SimplISO › ISO 27001 certification cost
Straight answers, no quote formISO 27001 is the most expensive of the four standards, and for a real reason rather than a pricing quirk. It is also the one most often asked for by a customer holding a contract. Here is the real arithmetic, and one thing worth checking before you spend anything.
Written for UK businesses. Last updated 22 September 2026.
If you already hold ISO 9001, adding ISO 27001 costs about £4,100 in the first year through a non UKAS certification body, then about £3,500 a year after that.
From a standing start, ISO 9001 and ISO 27001 together come to about £6,492 to first certificate.
It costs roughly double the other standards because it counts as two audit units. The auditor has to cover the management system and then the 93 Annex A controls on top.
Every modern ISO management standard is built on the same skeleton, known as the Harmonised Structure (you may have heard it called Annex SL). Context of the organisation, interested parties, leadership, planning, support, operation, performance evaluation, improvement. The clause numbers line up almost exactly.
If you already run ISO 9001 properly, you have built most of ISO 27001 without knowing it. Document control, competence records, the internal audit programme, management review, corrective action and nonconformity handling all carry straight across. You do not build any of it twice.
That is why we ask clients to certify to ISO 9001 first and add the rest onto it. The quality system is the spine. Bolting ISO 27001 onto a spine that already works is a fraction of the effort of building a standalone system, and your certification body audits both in one visit rather than turning up twice and charging twice.
So the useful question is not what ISO 27001 costs. It is what ISO 27001 adds.
Four things move when you add a standard to a system you already run. Your subscription steps up a tier, your consultant internal audit has more ground to cover, the certification body audits the new standard once, and your annual surveillance goes up to match.
| What changes | Non UKAS body | UKAS accredited |
|---|---|---|
| SimplISO subscription | +£200 a month | +£200 a month |
| Consultant internal audit | +£400 a year | +£400 a year |
| Certification body, initial audit | £1,300 once | £3,400 once |
| Certification body surveillance | +£700 a year | +£2,600 a year |
| First year of the addition | £4,100 | £6,200 |
Every year after that, the addition costs about £3,500 through a non UKAS body, or £5,400 through a UKAS accredited one. That is the whole number. There is no separate consultancy invoice, no day rate and no set up fee.
Every other standard here is one audit unit. ISO 27001 is two, and that is not a pricing quirk. It is because the auditor has a whole second body of work to look at.
ISO 9001, 14001 and 45001 are management system standards and nothing more. You build the system, the auditor checks the system. ISO 27001 is a management system standard plus Annex A, a catalogue of 93 individual security controls grouped into organisational, people, physical and technological themes. The auditor checks the system and then works through the controls.
That is why the audit takes longer, why the preparation takes longer, and why we count it as two standards when we price a programme. It is the single most expensive addition on our list, and it is also the one that most often pays for itself, because it is usually a customer holding the contract who is asking for it.
The document that says which of the 93 controls apply to you, which do not, and why. Your certification body reads it before anything else and audits against it. It is the biggest single piece of work and the one worth getting right.
Not the general business risk of ISO 9001. A structured information security risk assessment, asset based or scenario based, with a treatment plan that ties each decision back to a control and an owner.
Where the money is won or lost. Scope it to the product or service your customers are actually asking about, not the entire company. A tight, defensible scope is cheaper to build, cheaper to audit and no less credible.
Access control, cryptography, logging and monitoring, supplier security, secure development if you build software, backup and continuity, incident management. For most small firms this is the part that needs real change rather than documentation.
A lot of businesses arrive at ISO 27001 because a customer sent a security questionnaire or a tender mentioned it. Go back and read exactly what was asked for, because a meaningful share of the time Cyber Essentials Plus will satisfy it, and that is a few hundred pounds rather than a few thousand.
If the customer genuinely wants ISO 27001, it is worth every penny of the difference. If they wanted assurance and named the first thing they thought of, you can save yourself a lot of money by asking. We would rather tell you that on a twenty minute call than sell you a programme you did not need.
Eight of the 93 Annex A controls are People controls, and a proper joiners and leavers workflow evidences most of them in one place. This is the standard where the employee side is worth the most.
| Employee tool | What it evidences |
|---|---|
| Joiners workflow, screening, terms, confidentiality agreement | Controls A.6.1 Screening, A.6.2 Terms and conditions and A.6.6 Confidentiality agreements, captured as someone is set up rather than chased afterwards. |
| Offboarding checklist with timestamped access removal | Control A.6.5 Responsibilities after leaving. This is the single most common finding in a small business audit, the account of someone who left months ago that is still live. A checklist that forces the step and dates it closes that finding for good. |
| Security awareness on onboarding, and refreshers | Control A.6.3 Awareness, education and training. Proof every person had the security training and when. |
| Recorded disciplinary process | Control A.6.4 Disciplinary process, the documented route the standard expects to exist. |
Offboarding is the one to get right first. It is quick to set up, it costs you nothing, and it removes the finding an ISO 27001 auditor is most likely to write up against a business your size. Holiday booking is not an ISO requirement, and we would never pretend it is. It earns its place for a different reason. It is the thing your staff open the platform for every week, so while they are in there booking leave, the competence records and the training log stay current on their own instead of decaying quietly until an auditor asks to see them.
This one is almost always demand led, and the demand is usually specific and traceable to one customer or one bid.
One thing worth saying plainly. ISO 27001 is not a substitute for actually being secure, and certifying a system you have not fixed is an expensive way to paper over a problem. Done properly the certificate is a by product of doing the work, and the work is the bit your customers are paying for.
Everything above assumes ISO 9001 is already in place. If you are starting from nothing and you know you need more than one standard, do them together. One programme, one set of documents, one audit visit.
| What you are certifying | Audit units | Months | To certificate |
|---|---|---|---|
| ISO 9001 on its own | 1 | 4 | £2,196 |
| ISO 9001 plus one other standard | 2 | 6 | £4,144 |
| ISO 9001 plus two others, or 9001 with 27001 | 3 | 8 | £6,492 |
| The full set | 4 | 10 | £9,240 |
An audit unit is one standard, with one exception. ISO 27001 counts as two, because its audit has to cover the Annex A controls as well as the management system. Our pricing calculator runs the same sum with UKAS switched on, and the ISO 9001 cost page breaks the single standard route down line by line.
We are still in our founding period, and the first fifteen registrants get 25% off the whole of their first year, locked in from the first invoice.
Because its audit covers two things rather than one. ISO 9001, 14001 and 45001 are management system standards, so the auditor checks the system. ISO 27001 is a management system standard plus Annex A, a catalogue of 93 individual security controls, so the auditor checks the system and then works through the controls. That is more audit time, more preparation and a bigger internal audit, which is why we price it as two units.
Yes, though the saving is proportionally smaller than it is on the other standards, because the Annex A work is new whatever you already hold. Adding ISO 27001 to a working ISO 9001 system costs about £4,100 in the first year and £3,500 a year after that through a non UKAS certification body, against £6,492 to build both together from a standing start.
Very often, and it is worth checking before you spend anything. Many businesses pursue ISO 27001 because a customer sent a security questionnaire or a tender mentioned certification, when what was actually required is satisfied by Cyber Essentials Plus at a fraction of the cost. Go back and read the exact wording, and if it genuinely specifies ISO 27001 then it is worth the difference.
The document that lists all 93 Annex A controls and records which apply to you, which do not, and the reasoning either way. It is the first thing your certification body reads and the thing they audit you against, so it is the single biggest piece of work in an ISO 27001 project and the one most worth getting right.
More than any other decision you will make. Scope covering one product or service is cheaper to build, cheaper to audit and no less credible than scope covering an entire company, provided it is the part your customers are asking about. Deciding scope carelessly is the most common way a small business ends up paying twice what it needed to.
Twenty minutes on a call and we will tell you what your certification body will charge, what the extra work looks like and whether you need UKAS at all.
Same treatment, real numbers, no quote form.