What should ISO 27001 certification cost?
Pick your headcount and a day rate. For 50 people, the first 3 years cost about €17,188-39,004.
A fair quote for 50 people
First 3 years, audits and fees
€29,405
At €1,590 per day, with no travel. All public rates give €17,188-39,004.
- Stage 1 + Stage 2
- about 10 days
- Lowest a body can justify
- 7 days
- Surveillance, years 2 and 3, each
- about 3.5 days
- Recertification, end of year 3
- about 7 days
Get the fair-quote sheet as a PDF
The estimate, line by line
Audit days of a fair quote
- Below 7 days: more than the allowed reductions
- 7-10 days: reduced, needs recorded reasons
- 10 days: starting point for 50 people
3-year cost at public day rates
| Line | Low | Typical | High |
|---|---|---|---|
| Day rate | €925 | €1,590 | €2,101 |
| Year 1: Stage 1 + 210 days | €9,250 | €15,900 | €21,010 |
| Year 2: surveillance3.5 days | €3,238 | €5,565 | €7,354 |
| Year 3: surveillance3.5 days | €3,238 | €5,565 | €7,354 |
| Feesapplication, certificate, admin | €1,463 | €2,375 | €3,287 |
| Total, 3 years | €17,188 | €29,405 | €39,004 |
| Then: recertification | €6,475 | €11,130 | €14,707 |
What else moves the price
-
Headcount, slowly
10 times the people need less than twice the days.
Audit days by headcount -
Fees and travel
Fees add a few hundred to 2,000 or more. Travel at cost adds the most.
The fees outside the day rate -
Scope and risk
Complex IT or critical data add days. A simple scope can lose up to 30%, with recorded reasons.
When a cheap quote is a risk