How Much Does ISO 27001 Certification Cost in the UK? (2026 Guide)

The Short Answer

Most UK small and medium businesses spend somewhere between £6,000 and £35,000 to get ISO 27001 certified in year one, covering consultancy support, the certification body’s audit fees and internal staff time. A very small business (1 to 10 employees) doing a lean, consultant-supported implementation can land nearer £8,000 to £15,000 all in, while a 50 to 100 person organisation with more complex IT systems typically sees £20,000 to £40,000. The certification body’s audit fee alone is usually £4,000 to £15,000 depending on headcount, because ISO 27006 sets a minimum number of paid audit days based on company size. On top of that, expect annual surveillance audit costs of roughly £2,000 to £5,000 in years two and three. The single biggest lever on your total cost is how much of the work a consultant does versus your own team, so getting a fixed-fee quote based on your actual scope, rather than a generic price list, is the only reliable way to know what you will pay.If you have been quoted anything from “a few thousand pounds” to “£50,000” for ISO 27001, you are not imagining things. The spread is real, and it exists because ISO 27001 certification cost depends on variables that differ from business to business: how many employees are in scope, how mature your existing information security practices already are, whether you use a consultant or build the Information Security Management System (ISMS) in-house, and which certification body you choose. This guide breaks the real cost down by component, so you can see where your money actually goes and where there is room to save.

What Does ISO 27001 Certification Actually Cost? (Short Answer)

ISO 27001 certification cost has three separate components, and most price confusion comes from people quoting only one of them:

1. Certification body audit fees, paid to the UKAS-accredited body that carries out your Stage 1 and Stage 2 audits and, later, your annual surveillance visits.Consultancy or internal implementation costs, covering the gap analysis, risk assessment, policy writing and staff training needed to build a working ISMS.Ongoing maintenance costs, including annual surveillance audits, internal audits, and the three-yearly recertification audit.

For a typical UK small business (1 to 25 employees) working with a consultant, industry data from information security specialists puts certification body audit fees at roughly £3,500 to £7,000 for the combined Stage 1 and Stage 2 audit in year one, based on the mandated audit-day calculation in ISO 27006. Consultancy support for a full ISMS build-out commonly runs £5,000 to £12,000, though a narrower gap-analysis-only engagement can be as little as £1,000 to £2,500. Put together, most SMEs in the 10 to 50 employee range land between £11,000 and £18,000 in their first certification year when using some consultancy support, according to recent UK cost analyses. Larger or more complex organisations, or those needing a full external build with no in-house security resource, can see costs rise towards £40,000 or more.

ISO 27001 Certification Cost by Company Size

Certification bodies calculate audit fees using mandated audit days, not a flat rate, which is why cost scales fairly predictably with headcount. The table below combines audit-day guidance from ISO 27006 with typical UK market rates to give a realistic year-one range.

These are indicative UK market ranges, not a quote. Your actual cost depends on the scope of your ISMS, how many locations and systems are in scope, and how much preparation work your team can absorb internally. HSEQ Support provides a free, no-obligation quote once we understand your specific scope.

What Drives ISO 27001 Cost Up or Down?

Six factors explain most of the variation between a £6,000 certification and a £40,000 one.Company size and headcount matters most directly, because certification bodies set minimum audit days against employee numbers under ISO 27006, so a larger organisation simply requires more paid auditor time regardless of how well-prepared it is.Your starting point matters almost as much. A business that already has documented IT policies, access controls and a basic risk register will need far less consultancy time than one starting from nothing, because most of the ISMS documentation and evidence-gathering work is already partly done.Scope and complexity of your information systems, including how many locations, cloud environments, third-party suppliers and data types fall inside your ISMS boundary, directly affects how many controls from Annex A need to be implemented and evidenced.Consultant versus DIY versus in-house hire changes the cost profile completely. A do-it-yourself toolkit approach can cost as little as a few hundred pounds for templates, but demands significant internal staff time to complete correctly. A traditional consultant engagement for a full implementation typically costs £5,000 to £40,000 depending on scope, while hiring a dedicated internal resource can cost £40,000 or more per year in salary alone, which only makes sense for larger organisations planning ongoing security work beyond certification.Certification body choice affects price too. UKAS-accredited bodies vary in day rates, and 2026 has seen average auditor day rates rise to around £1,250, so comparing quotes from more than one accredited body is worth doing.Penetration testing and technical assurance, while not always mandatory for certification itself, are frequently requested by clients or built into a sensible ISMS and typically add £1,500 to £5,000 depending on the scope of systems tested.

ISO 27001 Certification Cost: What’s Included at Each Stage

Preparation and Gap Analysis

Before implementation starts, most businesses commission a gap analysis to see how far their current practices sit from ISO 27001’s requirements. This typically costs £1,000 to £3,500 depending on business size and is worth doing even if you plan to implement most of the work internally, because it stops you spending consultancy budget on areas you have already covered.

Implementation and ISMS Build

This is the largest and most variable cost. It covers writing your Information Security Policy, risk assessment and Statement of Applicability, the mandatory documented procedures, staff security awareness training (often priced per employee, roughly £30 to £50 each), and implementing the technical and organisational controls from Annex A that apply to your scope. Full consultancy-led implementation for an SME typically runs £5,000 to £12,000.

Certification Audit (Stage 1 and Stage 2)

Your certification body runs a Stage 1 documentation review followed by a Stage 2 on-site (or remote) assessment of whether your ISMS is actually operating as documented. Combined, this is the £3,500 to £15,000-plus range set out in the table above, scaled to your headcount.

Ongoing Maintenance: Surveillance and Recertification

Certification does not end the spending. UKAS-accredited certificates require annual surveillance audits in years one and two of your three-year cycle, typically costing roughly a third of your original certification audit fee, commonly £2,000 to £5,000 a year. Year three brings a full recertification audit, priced similarly to your original certification. Add mandatory internal audits (often outsourced for objectivity, £800 to £2,500 a year) and you should budget total annual maintenance of roughly £3,000 to £8,000 for a typical SME.

Is It Cheaper to Do ISO 27001 Yourself?

In theory, yes. In practice, it depends on what your team’s time is worth. A DIY toolkit of templates and guidance documents can cost as little as £500, and a confident, security-literate team can use it to build most of the required documentation without external help. The trade-off is time: most SMEs underestimate how many hours a proper risk assessment, Statement of Applicability and evidence trail actually take, and a failed or delayed Stage 2 audit because of gaps in that documentation ends up costing more in re-audit fees and lost time than a modest consultancy engagement would have. A middle path many businesses use is buying a template toolkit to speed up documentation, then paying a consultant for a shorter, targeted engagement to review the work and prepare the team for audit, which keeps costs down without carrying all the risk internally.

How to Reduce ISO 27001 Certification Costs

A few practical moves genuinely lower the bill without cutting corners on the standard.Start with a proper gap analysis so consultancy time is spent only on genuine gaps, not re-covering ground you have already done.Scope your ISMS carefully. Certifying only the business unit, product or location that actually needs ISO 27001, rather than your entire organisation by default, reduces both consultancy time and audit days.Get quotes from more than one UKAS-accredited certification body, since day rates and minimum engagement terms vary meaningfully between them.Build internal capability alongside consultancy support, so your team can maintain the ISMS and prepare for surveillance audits without paying for repeat consultant visits every year.Bundle information security training into your annual calendar rather than a one-off pre-audit rush, since planned training is cheaper per head than reactive, urgent sessions before a deadline.

How Long Does ISO 27001 Certification Take?

Most UK businesses complete initial ISO 27001 certification in three to six months from kick-off to certificate, depending on how mature your existing security practices are and how much internal resource you can dedicate to the project. Businesses starting from a strong baseline, with existing IT policies and a reasonably mature risk register, sometimes complete in closer to eight to ten weeks. Organisations building an ISMS entirely from scratch, particularly across multiple sites or complex IT environments, should plan for the fuller six-month timeline.

Frequently Asked Questions

Is ISO 27001 certification mandatory in the UK?

No, ISO 27001 is a voluntary certification. However, it is increasingly required or strongly preferred by clients, particularly in the public sector, financial services, legal and IT supply chains, where holding certification is often a tender prerequisite rather than a nice-to-have.

What is the cheapest way to get ISO 27001 certified?

Combining a DIY documentation toolkit with a short, targeted consultancy engagement for review and audit preparation is typically the lowest-cost route that still carries acceptable risk. Going fully DIY is cheaper still but increases the risk of documentation gaps causing delays or a failed Stage 2 audit.

Does ISO 27001 certification cost include VAT?

Most UK consultancy and certification body quotes are shown excluding VAT, so always confirm whether a quoted figure is ex-VAT before comparing prices between providers.

How much does ISO 27001 cost for a small business with under 10 employees?

Based on current UK market data, small businesses in this bracket typically spend £8,000 to £15,000 in year one when using consultancy support, made up of certification body audit fees of roughly £3,500 to £6,250 plus consultancy costs of £3,000 to £8,000.

Do I need to renew ISO 27001 certification every year?

Your certificate is valid for three years, but you must pass annual surveillance audits in years one and two to keep it valid, followed by a full recertification audit in year three. Missing a surveillance audit can result in certificate suspension.

Can I get ISO 27001 certified without a consultant?

Yes, it is possible, and some well-resourced, security-literate businesses do it successfully using a documentation toolkit and internal project ownership. Most SMEs find a hybrid approach, combining some DIY work with targeted consultancy support at the trickiest stages, achieves the best balance of cost and audit success.

Get an Accurate ISO 27001 Cost for Your Business

Generic price ranges are useful for budgeting, but the only way to know exactly what ISO 27001 certification will cost your business is to get a quote based on your actual scope, headcount and current security maturity. HSEQ Support’s chartered consultants carry out a free, no-obligation gap analysis conversation, map out exactly what your ISMS needs to cover, and give you a fixed-scope quote before any work begins, so there are no surprises partway through your certification journey. If you are also weighing up ISO 27001 against ISO 9001, ISO 14001 or ISO 45001, our guide on ISO 9001 vs 14001 vs 45001: Costs, Differences & Which Standard You Need is a useful next read

Get Your Free ISO 27001 Quote from HSEQ Support