ISO 27001 Certification Cost: A Small Business Guide (2026)

ISO 27001 certification cost for a small business comes down to four things: the certification body's audit, the work to build your information security management system (ISMS), any tools or outside help you buy, and your own team's time. The standard sets no price. What you pay depends mostly on how many people and sites fall inside your ISMS scope, how much of the security work you already do, and how much of the preparation you do yourself.

This guide explains each cost, what makes it go up or down, how the certification process runs over three years, and where small teams usually overspend. If you sell to larger customers, you have probably met the question in a security questionnaire: "Are you ISO 27001 certified?" This is what answering yes involves.

Download the ISO 27001 checklist (PDF + Excel)

TL;DR

What ISO 27001 certification means for a small business

ISO/IEC 27001:2022 sets requirements for an information security management system: a repeatable way to find your information security risks, decide how to treat them, and show that the measures work. Clauses 4 to 10 contain the requirements every certified organization must follow. Annex A lists 93 reference controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. You choose the controls you need through your risk assessment and record the decision in a Statement of Applicability.

Three facts matter for budgeting:

• ISO does not certify anyone. Certificates come from independent certification bodies. ISO advises checking whether the body is accredited (ISO). Accreditation bodies include UKAS in the UK and ANAB in the US. Accredited certificates can be checked on IAF CertSearch.
• The 2013 version is gone. Under IAF MD 26, every certificate to ISO/IEC 27001:2013 expired or was withdrawn at the end of the transition on 31 October 2025. A company whose old certificate lapsed usually starts again with an initial audit.
• A 2024 amendment added one question. Amendment 1:2024 asks you to decide whether climate change is relevant to your ISMS. It adds no security controls, but expect your auditor to ask how you considered it.

Certification is voluntary. ISO itself notes that some organizations use the standard without certifying. Small businesses often certify because customers ask for it.

How much does ISO 27001 certification cost?

We don't publish a price range here, because no primary source gives one and quotes vary widely by scope. What we can do is show what you are paying for, so you can compare quotes and plan a budget that holds up.

1. The certification audit

Certification bodies price the audit in auditor days. The minimum number of days is set by the rules certification bodies follow, ISO/IEC 27006-1:2024, and it depends mainly on the number of people working within your ISMS scope. A 15-person company with one office needs far fewer audit days than a 200-person company with three sites. Travel, the number of sites visited and how complex your systems are also change the quote.

Ask each certification body for a written quote that covers the whole three-year cycle: Stage 1, Stage 2, both surveillance audits and the recertification audit. A low first-year price can hide higher surveillance fees.

2. Preparation

This is usually the largest part. You need a defined scope, a risk assessment and treatment process, a Statement of Applicability, an information security policy, objectives, evidence of competence, an internal audit and a management review. If your team already writes things down and runs regular access reviews, preparation is mostly documentation. If not, it means changing how work is done.

A consultant shortens the learning curve but costs more. Templates and a compliance platform cost less but need more of your own time. Many small teams mix the two: they do the work themselves and pay for a review before Stage 1.

3. Tools

You may not need new tools at all. Check what you already have against the controls you select. The gaps small companies most often fill are device management (encryption, updates, screen lock and inventory on laptops and phones), backup, a password manager and security awareness training. Our ISO 27001 compliance software guide covers what tools can and cannot do.

4. Your team's time

Someone has to own the project, and control owners have to produce evidence. This cost doesn't show up on an invoice, so it is easy to underestimate. Name the project lead early and protect time in their week for it.

The ISO 27001 certification process, step by step

The process follows the same path in every company. For the detailed task list, use our ISO 27001 checklist.

1. Define the scope. Decide which parts of the business, locations and systems the ISMS covers (clause 4.3). Scope is the biggest single cost lever: a tighter scope means fewer audit days and fewer controls.
2. Run a gap analysis. Compare what you do today with clauses 4 to 10 and the Annex A controls you are likely to need.
3. Assess and treat risks. Define your risk criteria, identify risks to confidentiality, integrity and availability, assign owners, and choose a treatment for each (clause 6.1.2 and 6.1.3).
4. Write the Statement of Applicability. List the controls you need, why you include them, whether they are in place, and why you exclude any Annex A control (clause 6.1.3).
5. Put controls and policies in place. Write the policies your controls call for, configure the technical controls and train staff. Leadership has to take part: clause 5 makes top management commitment part of the audit.
6. Run an internal audit and a management review. The internal auditor must be objective and impartial (clause 9.2). Management reviews the results and decides on improvements (clause 9.3).
7. Stage 1 audit. The certification body reviews your documented ISMS and readiness, and plans Stage 2.
8. Stage 2 audit. The auditor checks that the ISMS is implemented and working, through interviews, evidence samples and observation. If it passes, the certification body makes its certification decision and issues the certificate.

A certificate is valid for three years. Surveillance audits follow in each of the next two years, and a recertification audit takes place before the certificate expires. How long the first certification takes depends on your starting point; we don't quote a number because it varies too much to be useful.

How to keep ISO 27001 costs down

• Scope tightly. Start with the product, team or service your customers ask about, and expand later.
• Reuse what you have. Existing policies, SOC 2 work and GDPR records can often be adapted. See ISO 27001 vs SOC 2 for how the two overlap.
• Automate evidence where it is routine. Device settings, inventory and update status are easier to prove with an exported report than with screenshots.
• Get quotes for the full cycle. Compare three-year totals from accredited certification bodies, not first-year prices.
• Fix the evidence habit early. The most expensive surprise is finding at Stage 2 that a control exists on paper but nobody runs it.

Common ISO 27001 mistakes small businesses make

• A paper ISMS. Policies on a shared drive that nobody follows. The Stage 2 auditor tests that controls operate, not only that they are written.
• Over-scoping. Including every system and team when the customer only asked about one service.
• A risk assessment done as a formality. Every control in the Statement of Applicability should trace back to a risk or a requirement.
• Using a non-accredited body without checking. Some customers only accept accredited certificates. Ask before you sign.
• Treating certification as the finish line. Surveillance audits check that the ISMS keeps running and improving.

ISO 27001 itself carries no fines: it is voluntary. The cost of not having it is commercial, in lost deals and longer security reviews. If you also handle personal data of people in the EU, much of the same work can be reused for GDPR (see the GDPR compliance checklist), though the two are separate obligations.

Download the ISO 27001 checklist (PDF + Excel)

Managing this across many devices

Device controls produce a lot of repeat evidence work. trio.so is device management software that supports the device-related Annex A controls you select. Across Windows, Mac, iOS and Android, from one console, it lets you:

• Enforce encryption: BitLocker on Windows and FileVault on Mac, with FileVault recovery key escrow, plus encryption on iOS and Android phones, with encryption status shown per device.
• Set the baseline: passcode rules and inactivity screen lock on enrolled devices.
• Keep devices updated: manage OS updates on Windows, macOS, iOS and Android.
• Control apps: allow approved apps and block the ones you don't want on company devices.
• Act on lost devices: lock a lost Mac, iPhone or Android device, and wipe company-owned devices.
• Show your work: a hardware and software inventory for each enrolled device, and compliance evidence you can export for your auditor.

trio.so's compliance engine includes ISO 27001 among its frameworks and checks the device controls a management tool can enforce. It does not write your Statement of Applicability, risk register or policies, and it does not certify you: certification comes from a certification body, ideally an accredited one. Learn more about compliance automation.

Start free trial Book a demo

14-day free trial. No credit card required.

More ISO 27001 guides: the ISO 27001 checklist, ISO 27001 compliance software, ISO 27001 vs SOC 2, NIST vs ISO 27001 and the ISO 27701 checklist for privacy. For wider context, see compliance for SMBs.

Sources. Last reviewed October 2026. This article is guidance, not legal or audit advice. ISO/IEC standards are copyrighted; control titles are cited, not quoted.

• ISO/IEC 27001:2022, ISO catalogue page
• ISO/IEC 27001:2022/Amd 1:2024, climate action changes
• ISO: Certification (ISO does not certify)
• ISO/IEC 27006-1:2024, requirements for ISMS certification bodies
• IAF MD 26:2023, transition requirements for ISO/IEC 27001:2022
• IAF CertSearch, database of accredited certifications