Prices and day rates read 24 September 2026
What ISO 27001 software includes, and what you pay the auditor separately
The software price buys the management system. The certificate comes from an accredited certification body, which you contract and pay yourself.
- Short answer
- Two bills
In €249/mo excl. VAT: every feature, unlimited people, the frameworks on the registry and support. Paid separately, to others: the certification audit, the text of the standard, and anything the auditor asks you to buy.
- Who it is for
- Anyone putting together a first ISO 27001 budget.
- What to do
- Price the audit from your headcount first, then the software, then your own people's time.
In €249/mo
- Every feature, no tiers
- Unlimited people
- ISO 27001, ISO 42001 and ISO 9001 included, NIS2 mapped, CRA reporting inside
- Hosted in the EU
- No minimum term
- Support included: email, answered within one business day by the people who build the product
Paid separately, at 10 people
- The certification auditAn accredited certification body
- €6,000 to €10,000
- Your own people's timeYour company
- €10,500 to €20,900
- A copy of ISO/IEC 27001A national standards body
- €138 to €166
- A penetration test, if the auditor asks for oneA testing firm · optional, not in the total
- €2,500 to €3,500
- A trained implementer, if you want oneA training provider · optional, not in the total
- €2,800 to €3,200
Sources, read 24 September 2026: heydata, Eurostat, Austrian Standards, DIN Media, Sectricity, Cyber Academy
The audit fee by headcount
Auditor days from ISO/IEC 27006-1:2024 Annex C, at €1,200 to €2,000 a day, the range read on 24 September 2026.
| People in scope | Auditor days | Initial audit | Each surveillance year |
|---|---|---|---|
| 10 | 5 | €6,000 to €10,000 Each surveillance year: €2,000 to €3,300 | €2,000 to €3,300 |
| 25 | 7 | €8,400 to €14,000 Each surveillance year: €2,800 to €4,700 | €2,800 to €4,700 |
| 65 | 10 | €12,000 to €20,000 Each surveillance year: €4,000 to €6,700 | €4,000 to €6,700 |
| 125 | 12 | €14,400 to €24,000 Each surveillance year: €4,800 to €8,000 | €4,800 to €8,000 |
The audit fee for your exact headcountFind an accredited auditor
StandardOS is software. It does not certify; an accredited certification body does, and you pay it directly.
Questions
- Can the software vendor issue the certificate?
- No. Certification comes from an accredited certification body you contract with separately. A certificate from a body that is not accredited is not certification.
- Is the audit a one-off?
- No. A shorter surveillance audit follows in each later year of the cycle, then recertification. At 10 people a surveillance year is €2,000 to €3,300.
- Does the price change if we add a framework?
- No. Every framework on the registry is in the one price, 12 of them, and the price is per organization, not per seat.
Build the system first; book the auditor when it is ready
No card to start · cancel in-app anytime