In short: The cost of an ISO 27001 certification depends mainly on three factors: the scope, your organisation's starting point and the number of people working within the scope. Costs fall into six blocks, from external consulting and certification body fees to running the system after the certificate is issued. A reliable fixed price is only possible once a gap analysis shows what is already in place and what is missing. Price lists that skip this step say little about what you will actually pay.

The six cost blocks at a glance

Certification to ISO/IEC 27001:2022 is not a single purchase. You build an information security management system (ISMS), meaning defined roles, rules, processes and evidence that let you steer information security. An independent body then checks whether that system meets the standard. Costs arise in six blocks:

  1. External consulting. Support with the gap analysis, risk assessment, policies and audit preparation. The scope depends on how much your own team takes on.
  2. Internal time. Hours from management, the information security officer and business units.
  3. Certification body fees. Audit days for initial certification, surveillance and recertification.
  4. Technical measures. Whatever gaps the gap analysis uncovers.
  5. Tools. Document storage, a risk register and, if you choose, ISMS software.
  6. Ongoing operation. Maintaining the ISMS across the full certificate cycle.

Many cost comparisons only look at blocks 1 and 3. Your budget has to cover all six.

Internal time: the block that often goes missing

The standard requires top management to lead the ISMS (clause 5.1) and to provide the necessary resources (clause 7.1). Management approves the information security policy, decides on risks and carries out the management review (clause 9.3). The management review is a documented meeting in which leadership reviews the status, metrics and improvements of the ISMS.

The largest share falls on the information security officer (ISO). This role runs the ISMS day to day, maintains the risk register and evidence and plans the internal audit under clause 9.2. Business units add to the load: HR for joiners and leavers, procurement for suppliers, IT for access and backups. In the stage 2 audit, auditors talk to these areas directly. If you do not plan for this time, you only push it back.

Certification body fees and audit days

The certificate is issued by a certification body. In Germany it is usually accredited by the German national accreditation body (DAkkS), which means it has been assessed and approved for this work. The body charges by audit day. The number of audit days is set according to ISO/IEC 27006-1, mainly based on the number of people working under your organisation's control within the scope, and on complexity. Complexity covers factors such as the number of sites, the IT environment, outsourced processes and the legal requirements of your sector. The certification body sets the audit days, not the consultant.

The cycle follows ISO/IEC 17021-1 and runs for three years:

  • Stage 1. Review of documentation: scope, risk assessment, Statement of Applicability, policies.
  • Stage 2. Review of day-to-day practice through interviews, samples and evidence. The body then decides on certification.
  • Surveillance audits. At least once a year in the two following years, the first no later than twelve months after the certification decision.
  • Recertification. A full audit before the three years expire, after which the next cycle begins.

Compare quotes from several bodies using the same details on headcount, sites and scope, and compare them over the full three-year cycle. Travel costs for on-site audit days belong in the comparison.

Technical measures, tools and operation

The gap analysis compares your current state with the standard. Annex A of ISO/IEC 27001:2022 lists 93 controls. You justify which of them apply in the Statement of Applicability, based on your risk assessment (clause 6.1.3). Common gaps concern access rights (A.5.15, A.5.18), backups (A.8.13), logging (A.8.15), management of technical vulnerabilities (A.8.8) and supplier security (A.5.19). What technology or services you need here only becomes clear after the comparison.

For tools, a well-organised document repository with version control and a structured risk register are often enough to start. Dedicated ISMS software tends to pay off with several sites or large volumes of evidence. Ongoing operation covers the ISO's time, internal audits at planned intervals, the management review, awareness training (A.6.3) and preparing for surveillance audits.

How to reduce costs

  • Choose the right scope. Under clause 4.3, define what your customers actually expect to see certified, such as a data centre, a product or a site. The scope is printed on the certificate. If it is too narrow for your customer's requirement, the certificate is of little use.
  • Use existing evidence. GDPR documentation, contingency plans, IT policies, penetration test reports and measures from your NIS 2 implementation often cover part of the ground.
  • Keep the order. Gap analysis, scope and risk assessment first, then measures and tools. Buying software beforehand often means buying the wrong thing.
  • Do not copy templates blindly. In stage 2, auditors check whether the rules are lived. Policies that do not match your processes lead to nonconformities and rework.
  • Take the internal audit seriously. A thorough dry run before stage 2 finds gaps before the certification body does.

A fixed price only after the gap analysis

Two companies with the same headcount can face very different workloads. One has already settled its access concept, backups and supplier contracts, the other is starting from scratch. A fixed price before the comparison therefore contains either large safety margins or open change requests. The gap analysis makes scope and sequence visible, and only then can the consulting effort be priced reliably.

Consulting and certification are commissioned separately. ISO/IEC 17021-1 requires the certification body to be impartial. It may not advise on your management system itself, and a consultant cannot issue a certificate. Request two separate quotes: one for consulting and one from the certification body.

How GermanAI Defense helps

We have been certified to ISO/IEC 27001:2022 ourselves since 26 May 2026 and know both audit stages from our own experience. We start with the gap analysis, define the scope with you and then send you a quote for the consulting work. You commission the certification body directly. If you wish, we also take on technical measures such as penetration testing and SOC monitoring around the clock, with service and response times as agreed in the contract.

→ Request a quote for your ISO 27001 project: ISO 27001 quote

→ Process, audit cycle and services: ISO 27001 consulting

→ How ISO 27001 and NIS 2 fit together: ISO 27001 and NIS 2 compared

Sources

  • ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection: Information security management systems, Requirements (clauses 4.3, 5.1, 6.1.3, 7.1, 9.2, 9.3, Annex A)
  • ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of information security management systems, Part 1: General
  • ISO/IEC 17021-1:2015, Conformity assessment: Requirements for bodies providing audit and certification of management systems, Part 1: Requirements
  • German national accreditation body (DAkkS)