The cheapest ISO 27001 certification worth having is a quote from a body accredited for ISO/IEC 27001 whose auditor days match ISO/IEC 27006 Annex B for your headcount: about 5 days for up to 10 people, 7 for 16 to 25, 10 for 46 to 65 and 12 for 86 to 125, at roughly 1,200 to 1,800 EUR per day across European bodies. A quote far below that band means fewer days, a narrower scope than you asked for, or a body not accredited for this standard, and a non-accredited certificate is one procurement teams reject.
Get three quotes, and compare the days
Ask each body for the number of auditor days behind the number, split into Stage 1 and Stage 2. That is the honest unit. Accreditation holds certification bodies to the audit-time chart in ISO/IEC 27006 Annex B, which reads roughly:
| People | Auditor days |
|---|---|
| up to 10 | 5 |
| 16 to 25 | 7 |
| 46 to 65 | 10 |
| 86 to 125 | 12 |
At 1,200 to 1,800 EUR per day across accredited European bodies, two quotes for the same headcount should land in the same region. One that is dramatically lower is usually fewer days, a narrower scope than you asked for, or a body whose accreditation does not cover what you need.
The check that matters more than the price
Accreditation, and for this standard specifically. A body accredited for ISO 9001 is not thereby accredited for ISO/IEC 27001. Accreditation is granted per standard, and a certificate from an unaccredited body is a document your customer's security team may simply decline.
Check the scope yourself in the accreditation body's public register rather than taking a sales claim for it. How to find and verify one walks through the registers.
Budget the cycle, not the audit
A certificate lasts three years and carries surveillance audits at roughly a third of the initial audit time each year, then recertification at about two thirds. The cheapest first audit is not the cheapest three years if the body is difficult to work with, and switching bodies mid-cycle usually means paying for a transfer audit.
What you cannot buy your way out of
The records. Certification turns on whether your management system is operating and whether you can show it, over a period. That is the part no quote covers and no discount reduces, and it is where the internal cost sits. Our clause-by-clause coverage states what we hold for you and, just as importantly, what we do not.