The certification body's audit fee, not ours

What ISO 27001 certification actually costs

Free, no account.

A 25-person company: 7 auditor days for Stage 1 and Stage 2; €8,400 to €14,000 for initial certification; €14,000 to €23,300 over the three-year cycle with two surveillance audits, audit fees only.

Our price:

StandardOS is €249/mo flat, on top of whatever the auditor charges; the numbers below are the auditor's.

Sources

ISO/IEC 27006-1:2024 Annex C
Day rates read 24 September 2026
All-in figures read 24 September 2026

People doing work under your control, in ISMS scope

Count contractors and freelancers, not just employees. The 2024 edition is explicit about this, and it is the mistake that most often pushes a company into the next band.

Sites in scope

Scope complexity

SimpleTypicalComplex

Auditor days (Stage 1 + Stage 2): 7
Initial certification: €8,400 – €14,000
Surveillance audit, years 2 and 3: €2,800 – €4,700 / yr
Three-year total, audit fees only: €14,000 – €23,300

Ready for the auditor on every day of the cycle, not only in audit week

Start your compliance system What's included

No card to start · cancel in-app anytime

Or have it done with you: ISO 27001 gap assessment, €1,200, 10 working days

Your three years, audit fees only

€8,400 – €14,000Initial certification

€2,800 – €4,700Surveillance audit, years 2 and 3

€14,000 – €23,300Three-year total, audit fees only

The three-year certificate cycle

Stage 1 audit
Stage 2 audit7 auditor days, stages 1 and 2€8,400 – €14,000
Certificate
Surveillance, year 1about 2.3 auditor days€2,800 – €4,700
Surveillance, year 2about 2.3 auditor days€2,800 – €4,700
Recertification, year 3

Auditor days for 25 people in scope, ISO/IEC 27006-1:2024 Annex C; surveillance is about a third of the initial audit.

Stage 1 audit + Stage 2 auditSurveillance, year 1Surveillance, year 2

Day counts from the audit-time chart in ISO/IEC 27006-1:2024 Annex C; surveillance is about a third of the initial audit and recertification at least two thirds, per the same annex. Day rates of €1,200–€2,000 are the range across published practitioner sources for accredited bodies in Europe. Nobody publishes an official figure, which is exactly why you should get three quotes on an identical brief. Travel is billed on top. The band can legitimately be cut by up to 30% for a simple, single-site, mature scope, and no further: that floor is in the annex too.

Or have it done with you: ISO 27001 gap assessment, €1,200, 10 working days

With you at each step

Every step you just priced, in one place

1 The scope
The scope statement, written from your answers.
2 The policies
Drafted from your answers, approved and kept current.
3 The evidence
Read every day from the tools you already run.
4 The audit
The Statement of Applicability and the audit pack, ready on the day.
5 The auditor
Your auditor reads every record and changes none, from a start date to an end date.

What sets the number

People in scope

Count contractors and freelancers, not just employees. The 2024 edition is explicit about this, and it is the mistake that most often pushes a company into the next band.

Sites in scope · Scope complexity

The sites and complexity adjustments are StandardOS's assumptions, half a day per additional site and a fifth either way for complexity, not the annex's factors; a certification body applies its own under ISO/IEC 27006, so ask every quote to state its days.

Where the numbers come from

The days: the audit-time chart in ISO/IEC 27006-1:2024 Annex C, by the people in scope, which accreditation bodies hold certification bodies to. The rate: €1,200 to €2,000 a day, the range across published European sources read on 24 September 2026, because no accredited body publishes one. Surveillance: about a third of the initial audit each year.

What you pay, and to whom

What the audit fee pays for

Stage 1, the review of your documented system and its readiness.
Stage 2, the audit of the running system against the standard, on site or remote.
The audit report, the certification decision and the certificate.
The surveillance audits in years two and three, at about a third of the initial days each.

StandardOS does not certify; an accredited body does, and you pay them directly.

What else you will spend

A penetration test, expected by auditors and by your customers, typically €2,500–€5,000 for a SaaS application.
The standard itself, around €130 for ISO 27001; you will want ISO 27002 too.
Auditor travel and expenses, billed separately from the day rate.
Your own people's time, which is the largest cost and appears in nobody's quote. Reducing it is what we sell.

What is not in it. The penetration test, the standard's own text, the auditor's travel, and your own people's time, which is the largest line and appears in nobody's quote. A certificate from a body that is not accredited costs less and is not certification. The card below prices all but the travel.

The audit fee is the big number. The software is not.

What you have just worked out is paid to a certification body, not to us. StandardOS is €249/mo excl. VAT, flat, and its job is to cut the largest cost on this page, your own people's time, which appears in nobody's quote.

What it costs all in

The audit fee is one line of the budget. These are the others, at your headcount.

All-in cost by headcount, year one and a later year
People in scope	Year one	Years two and three, each
up to 10	€19,600 – €34,100	€5,000 – €6,300
up to 25	€22,000 – €38,100	€5,800 – €7,700
up to 65	€25,600 – €44,100	€7,000 – €9,700
up to 125	€28,000 – €48,100	€7,800 – €11,000

The certification auditStage 1 and Stage 2, the annex's days at the day rate. A third of it again in each surveillance year. Ours, computed on this page.: €8,400 – €14,000
Your own people's time300 to 600 hours to build the management system, at €34.90 an hour, the EU average hourly labour cost including employer contributions. heydata and Eurostat, read 24 September 2026.: €10,500 – €20,900
A copy of the standardOne single-user PDF of ISO/IEC 27001:2022, excluding VAT, as two national standards bodies price it. Austrian Standards and DIN Media, read 24 September 2026.: €138 – €166
StandardOS for a year€249/mo, the policies, the evidence and the audit pack. Ours, computed on this page.: €2,988
A penetration testnot in the totalOne small web application in a single scope. The same price lists run past €20,000 for a large one. Sectricity, read 24 September 2026.: €2,500 – €3,500
A trained implementernot in the totalOne seat on a five-day lead implementer course, materials, exam and one retake. Cyber Academy, read 24 September 2026.: €2,800 – €3,200
A consultantnot in the totalTen to twenty project days at the rate the same source prints. heydata, read 24 September 2026.: €15,000 – €35,000

Two lines are ours: the audit fee, which is the annex's days at the day rate, and our own price. The other five were read from the sources linked beside them and none of them is ours to set. The rate on the time line is the EU average in every language on this site, because a language is not a country: the same release puts national rates between €12.00 and €56.80 an hour, so adjust that line by yours. Not in it: your own time in years two and three, because no source we would quote prints a maintenance figure, and the auditor's travel, which a quote states. The source that gives the hours gives its own first-year total for a small company, €15,000 to €60,000, read 24 September 2026. Every figure here is EUR, excluding VAT.

The audit fee by company size

Every band of the chart, one site, typical complexity, at €1,200 to €2,000 a day: the initial audit, each surveillance year, and the three-year total.

Auditor days and audit fees by headcount band
People in scope	Auditor days	Initial certification	Surveillance, per year	Three-year total
up to 10	5	€6,000 – €10,000	€2,000 – €3,300	€10,000 – €16,700
up to 15	6	€7,200 – €12,000	€2,400 – €4,000	€12,000 – €20,000
up to 25	7	€8,400 – €14,000	€2,800 – €4,700	€14,000 – €23,300
up to 45	8.5	€10,200 – €17,000	€3,400 – €5,700	€17,000 – €28,300
up to 65	10	€12,000 – €20,000	€4,000 – €6,700	€20,000 – €33,300
up to 85	11	€13,200 – €22,000	€4,400 – €7,300	€22,000 – €36,700
up to 125	12	€14,400 – €24,000	€4,800 – €8,000	€24,000 – €40,000
up to 175	13	€15,600 – €26,000	€5,200 – €8,700	€26,000 – €43,300
up to 275	14	€16,800 – €28,000	€5,600 – €9,300	€28,000 – €46,700
up to 425	15	€18,000 – €30,000	€6,000 – €10,000	€30,000 – €50,000
up to 625	16.5	€19,800 – €33,000	€6,600 – €11,000	€33,000 – €55,000
up to 875	17.5	€21,000 – €35,000	€7,000 – €11,700	€35,000 – €58,300
up to 1175	18.5	€22,200 – €37,000	€7,400 – €12,300	€37,000 – €61,700

Five mistakes that change the bill

Counting only employees: contractors and freelancers in scope count too.
Buying a certificate from a body that is not accredited.
Comparing quotes without asking for the auditor days and the edition.
Planning less than three months before Stage 2.
Taking accreditation for certification: you pay for certification.

How this is calculated

The fee: auditor days × day rate

No accredited certification body publishes its prices. DNV, Bureau Veritas, DQS, TÜV, BSI, Intertek, SGS, LRQA and Dekra all quote on request, so you cannot budget before the sales calls start. The fee is still auditor days × day rate, and the days are set by the audit-time chart in ISO/IEC 27006-1:2024 Annex C, which the accreditation body holds the certifier to, so you can compute your own number before anyone quotes you.

ISO/IEC 27006 is international, so the day count holds in any country; the euro band is what practitioners publish for Europe. Certifying elsewhere, keep the days and put your own quoted rate through the same arithmetic.

Every number above is auditor days × day rate. The days come from ISO/IEC 27006, which fixes them by headcount; the €1,200–€2,000 band is the range across published practitioner sources for accredited bodies in Europe, and no certification body publishes its own. The arithmetic is on this page precisely so you can redo it with a rate you have been quoted rather than ours. If a body quotes you far outside these ranges, ask them how many auditor days they have allocated and which edition of ISO/IEC 27006 they applied.

How long it takes

Four to seven months is realistic for a small software company using tooling. The floor is around three months and it is a hard floor, for a reason worth understanding: Stage 2 samples your records. Clause 9.2 requires an internal audit and 9.3 a management review, and an auditor cannot sample a management review that has not happened. No software can compress that. What software can remove is the two-to-six months of building policies, the risk register and the SoA that normally comes first.

The trap worth naming

Nothing stops a company calling itself a certification body and selling certificates. A non-accredited certificate looks identical, costs roughly 40–50% less, and is routinely rejected in enterprise procurement, at which point you pay the full accredited fee again, because an unaccredited certificate generally cannot be transferred. Every EU country has one national accreditation body, named under Regulation (EC) 765/2008 and listed by European co-operation for Accreditation: DAkkS in Germany, COFRAC in France, RvA in the Netherlands, ENAC in Spain, ACCREDIA in Italy. Check your certifier on that register, or internationally via IAF, before you sign anything.

How to find an accredited certification body, and check them yourself

Worked examples

up to 10 people → 5 auditor days
16–25 people → 7 auditor days
46–65 people → 10 auditor days
86–125 people → 12 auditor days

Reproduced as worked examples rather than as the chart itself, because ISO/IEC 27006 is copyrighted and we are not going to republish it. Check them against your own copy.

The questions people ask

How much does ISO 27001 certification cost?

Auditor days times a day rate, and the days are set by headcount: about 7 days for a 20-person company, €8,400 to €14,000 for the initial certification, and about 12 days for a 100-person company, €14,400 to €24,000. Surveillance audits in years two and three cost about a third of that each.

What does an ISO 27001 audit cost per day?

No accredited certification body publishes a day rate; across published European sources the range is €1,200 to €2,000. The days are the fixed part: the audit-time chart in ISO/IEC 27006-1:2024 Annex C sets them by the people in scope, so two quotes for the same company should show the same days and differ only in the rate.

What is the ISO 27001 accreditation cost?

Accreditation is what a certification body pays its national accreditation body to be allowed to certify; a company pays for certification, not accreditation. When the search says accreditation cost it means the certification fee above, and the accreditation that matters to a company is the body's: check it in the national register before you sign.

What are the ISO 27001 certification fees per year?

Year one is the initial audit, Stage 1 and Stage 2. Years two and three are surveillance audits at about a third of the initial days each. Year four is recertification at about two thirds, and the cycle starts again. The software and your own people's time run every year and are not in the audit fee.

How much does ISO 27001 cost for a small company?

For up to 10 people in scope the chart gives 5 auditor days, so €6,000 to €10,000 for the initial certification and about a third of that in each surveillance year. Counting contractors and freelancers as people in scope is the mistake that most often moves a small company into the next band.

Does the ISO 27001 cost depend on the industry?

Barely. Headcount sets the days; the certification body can adjust for the complexity of the scope, the number of sites and the reliance on outsourcing, and travel is billed on top. Industry moves the price only through those factors.