[{"data":1,"prerenderedAt":14},["ShallowReactive",2],{"article:en:iso-27001-certification-cost-for-company":3},{"locale":4,"slug":5,"title":6,"description":7,"published":8,"answer":9,"body":13},"en","iso-27001-certification-cost-for-company","ISO 27001 certification cost for a company, by headcount","Auditor days come from the ISO\u002FIEC 27006 Annex B chart, so certification cost tracks headcount more than industry. Here is the arithmetic, and the lines people forget.","2026-08-20",{"who":10,"when":11,"do":12},"A company budgeting ISO 27001 certification: the audit fee is set by headcount through the auditor-day chart of ISO\u002FIEC 27006 Annex B, not by industry, so a 10-person company, a 25-person company and a 65-person company each get a different number for the same standard.","Before the first quote is requested, so that a quote's auditor days can be read against the chart, and again at each surveillance year, since the initial Stage 1 and Stage 2 fee is the first of a three-year cycle rather than the whole cost.","Count the people in scope, read the auditor days for that headcount from the chart, multiply by a day rate of roughly 1,200 to 1,800 EUR, add the surveillance years, and ask each certification body for the days behind its quote rather than the total alone.","\nISO 27001 certification costs a company roughly 6,000 to 9,000 EUR in audit fees at up to 10 people, 8,400 to 12,600 EUR at 16 to 25, 12,000 to 18,000 EUR at 46 to 65 and 14,400 to 21,600 EUR at 86 to 125, for the initial Stage 1 and Stage 2 audits. The days behind those figures are set by ISO\u002FIEC 27006 Annex B and the day rate runs roughly 1,200 to 1,800 EUR across accredited European bodies. Industry barely moves the number. Headcount does.\n\n## The audit line\n\nAccredited certification bodies are held to the audit-time chart in ISO\u002FIEC 27006 Annex B. It maps headcount to auditor days for Stage 1 and Stage 2 combined:\n\n| People | Auditor days | At 1,200 to 1,800 EUR\u002Fday |\n|---|---|---|\n| up to 10 | 5 | 6,000 to 9,000 EUR |\n| 16 to 25 | 7 | 8,400 to 12,600 EUR |\n| 46 to 65 | 10 | 12,000 to 18,000 EUR |\n| 86 to 125 | 12 | 14,400 to 21,600 EUR |\n\nNo accredited body publishes a day rate, so that band is the spread across published practitioner sources for Europe rather than a quotation. Get three quotes. The [cost calculator](\u002Fiso-27001\u002Fcost) runs this arithmetic against your own headcount.\n\n## The lines people forget\n\n**Surveillance.** Roughly a third of the initial audit time, every year, for the two years after certification.\n\n**Recertification.** At the end of year three, roughly two thirds of the initial time.\n\n**Your own people.** The largest cost for most companies and the one that never appears in a budget, because it is salary rather than invoice. Someone writes the policies, runs the internal audit, chases the evidence and sits with the auditor.\n\n**Software, if you use it.** Small next to the above.\n\n## What changes the number\n\nScope is the main lever: the audit covers what you declare, so a scope that includes more sites, products or processes than the certificate needs costs days. Multiple sites can add sampling. A management system that is not ready at Stage 1 can turn into a longer Stage 2.\n\n## The number behind the number\n\nCertification is a judgement about whether your management system operates, evidenced over a period. Companies that find it expensive usually find it expensive twice: once for the audit, and once for the weeks spent assembling records that were never kept as they went. The second one is avoidable and is worth more than any discount on the first.\n",1789383986251]