ISO/IEC 27001:2022

ISO 27001 Cost & Timeline Estimator

Estimate certification-audit fees, internal ISMS effort, and a realistic timeline for ISO 27001.

What ISO 27001 certification costs

The total has four parts, and only one of them is the certificate:

Cost	What it is	Who sets it
Certification audit	Stage 1 (documents and readiness) and Stage 2 (is the ISMS working?)	An accredited certification body, per audit day
Surveillance audits	Shorter audits in each of the next two years	The same certification body
Internal effort	Scope, risk assessment, Statement of Applicability, policies, internal audit, management review	Your team's time, or an ISMS consultant
Fixing gaps	The controls you do not have yet, from MFA and logging to supplier reviews	Depends on how far you start from

The calculator above gives budgeting ranges for these. They are estimates, not quotes: no official fee schedule exists, and certification bodies price their own audit days.

How the audit length is set

Certification bodies calculate ISMS audit time from ISO/IEC 27006-1:2024, mainly from the number of people working within the scope, adjusted for complexity and the number of sites. As a rough guide, it starts at about five audit days for under ten people and rises to fourteen or more around 200 people. An audit day is eight hours, and the body cannot cut below 80% of the calculated time. When you compare quotes, ask each body how many audit days it is quoting: a cheaper quote with fewer days is not the same audit.

How long it takes

Readiness: from a few months, if you already have good security practice, to most of a year from a standing start.
Operating the ISMS: the certification body will want to see it running, including an internal audit and a management review, before Stage 2.
Stage 1, then Stage 2: usually a few weeks apart, with time between to fix anything Stage 1 finds.
Certificate: valid for three years, with surveillance audits in years two and three and a recertification audit in year three (ISO/IEC 17021-1).

How to keep the cost down

Scope tightly: the people and sites in scope drive the audit days.
Fix the technical gaps before Stage 1, not between Stage 1 and Stage 2.
If you need SOC 2 as well, build the controls once: the two share most of their evidence.
Ask several accredited bodies for quotes, and compare their audit-day counts.

FAQ

Which edition should we certify against?

ISO/IEC 27001:2022 with its 2024 amendment. The transition from the 2013 edition ended on 31 October 2025.

How many controls are there?

93 in Annex A, grouped into four themes (organisational, people, physical and technological), described in ISO/IEC 27002:2022. Your Statement of Applicability records which apply.

Does the certificate cost include consultancy?

No. The certification body only audits; it cannot also help you build the ISMS. Implementation help comes from your own team or a separate firm.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Certification audit (Stage 1 + Stage 2): a fee band for your company size, plus US$2,000-5,000 for every location in scope beyond the first.
Surveillance audits in years 2 and 3: 30% of the low end to 40% of the high end of that audit band, per year.
Internal ISMS effort (policies, risk assessment, Statement of Applicability, internal audit) comes from company size alone.
Timeline to certificate comes from your maturity answer, plus 1-2 months for 101-500 staff and 2-3 months for 500+.
The cloud answer adds a shared-responsibility note only; it does not change any figure.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Stage 1 + 2 audit, 1-20 / 21-100 / 101-500 / 500+ staff: US$5k-12k / 10k-25k / 20k-40k / 30k-50k
Each extra location: +US$2,000-5,000
Surveillance audit per year: 30%-40% of the initial audit band
Internal effort, same size bands: 10-20 / 20-40 / 40-80 / 80-150 person-weeks
Timeline: no controls / some policies / mostly compliant: 12-18 / 8-14 / 6-9 months

Worked example

The calculator run on its default inputs:

Company size (employees): 21-100
Number of locations in scope: 1
Current compliance maturity: Some policies / partial controls
Scope includes cloud infrastructure / SaaS operations: Yes

ISO 27001 certification estimate

US$10,000-US$25,000

Stage 1 + Stage 2 certification audit: US$10,000-US$25,000
Internal ISMS effort: 20-40 person-weeks
Surveillance audits (years 2 & 3, per year): US$3,000-US$10,000
Typical timeline to certificate: 8-14 months

For a 21-100 person company with one location, some policies in place and cloud in scope, the certification audit band is US$10,000-25,000 (no extra-site uplift). Surveillance audits are 30% of US$10,000 to 40% of US$25,000, so US$3,000-10,000 a year. Internal effort is 20-40 person-weeks and the timeline 8-14 months.

Sources

ISO/IEC 27001:2022 (ISO) - the ISMS requirements you are certified against
ISO/IEC 27002:2022 (ISO) - the 93 Annex A controls in four themes
ISO/IEC 17021-1:2015 (ISO) - the three-year certification cycle with surveillance audits and recertification
ISO/IEC 27006-1:2024 (ISO) - how certification bodies set ISMS audit time

Sources last checked September 2026.

Limitations

Real audit time, and so the fee, is set by the certification body from the audit-time rules in ISO/IEC 27006-1 using effective headcount, complexity and sites; this tool uses flat bands instead. Consultancy and remediation spend are not included. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.