What does it take to get ISO 27001 certified?  

The ISO 27001 certification is globally recognised and demonstrates to your customers that your ISMS is compliant with industry best practices. 

Once you've set up your ISMS with the relevant security controls, you can register for ISO 27001 certification, proving that your ISMS meets the requirements of the ISO 27001 standard. Initial certification ends with an internal and external audit of your ISMS. 

Once you receive your ISO 27001 certification, it's valid for three years. During this time, you'll need to maintain your ISMS and audit it every year to retain your certification.

What are the key cost factors for ISO 27001 certification? 

The exact cost depends on the following factors: 

• Number of locations to be audited and complexity of the information processes  

• Scope of the ISMS  

• Maturity level of the existing ISMS  

• Internal resources for implementing ISO 27001  

• External service providers 

The most significant expense on the way to certification is the implementation of the specific requirements. Depending on the factors mentioned above, this can take varying amounts of time. 

Alongside the cost of an external service provider, you’ll also need to budget for the external audit. This is where you find out whether the financial investment in implementation was worthwhile. If the certification body identifies significant deficiencies and your organisation fails the audit, a new date will need to be scheduled. In this case, the process starts over, leading to a considerable increase in costs. 

How much does the ISO 27001 certification audit cost? 

We know you’re looking for concrete numbers. However, the cost of an ISO 27001 certification audit can’t be estimated with a one-size-fits-all figure. It depends on the time required for the audit, which is influenced by the complexity of your information security processes and the scope of your ISMS. The following figures are meant to provide a general guide: 

• For small to medium-sized companies, audit costs can be up to £25,000. 

• For larger companies, audit costs of £50,000 are not uncommon. 

These figures give you a starting point, but you’ll need to contact your chosen certification body directly for a precise quote.

Is it a good idea to cut costs when choosing the certification body? 

To save on external audit costs, you might consider comparing different certification bodies and choosing the one with the lowest audit fees. While this may seem like a sensible approach, be cautious: Not all certifications offer the same value. 

For ISO 27001, there is a selection of accredited certification bodies in the UK, meaning they have been assessed and accredited by the United Kingdom Accreditation Service (UKAS). UKAS is the national accreditation body for all management systems according to ISO standards. 

If a certification body is not on the UKAS-accredited list, the obtained certificate may lose credibility and is often not recognised by contract partners. 

How do you achieve ISO 27001 certification cost-effectively?

When seeking ISO 27001 certification, three main cost factors come into play. Which one offers the best opportunity for savings? 

• Internal resources for ISO 27001 implementation: You can make indirect savings here by ensuring efficient project management during implementation. 

• External audit costs with a certification body: You can reduce expenses by thoroughly preparing for the audit, allowing you to pass on the first attempt and avoid paying for a re-audit. 

• External service providers: This is the area where you have the greatest opportunity for savings. 

The right service provider can help you reduce costs on your path to ISO 27001 certification: 

• Experts in information security and ISO 27001 specifically know how to best manage your ISMS project. Their guidance helps you avoid pitfalls during the ISMS setup and the audit, ultimately saving you money. 

• Many service providers offer templates for ISO 27001 controls, which are a key component of certification. This saves you time and resources, and you can be confident that your policies will meet the standards required by external auditors. 

• Consultants can assess your organisation’s status using automated questionnaires, reducing the time required to determine recommendations for risk mitigation. 

• Access to a user-friendly platform allows you to manage risk assessments, gap analyses, and ISMS documentation in one place, making them readily available for the audit and increasing the likelihood of success. 

• Consultants conduct internal audits to identify potential weaknesses early, helping you pass the external audit on the first attempt.
  

What costs can you expect for recertification? 

ISO 27001 requires recertification every three years, involving another complete audit process. The associated costs are similar to those of the initial certification audit. Additionally, the certification body conducts annual surveillance audits, though these are less comprehensive and, therefore, less costly. 

When maintaining ISO 27001 certification, the largest expense is the ongoing operation of the ISMS. As your business and the risk landscape evolve over time, your ISMS must adapt to these changes.