Figures as read on 19 October 2026
Short answer. Published ISO 27001 numbers disagree. One provider gives £5,000 to £11,000 for initial certification. A consultancy that works from audit-day tables at a £1,250 day rate shows £6,250 for a one-person scope up to £12,500 for 46 employees. Neither is a certification body price list. Scope and headcount decide the audit days.
Published ranges
| Source | What it says | Caveat |
|---|---|---|
| Citation ISO Certification (cost page) | Initial certification £5,000 to £11,000 depending on size and scope. Annual fee £1,500 to £2,500. Audit fees "typically start in the low thousands of pounds, rising into the tens of thousands". | Provider states ASCB accreditation, not UKAS. Includes support packages. |
| GRC Solutions (consultancy), article of 26 November 2025 | Audit days for Stage 1 and Stage 2 by employees, priced at "a typical day rate of £1,250". Table below. | A consultancy, not a certification body. States that actual fees vary with the body appointed and the risk it associates with your ISMS. |
Audit days and illustrative cost, from GRC Solutions
| Employees in scope | Audit days (Stage 1 + 2) | At £1,250 a day |
|---|---|---|
| 1 | 5 | £6,250 |
| 11 | 6 | £7,500 |
| 16 | 7 | £8,750 |
| 26 | 9 | £11,250 |
| 46 | 10 | £12,500 |
| 66 | 11 | £13,750 |
| 86 | 12 | £15,000 |
| 126 | 13 | £16,250 |
| 426 | 17 | £21,250 |
The source lists the band start (for example, "11" means 11 to 15 employees) and rounds to whole days. It notes that, under the ISO 27006 rules, the minimum audit duration "may be 70%% of the recommended time". We show these as an illustration of how days scale with headcount. They are not a quote and we have no evidence any certification body charges £1,250 a day.
What moves the number
- Headcount in scope. More people means more interviews and sampling.
- Scope. A narrow scope (one service) is quicker to assess than an organisation-wide ISMS.
- Locations. Multi-site organisations may need audits at several offices.
- Technical complexity. Highly digital or bespoke environments can need deeper testing.
- Maturity. Starting from nothing needs more preparation time and support.
- Remote or on-site audits. Citation says remote or part-remote audits can reduce travel and time costs.
- The body. ISOQAR's own ISO 27001 page says "There is no fixed cost" and offers a tailored quote; DNV says cost depends on size, complexity and the extent of external support.
What we could not find
No certification body we reviewed publishes an ISO 27001 price table. The day rates and the audit-day table above are from a consultancy, so we have not treated them as a body's tariff. Ask for the audit days a body has calculated for your scope and the fee for years two and three.