy | Enquire → |
| Integrated Sprint, ISO 27001 with ISO 27701 | £12,500, plus VAT | Agreed on the diagnostic | Building both together | Enquire → |
| ISO 27701 transition review | From £2,950, plus VAT | Agreed on the diagnostic | Moving a 2019 certificate to 2025 | Enquire → |
| The fixed fee covers a single legal entity, up to 50 people in scope, one site or cloud hosted. A larger or multi-entity scope is scoped on the free diagnostic. | ||||
| Service | From | Scope | Best for | Action |
|---|---|---|---|---|
| Free 45 minute diagnosticStart here | No fee | 45 minutes | Confirming scope and route | Book the Free Diagnostic → |
| First Security QuestionnaireYour customer's security questionnaire answered from evidence you can stand behind, with a reusable answer library.A questionnaire over 200 questions is £2,000 plus VAT. A second questionnaire in the same quarter is £750 plus VAT, because it reuses your answer library. The £1,250 is credited in full against a Sprint started within six months. | £1,250, plus VAT | Within 10 working days | Book the Free Diagnostic → | |
| Cyber Essentials readiness, up to 10 peopleThe certification body's fee is passed through at its published rate, nothing added. | £595, plus VAT | Set on the diagnostic | The verified self-assessment, evidenced before you apply | Book the Free Diagnostic → |
| Cyber Essentials Plus readiness, up to 50 peopleThe certification body's fee is passed through at its published rate, nothing added. | From £1,250, plus VAT | Set on the diagnostic | Preparation for the independent technical assessment | Book the Free Diagnostic → |
| ISO 27001 Readiness AssessmentCredited in full against a Sprint started within six months. | From £1,950, plus VAT | Set on the diagnostic | Setting the boundary before you commit | Enquire → |
| ISO 27001 Alignment PackScope statement, risk assessment and treatment plan, Statement of Applicability, core policies, evidence for the controls your customer asked about, their questionnaire answered, an answer library, trust centre set-up, and a regulated-buyer section mapping your evidence to bank and insurer supplier reviews (DORA, PRA, FCA SYSC 8, NIS2).Credited in full against a Sprint started within six months.An alignment summary is a consultant's statement, not a certification.Half at start, half on delivery. | £3,500 fixed, plus VAT | 3 to 4 weeks | Book the Free Diagnostic → | |
| AI Governance Readiness AssessmentCredited in full against a Sprint started within six months. | From £2,500, plus VAT | Set on the diagnostic | ISO 42001 or an AI questionnaire | Enquire → |
| Integrated DPIA and AI Impact AssessmentCredited in full against a Sprint started within six months.Free DPIA checker | From £4,000, plus VAT | Set on the diagnostic | A high-risk processing or AI use case | Enquire → |
| AI Assurance Evidence PackCredited in full against a Sprint started within six months. | From £5,000, plus VAT | Set on the diagnostic | Answering an enterprise AI questionnaire | Enquire → |
| DCC Requirement and Scope ReviewCredited in full against a Sprint started within six months. | From £1,950, plus VAT | Set on the diagnostic | A prime has raised DEFCON 658 | Enquire → |
| Pre-Certification Readiness AuditCredited in full against a Sprint started within six months. | From £3,500, plus VAT | Set on the diagnostic | You think you are ready and want it tested | Enquire → |
| DCC Level 1 Readiness DiagnosticCredited in full against a Sprint started within six months. | From £4,500, plus VAT | 4 to 8 days | Reaching Cyber Risk Profile Level 1 | Enquire → |
| DCC Level 0 Readiness Diagnostic | Scoped on the diagnostic | 2 to 4 days | Establishing the Level 0 position | Enquire → |
| ISO 27001 Internal Audit, up to 10 people | £1,950, plus VAT | Up to 2 days and a written report | Clause 9.2 for a single entity with up to 10 people in scope, one site or cloud hosted, on an ISMS someone else built. Extra days are quoted before they start. | Enquire → |
| ISO 27001 Internal Audit, larger scopes | From £2,950, plus VAT | Set on the diagnostic | Clause 9.2, priced by boundary size and control set | Enquire → |
| ISO 42001 Internal Audit, up to 10 people | £1,950, plus VAT | Up to 2 days and a written report | Clause 9.2 for a single entity with up to 10 people in scope and 1 to 3 AI systems, on an AI management system someone else built. Extra days are quoted before they start. | Enquire → |
| ISO 42001 Internal Audit, larger scopes | From £4,500, plus VAT | Set on the diagnostic | Clause 9.2 on an AI management system | Enquire → |
| Recertification readiness | £5,500, plus VAT | Set on the diagnostic | Before your ISO 27001 recertification audit | Enquire → |
| Combined ISO 27001 and ISO 42001 Internal Audit | Scoped on the diagnostic | Set on the diagnostic | Both management systems audited in one engagement | Enquire → |
| Stage 2 Audit Defence | Scoped on the diagnostic | Duration of the audit | The audit is booked and you want cover | Enquire → |
| Service | From | Scope | Best for | Action |
|---|---|---|---|---|
| Evidence Essentials | From £495 a month + £1.95 per user, plus VAT | 12-month term | Certified or close, staying audit-ready | Enquire → |
| Secure Compliance | From £895 a month + £9 per user, plus VAT | 12-month term | Evidence plus 24/7 detection and response and account monitoring | Enquire → |
| Security & Governance | From £1,495 a month + £9 per user, plus VAT | 12-month term | A named security lead and board reporting | Enquire → |
| Fractional AI Governance Lead | From £4,250 per month, plus VAT | 3 month minimum | You need the role, not the headcount | Enquire → |
| Outsourced DPO, Startup | From £695 a month, plus VAT | 12-month term | A named DPO, month-one setup and a playbook for the DPAs your customers send | Enquire → |
| Outsourced DPO, Scale | From £1,250 a month, plus VAT | 12-month term | Everything in Startup, plus AI feature DPIA reviews and subject access request coordination | Enquire → |
| Introductory pricing, reviewed January 2027. Scaling companies of around 50 to 250 people: Secure Compliance from £1,850 a month + £7.50 per user and Security & Governance from £3,250 a month + £7.50 per user. Extra devices and servers (Secure Compliance and above): £4 each a month. | ||||
All figures exclude VAT.
Programme delivery support: scoped per statement of work
On the Sprint: read what the 8 to 12 weeks assumes, and what ISO 27001 costs in full.
The diagnostic is free, 45 minutes, and the one-page roadmap is yours either way. The price is confirmed on the call and in writing before work begins.
Goldline is not a certification body. An independent, accredited body assesses and certifies.
The certification body charges its own audit fee, which you pay to it direct.
Introductory pricing, reviewed January 2027. The per-user price covers the security tooling on each person's devices and accounts.
For companies certified, or close to it, that need to stay audit-ready.
12-month term, billed monthly. Plus VAT. Introductory pricing, reviewed January 2027.
Two hours of Goldline practitioner time a month are included. Anything beyond that is quoted before it starts.
12-month term, billed monthly. Plus VAT. Introductory pricing, reviewed January 2027.
The per-user price covers one laptop or desktop per person. Extra devices and servers are £4 each.
12-month term, billed monthly. Plus VAT. Introductory pricing, reviewed January 2027.
Price at 10 users: Evidence Essentials £514.50, Secure Compliance £985, Security & Governance £1,585, plus VAT.
Scaling companies of around 50 to 250 people: Secure Compliance from £1,850 a month + £7.50 per user and Security & Governance from £3,250 a month + £7.50 per user. Extra devices and servers (Secure Compliance and above): £4 each a month.
12-month term
Includes a named DPO, the DPA playbook, and the DPO and adviser roles kept separate in writing.
Audit days are set by people in scope under ISO/IEC 27006-1:2024 Annex C. The audit fee is paid to the certification body directly.
| People in scope | Audit days |
|---|---|
| 1 to 10 | 5 |
| 11 to 15 | 6 |
| 16 to 25 | 7 |
| 26 to 45 | 8.5 |
| 46 to 65 | 10 |
| 66 to 85 | 11 |
| 86 to 125 | 12 |
| 126 to 175 | 13 |
| 176 to 275 | 14 |
This is an estimate, not a quotation.
Fixed. Scope confirmed on the free diagnostic.
Every readiness service, including the First Security Questionnaire, credits in full against a Sprint started within six months.
No mobilisation charge and no unagreed change fees.
Certification body audit fees are billed separately and paid to that body directly.
The person who scopes it is the person who delivers it.
Fixed. The scope is agreed on the diagnostic and the price is confirmed in writing before work begins. It does not move afterwards unless the scope changes and both parties agree in writing. Goldline does not bill day rates.
Certification body audit fees are billed separately and paid to the body directly. Any licence needed for your chosen tools is quoted separately and set out in your engagement letter. Your own team's time is the cost most organisations underestimate.
Yes. Every readiness service, including the First Security Questionnaire, credits in full against a Sprint started within six months. The fee is deducted in full from the Sprint price.
The audit fee is separate and is quoted per engagement by the body itself. Audit days are set by the number of people doing work inside the scope, following ISO/IEC 27006-1:2024 Annex C.
No. Goldline is not a certification body and does not issue certificates. Goldline will not audit a management system it implemented, and will not sell implementation and certification to the same organisation for the same scope. The internal audit is carried out by an independent internal auditor appointed by Goldline, never by the team that built your system.
The fixed Sprint fees cover a single legal entity, up to 50 people in scope, one site or cloud hosted. A larger or multi-entity scope is scoped on the free diagnostic. Certification body figures are estimates from the Annex C table rather than quotations and do not bind any certification body.
The diagnostic is free, 45 minutes, and the one-page roadmap is yours either way.
Enter a valid work email.
We use cookies to measure the site and improve it.
We use cookies and similar technologies to measure how this site is used and to measure our advertising. Until you choose, Google tags run in a consent-limited mode that sets no cookies. If you accept, we load Google Analytics 4 and Google Ads with cookies, PostHog, Plausible and Microsoft Clarity, which records session replays. Read our Cookies policy.