Prices published

What ISO 27001 actually costs in the UK (2026)

Three separate costs make up ISO 27001: getting ready, the certification body's audit, and keeping the certificate alive. Most of this market hides at least one of them. All three are on this page, with our own fees published in full, and the third cost is the one our managed service exists to take off you entirely.

3D illustration of ISO 27001 certification costs

Cost one: readiness

Our readiness fees, fixed by headcount

One fixed fee covering the gap analysis, the ISMS build, documentation, risk assessment, the clause 9.2 internal audit and support through both certification audit stages. No day rates and no scope creep: if it takes longer, that is our problem. And because this is a managed service rather than consultancy, we do not hand over a binder and leave: the same team keeps running the ISMS after the certificate arrives.

Up to 10 staff

£7,890

A focused ISMS, a small document set and the shortest route to Stage 1.

Start here

11 to 50 staff

£8,990

The most common band for our clients.

Start here

51 to 100 staff

£13,550

Multiple departments in scope; more evidence, more interviews.

Start here

100+ staff

£16,300

Multi-site and group structures welcome; unusual scopes confirmed on the call.

Start here

For context, published UK market analyses put consultancy-led readiness for organisations under 50 staff at roughly £8,000 to £15,000, rising with headcount. Prices exclude VAT.

Cost two: the audit itself

The certification body's fee, itemised

The audit is paid to your UKAS-accredited certification body, never to us, and it is priced in auditor days. Two independent UK market analyses put the 2026 UKAS rate at around £1,250 per day, and ISO 27006 sets minimum day counts by organisation size, which is why a genuine UKAS audit for even the smallest company starts around £6,250.

Beware quotes dramatically below that floor: they usually mean a non-accredited certificate, which your enterprise customers' due diligence teams will spot. Our guide to choosing a certification body covers how to compare quotes properly.

Employees	Initial audit	Indicative fee
1 to 10	5 audit days	around £6,250
11 to 25	7 audit days	around £8,750
26 to 45	8.5 audit days	around £10,625
46 to 100	11+ audit days	around £13,750+

Indicative figures from published 2026 UK market analyses at ~£1,250/day against ISO 27006 minimum day counts. Your chosen certification body quotes its own fee. Surveillance audits (annual) are smaller, typically £1,500 to £3,000.

Cost three: year two onwards

Certificates run on a three year cycle: annual surveillance audits in years two and three, then full recertification. This is where our managed service earns its name: we take the whole thing end to end off your team, operating the ISMS, keeping the evidence current, running the internal audit cycle and fronting the surveillance audits, so the certificate stays true to how you actually operate without consuming anyone internally. The expensive version of ISO 27001 is the one rebuilt from scratch every third year because nobody owned it in between; on the managed service, somebody owns it, and it is us.

Sense-check us

The three routes, costed side by side

Year-one totals from published UK market analysis. We sell the third, as a managed service that includes running the ISMS, not just building it; the full comparison is straight about when the other two are the better call. The table below shows who actually does the work on each route.

3D illustration of the DIY toolkit route

DIY with a toolkit

Roughly £8,000 in year one

A few hundred pounds of templates, your own time in quantity, and the full UKAS audit fee. Cheapest on paper; the real cost is the months of internal effort and the risk of documents that do not match reality.

3D illustration of the compliance platform route

Compliance platform (Drata, Vanta)

Roughly £17,000 to £21,000 in year one

Platforms such as Drata and Vanta structure the work and automate parts of evidence collection, but the ISMS is still yours to run: you collate the rest of the evidence, operate the platform day to day, input the data, run the reports, chase the failed control tests, and design and embed the controls and processes in the first place. The subscription then recurs every year.

3D illustration of the consultancy-led route

Managed service (our route)

Readiness from £7,890 plus the audit fee itemised above

Not consultancy that advises and leaves: our practitioners build the ISMS, carry you through both audit stages, and then keep running it, evidence, surveillance audits and control upkeep included, so the certificate never becomes your team's second job.

Who does the work	DIY with a toolkit	Platform (Drata, Vanta)	Our managed service
Design the ISMS and controls	You	You	We do
Write the policies and documentation	You	You, with templates	We do
Collate the audit evidence	You	Partly automated, the rest is you	We do
Operate the tooling and fix failed control checks	You	You	We do
Run the clause 9.2 internal audit	You, or buy it in	You, or buy it in	We do
Carry you through the certification audit	You face it alone	You face it with reports	We sit beside you
Run and maintain the ISMS in years two and three	You	You, plus the subscription	We do