How much does ISO 27001 certification cost? It's usually the first question a business owner asks, and the honest answer is that there's no fixed price. ISO 27001 certification cost depends on the size of your business, the scope you choose and how close you already are to the standard. Two businesses with the same headcount can end up with very different bills.
What we can do is break the cost into its parts. Once you can see where the money and time actually go, it's much easier to budget sensibly, ask the right questions of consultants and certification bodies, and avoid paying for work you don't need.
This guide sets out what to expect: the five parts of the cost, what pushes the price up or down, how the three-year certification cycle affects your budget, and practical ways to keep the cost down. You won't find dollar figures here, because there's no reliable source we'd stand behind. Instead, you'll come away knowing exactly what to ask for when you request quotes.
Is there a set price for ISO 27001 certification?
No. There's no published price list for ISO 27001 certification in Australia, because no two certification projects are the same. You won't find a reliable dollar figure that applies to every business, and we'd be wary of anyone quoting one before they've looked at your setup.
Why do quotes vary so much?
Quotes vary because the work varies. A certification body prices its audit mostly on how many people and sites are in scope and how complex the systems are. A consultant prices on how much documentation, risk assessment and remediation work you need help with. And your own internal costs depend almost entirely on your starting point.
What should a quote actually include?
A useful quote spells out what's covered and what isn't. Ask whether it includes the stage 1 audit, the stage 2 audit, surveillance audits and the recertification audit, or just the first year. Ask what happens if the auditor finds a major nonconformity. And for consultants, ask exactly which documents and controls they'll deliver, and which ones they'll expect you to own.
The five parts of ISO 27001 certification cost
Most of the cost of getting ISO 27001 certified falls into five buckets. Some appear on an invoice. Others don't, but they're just as real.
1. Your own team's time
Someone has to own the information security management system (ISMS). That means writing and approving policies, running the risk assessment, collecting evidence, training staff and taking part in audits. For a small business, this internal time is often the biggest cost of the whole project, even though it never appears on an invoice.
Think about a 20-person engineering consultancy in Parramatta. The practice manager might end up spending a few hours a week on the ISMS for months. That's time not spent on billing, recruitment or client work, and it needs to be planned for.
2. Outside help, if you use it
Many small businesses bring in a consultant or their IT provider to run the gap analysis, help write the documentation and prepare for audit. It costs money, but it usually shortens the journey and lowers the risk of a failed audit. The amount depends on how much you hand over and how much you do yourself.
3. Security improvements
The risk assessment almost always finds gaps. Common ones include accounts without multi-factor authentication, laptops that aren't centrally managed, backups that have never been test-restored and no written incident response plan. Fixing them may mean new tools, extra licences or configuration work. The good news is these are improvements you'd want anyway.
4. The certification audit
Certification is carried out by an independent certification body, accredited in Australia by JAS-ANZ. It charges for the stage 1 audit, which is a documentation and readiness review, and the stage 2 audit, which checks the ISMS works in practice. The fee depends largely on how many people and locations are in scope, and how complex your operations are.
5. Keeping the certificate
An ISO 27001 certificate lasts three years. In between, the certification body runs surveillance audits, and at the end there's a recertification audit. Budget for those audits, and for the ongoing time it takes to run the ISMS: internal audits, management reviews, risk reviews and keeping evidence up to date.
What drives the cost up or down?
A handful of factors make the biggest difference to what ISO 27001 certification costs. Understanding them helps you control the budget before you start.
Scope
Scope is the single biggest lever. Certifying the whole business costs more than certifying the part your clients care about, such as the team and systems that handle client data. A tight, sensible scope reduces audit time, documentation and the number of controls you need to evidence.
Your starting point
A business that already runs managed devices, multi-factor authentication, regular patching and tested backups is much closer to the standard than one starting from scratch. The further you are from the requirements, the more remediation work you'll need before the audit.
Size and complexity
More people, more sites and more systems mean more to assess and more to audit. A single-office accounting firm in Penrith with one cloud platform is simpler to certify than a business with three offices, a warehouse and a dozen specialist applications.
Documentation habits
Businesses that already write things down spend far less time building evidence. If you've got an asset register, onboarding and offboarding checklists and documented procedures, you're ahead. If everything lives in one person's head, expect more work.
How much you outsource
Doing more yourself lowers external costs but raises internal time. Outsourcing more does the opposite. There's no right answer, only the mix that suits your team's capacity and skills.
How long does certification take?
Timeframes depend on the same factors as cost. A business with good technical controls and documentation habits will usually get there faster than one starting from scratch. The stage 1 and stage 2 audits are separate events, and there's often work to do in between, so plan for a project rather than a quick sign-off.
Does a longer project cost more?
Usually, yes, mostly through internal time. A project that drags on keeps people distracted for longer. Setting a realistic timeline, with clear owners and milestones, is one of the simplest ways to keep the total cost under control.
Seven ways to keep ISO 27001 certification cost down
You can't avoid every cost, but you can avoid a lot of wasted effort. These are the approaches that make the biggest difference for small businesses.
- Set a sensible scope. Start with what your clients and tenders actually need, rather than certifying everything at once.
- Do a gap analysis first. Knowing exactly what's missing stops you paying for work you don't need.
- Fix the technical basics early. Controls like MFA, endpoint protection, patching and backups are needed anyway, and they're cheaper to sort out before the audit clock starts.
- Use the Essential Eight as your technical baseline. Many of its strategies line up with ISO 27001 Annex A controls, so the work counts twice.
- Use templates carefully. Templates save time, but policies must describe how your business really works, or the auditor will notice.
- Give one person clear ownership. An ISMS with no owner drifts, and drift is expensive at audit time.
- Keep the ISMS running between audits. A system that's maintained all year makes surveillance audits routine instead of a scramble.
Is it cheaper to do it all yourself?
It can be cheaper on paper, but not always in practice. If nobody on your team has been through an ISO 27001 project before, the learning curve is steep and the risk of a failed audit is higher. Many small businesses find a middle path works best: outside help for the gap analysis and the trickier documents, with the business owning day-to-day running of the ISMS.
Hidden costs to watch for
Some costs catch businesses by surprise. Knowing about them upfront makes budgeting much easier.
Staff time beyond the project lead
Everyone in scope will need security awareness training, and some will be interviewed by the auditor. Managers will need to approve policies and attend management reviews. It's not a lot of time per person, but it adds up.
Tools you didn't plan for
The risk assessment may show you need a password manager, device management, better logging or a more reliable backup platform. These are worthwhile, but they're ongoing costs, not one-offs.
Fixing audit findings
If the auditor raises a nonconformity, you'll need to fix it and show evidence. Minor findings are common and usually manageable. A major finding can delay certification and add cost, which is another reason to do a proper gap analysis first.
Is ISO 27001 certification worth the cost?
For many Australian small businesses, yes, especially when certification opens doors that are otherwise closed. If a key client, a tender panel or a larger partner requires ISO 27001, the cost of certification is effectively the cost of staying in the game.
What do you get for the money?
Beyond the certificate, you get an information security management system that helps you find and fix weaknesses, respond better to incidents and answer security questionnaires quickly. Insurers, clients and partners can see that your approach to security has been independently audited, and keeps being audited.
When might it not be worth it yet?
If no client, tender or partner is asking for ISO 27001, and your main concern is stopping common attacks, the Essential Eight may be a more practical place to start. You can build towards ISO 27001 later, and the work won't be wasted. We compare the two in ISO 27001 vs the Essential Eight.
The three-year certification cycle
It helps to think about ISO 27001 certification cost across the whole certification cycle, not just the first year. The total cost of ownership is spread over three years, and the pattern of spending changes as you go.
Year one: initial certification
Year one carries most of the implementation costs. This is when you do the gap analysis, the risk assessments, the control implementation and the documentation. It ends with the initial certification audit, which is run in two parts. The stage 1 audit is largely a documentation review. The stage 2 audit tests whether your ISMS and your existing security controls work in day-to-day business processes.
Years two and three: surveillance audits
Once you're certified, the certification body comes back for surveillance audits during the life of the certificate. They're shorter than the original certification audit and look at a sample of your ISMS rather than everything. Your ongoing costs in these years are mainly the audit fees, plus the internal time to keep the system running.
End of year three: the recertification audit
Recertification audits occur every three years. The full recertification audit is more thorough than a surveillance audit, because the certification body is deciding whether to issue a new certificate for another three-year cycle. Businesses that have kept their ISMS running steadily usually find it straightforward. Businesses that let things slide often find it's almost like starting again.
How certification body fees are worked out
Certification body fees are one of the few parts of the cost you'll see on a formal quote. Understanding how they're calculated makes it easier to compare different certification bodies fairly.
Audit days and audit duration
Certification bodies usually price the certification assessment in audit days. The audit duration depends on the audit scope: how many people work within the ISMS, how many sites are included, and how complex the technology and business processes are. A wider initial scope means more audit days, which means higher audit costs.
Why different certification bodies quote differently
Accredited certification bodies vary in their audit fees, travel costs, reporting and how they handle findings. It's worth getting more than one quote. Make sure every certification body you consider is accredited by JAS-ANZ, the national accreditation body for Australia and New Zealand, or the certificate may not be accepted by the clients and tender panels you're trying to satisfy.
The role of the lead auditor
Your audit will be run by a lead auditor from the certification body, sometimes with a second auditor for larger scopes. The external auditor is independent: they can't also have helped you build the ISMS. That independence is what gives the certificate its value, and it's why your IT provider or consultant can prepare you but never certify you.
Internal resources vs external support
How you split the work between your internal team and external support has a big effect on both the total cost and how smoothly certification goes.
When your internal team can carry it
If someone in the business has information security governance experience, or is willing to learn, a lot of the work can stay in-house. That keeps external costs down, but it uses internal resources that would otherwise go into running the business. Be realistic about how many hours that person really has each week.
When to hire consultants
Businesses usually hire consultants when they lack internal expertise, are working to a tight tender deadline, or have already tried and stalled. An external consultant can speed up the risk management work, write the trickier policies and handle audit preparation. Ask for a clear statement of what's included, so you can compare offers like for like.
Building internal expertise
Some businesses send a staff member on ISO 27001 internal auditor or lead implementer training. It's an upfront cost, but it builds internal expertise that pays off at every internal audit and surveillance audit for years. Staff training for everyone else, such as security awareness, is a separate and ongoing cost.
Do compliance automation platforms reduce cost?
A compliance platform can help with evidence collection, policy management, continuous monitoring and tracking tasks. Using automated compliance software can help reduce implementation costs for some businesses, because compliance automation streamlines compliance and cuts the hours spent chasing evidence. It isn't a substitute for doing the risk assessment and running the ISMS properly, though, and it's another subscription to add to the ongoing costs. Weigh it against the size of your scope.
Budgeting for ISO 27001 certification
There's no fixed cost to plug into a spreadsheet, but you can still build a sensible budget. A simple structure works for most small businesses.
A simple budget structure
- Implementation effort: internal team hours for the gap analysis, risk assessments, policies, control implementation and evidence.
- External support: consultant or IT provider fees for the parts you outsource.
- Technical controls: any new tools, licences or configuration work the risk assessment calls for.
- Certification body fees: the initial certification audit, surveillance audits and the recertification audit.
- Ongoing costs: internal audits, management reviews, staff training and continuous improvement over the certification cycle.
How existing security maturity changes the numbers
Existing security maturity is one of the biggest factors in implementation costs. A business with good technical controls, an up-to-date asset list and clear onboarding and offboarding processes will spend far less getting ready than one with none of these. That's why a gap analysis is the most useful first step: it turns a vague estimate into a list of actual work.
Weighing cost against risk
It's also worth weighing the cost of certification against the cost of doing nothing. A serious data breach can bring recovery costs, downtime, lost clients and reputational damage, and many security questionnaires now ask about certification before you're even considered. For businesses chasing larger contracts or government procurement, certification can be the difference between being shortlisted and being ruled out.
How Static Computers can help
Static Computers is an ISO 27001 certified Sydney managed IT provider, and we've been supporting local businesses since 2006. We help businesses prepare for certification, which can include:
- A gap analysis to show how far you are from the standard, so the scope and budget are realistic.
- Putting technical controls in place, such as MFA, device management, patching and backups.
- Helping you build the policies, procedures and evidence an auditor will expect.
- Support with tenders and supplier security questionnaires.
We never certify anyone ourselves. Certification is always done by an independent, accredited certification body.
Frequently asked questions
How much does ISO 27001 certification cost in Australia?
There's no fixed price. ISO 27001 certification cost depends on your scope, size, complexity and starting point, and on how much outside help you use. The best way to get a realistic figure is a gap analysis, followed by quotes from accredited certification bodies.
Do you pay for ISO 27001 certification every year?
There are ongoing costs. The certificate lasts three years, with surveillance audits in between and a recertification audit at the end, so you'll have audit fees and internal time across the whole cycle, not just in year one.
Who carries out the certification audit?
An independent certification body. In Australia, certification bodies are accredited by JAS-ANZ. Check that any certification body you engage is accredited before you sign.
Can the Essential Eight reduce the cost of ISO 27001?
It can help. Many Essential Eight strategies, such as MFA, patching, restricting admin privileges and regular backups, map onto Annex A controls in ISO 27001. Work done for one counts towards the other.
Get a realistic starting point
Because the cost depends so much on where you're starting from, the most useful first step is an honest look at your current setup. Our complimentary IT review does exactly that, and we'll tell you plainly what's already in good shape and what would need work. For the bigger picture, read our guide to ISO 27001 certification for Australian businesses.