[{"data":1,"prerenderedAt":14},["ShallowReactive",2],{"article:en:cheapest-way-to-get-iso-27001":3},{"locale":4,"slug":5,"title":6,"description":7,"published":8,"answer":9,"body":13},"en","cheapest-way-to-get-iso-27001","The cheapest way to get ISO 27001, and the part you cannot make cheaper","Most of an ISO 27001 budget is auditor days, and those are set by a published chart rather than by negotiation. Here is what actually moves the number, and what does not.","2026-08-20",{"who":10,"when":11,"do":12},"A company that wants ISO 27001 for the least money: the audit fee is close to fixed before any quote, since ISO\u002FIEC 27006 Annex B sets the auditor days by headcount, 7 days for a 20-person company at roughly 1,200 to 1,800 EUR a day, so about 8,400 to 12,600 EUR for initial certification; what moves the total is the scope, the headcount counted and who does the recurring work.","Before the scope is written and the people are counted, since both set the auditor days, and before the recurring work is contracted out, since your own people's time is the largest line and the one you control.","Keep the scope narrow and truthful, count the people in scope correctly, do the internal audit, the management review and the records yourselves, and spend on the audit days, which cannot be made cheaper, rather than on the parts that can.","\nThe cheapest way to get ISO 27001 is to keep the scope narrow and truthful, count your people correctly, and do the recurring work yourselves, because the audit fee is close to fixed before anyone quotes you: ISO\u002FIEC 27006 Annex B sets the auditor days by headcount, 7 days for a 20-person company, and accredited European bodies charge roughly 1,200 to 1,800 EUR a day, so about 8,400 to 12,600 EUR for initial certification. Software is a small line against that. Your own people's time is the large one.\n\n## The audit fee is arithmetic, not a negotiation\n\nCertification bodies do not price freely. Accreditation holds them to the audit-time chart in ISO\u002FIEC 27006 Annex B, which turns your headcount into a number of auditor days for Stage 1 and Stage 2 combined:\n\n| People | Auditor days |\n|---|---|\n| up to 10 | 5 |\n| 16 to 25 | 7 |\n| 46 to 65 | 10 |\n| 86 to 125 | 12 |\n\nDay rates for accredited bodies in Europe run roughly 1,200 to 1,800 EUR. No accredited body publishes a price, so that band is the spread across published practitioner sources rather than a quote. A 20-person company is therefore looking at something like 8,400 to 12,600 EUR for the initial audit, before anything else.\n\nYou can shop between bodies. You cannot shop your way out of the day count, and a body offering materially fewer days than the chart is a body whose certificate is worth less.\n\nWork your own number on the [cost page](\u002Fiso-27001\u002Fcost), which runs the same arithmetic.\n\n## Then it happens again, twice\n\nCertification is a three-year cycle. Surveillance audits are about a third of the initial audit time, once a year, and recertification at the end is roughly two thirds. Budgeting only for the first audit is the most common way the total surprises people.\n\n## What actually moves the number\n\nThree things, in order of how much they matter.\n\n**Scope.** The audit covers what you say it covers. A scope that includes offices, products and processes the certificate does not need adds days. Write the scope narrowly and truthfully, and defend it at Stage 1.\n\n**Readiness at Stage 1.** A Stage 1 that finds the management system half-built turns into a longer Stage 2, or a second visit. This is the one place preparation converts directly into money.\n\n**Whether the evidence exists on the day.** Auditors ask for records covering the period, not policies written last week. Assembling twelve months of evidence in the week before an audit is where most of the internal cost actually goes, and it is invisible in every budget because it is somebody's salary rather than an invoice.\n\n## Where the money is not\n\nSoftware is a small line next to the audit, whatever you pick. Choosing a tool primarily on price optimises the wrong number: if it does not leave you with dated, complete records at the audit, it has cost you the expensive thing to save the cheap one.\n\nIf you want the honest version of what any tool covers, ask the vendor for a clause-by-clause list including the gaps. [Ours is published](\u002Fiso-27001\u002Fcoverage), gaps included.\n",1789383986172]