ISO 27001 Certification Cost: What Drives Audit Days

Key takeaways

• Audit days drive the fee: Annex C of ISO/IEC 27006-1:2024 gives a starting audit time based on the number of persons in scope, which the certification body then adjusts for complexity.
• Contractors count: persons doing work under your organization's control are counted whether or not they are employees.
• Identical roles can lower the count: a group's effective count can fall no lower than the square root of its headcount, rounded up, and only if the certification body accepts the reduction based on risk.
• Budget for three years: the initial two-stage audit, surveillance in years 1 and 2, and recertification in year 3.
• Ask for the justification: ISO/IEC 17021-1 clause 9.1.4 requires the certification body to record the audit duration and why it was chosen.

What does ISO 27001 certification cost?

ISO 27001 certification cost has six core parts, and only three of them go to the certification body. The rest is what you spend to build and run the information security management system (ISMS) that gets audited.

1. The standard itself. ISO/IEC 27001:2022 costs CHF 155 from ISO. Amendment 1:2024, which adds climate action considerations, is free (ISO).
2. Implementation effort. Defining the scope, running the risk assessment, writing the Statement of Applicability and policies, and putting controls in place. This is mostly internal time, plus outside help if you hire it.
3. Internal audit and management review. Clause 9.2 requires internal audits at planned intervals, and clause 9.3 requires top management to review the ISMS at planned intervals. Both are requirements of the standard, so the certification audit looks at them like any other clause.
4. The certification audit. Stage 1 reviews your documentation and readiness. Stage 2 tests whether the ISMS works in practice. The Annex C starting time covers both stages together.
5. Surveillance audits. Under ISO/IEC 17021-1 clause 9.1.3.2, the certification body returns in years 1 and 2, at least once each calendar year.
6. Recertification. In year 3, before the certificate expires, a recertification audit starts the next cycle.

For budgeting, a certification body's quote is essentially audit days multiplied by the auditor day rate, plus any travel and fixed fees the provider lists. That makes quotes easier to compare: ask each provider for the day count, the day rate, any travel and fixed fees, and the written audit-time justification, which ISO/IEC 17021-1 clause 9.1.4 requires it to record. If two quotes differ, those figures show whether the gap comes from the days, the rate or the extras.

Because the audit fee recurs, compare quotes over the whole cycle rather than on the first audit alone. EUROTECH quotes cover the full three-year cycle; our guide to ISO certification cost explains what that includes.

How are audit days calculated?

Audit days are calculated in two steps: a starting figure from the number of persons in scope, then adjustments for complexity. ISO/IEC 27006-1:2024 sets this out in Annex C, "Audit time", with calculation methods in Annex D (ISO/IEC 27006-1). The standard replaced ISO/IEC 27006:2015 and adds ISMS-specific requirements on top of ISO/IEC 17021-1.

### Who counts in the headcount

The count is the number of persons doing work under your organization's control within the ISMS scope. That includes contractors and freelancers, not only employees. A developer on a long-term freelance contract who works in your codebase counts the same way a salaried engineer does.

Two practical points follow. Certification bodies typically convert part-time staff to full-time equivalents; this is common practice rather than a rule quoted from the standard. And where you have several sites, total audit time is generally based on the total number of persons in scope, irrespective of location (Annex C.6). Opening a second office does not reset the count.

### The indicative starting table

The bands below are indicative starting points reported from Annex C by secondary sources. Published versions of this table are not always consistent, so confirm the figure for your organization in a written quote.

These are starting figures, not final ones. The certification body adjusts them for complexity before it quotes.

### The identical-activity reduction

When many people perform the same activity, ISO/IEC 27006-1 allows a risk-based reduction (Annex C.3.4). The group's effective count can fall no lower than the square root of its headcount, rounded up, and only if the certification body accepts the reduction based on risk. The reduction is not automatic. For example, 49 people on an identical support desk could count as 7.

The certification body decides whether the reduction applies. It looks at whether the roles really are identical in their access, tools and information security risk. A support team where some agents can reach production data and others cannot may not qualify as one group.

What drives audit days up or down?

Headcount sets the starting point; the drivers below move it. Some come straight from the standard. Others are factors that certification bodies typically assess when they apply the Annex C complexity adjustment, and they are labelled as practice in the table.

For a SaaS company, the practice-based factors often carry real weight. Cloud hosting, a product built in-house and customers in regulated sectors each give the auditor more to examine. None of these is a flaw. They are simply part of the risk picture the audit has to cover. If your SaaS customers also ask about SOC 2, our comparison of ISO 27001 vs SOC 2 explains how the two differ before you budget for either.

Worked example: a 68-person SaaS company

The scenario below is hypothetical and simplified. A SaaS company has 60 employees and 8 contractors working within the ISMS scope.

• Starting count. 60 plus 8 gives 68 persons. That falls in the 66 to 85 band, about 11 days indicative.
• Identical-activity reduction. Suppose 49 of those people work an identical customer support role. The square root of 49 is 7, so that group could count as 7. The effective number becomes 68 minus 49 plus 7, which is 26.
• New band. 26 persons falls in the 26 to 45 band, about 8.5 days indicative.
• The condition. The lower figure applies only if the certification body accepts the reduction based on risk. If support agents have different access to customer data, it may accept a smaller reduction or none.
• Complexity. After that, the factors in the driver table can move the figure up or down.

### The three-year view

The standards set the cycle but not a fixed ratio for later audits. Many certification bodies plan surveillance at about one third of the initial audit time and recertification at about two thirds. The table applies that practice to both figures from the example, before any complexity adjustment, rounded to one decimal.

Your certification body will round to its own planning units. The point of the exercise is to see where the days come from, so you can check a quote line by line.

How to reduce ISO 27001 certification cost legitimately

You can lower audit days without cutting corners, because several inputs to the calculation are decisions you make. These five are the most direct.

1. Right-size the scope. Include the products, processes and locations your customers rely on, and leave out what they do not. A scope that excludes the service your customer buys will not answer their question, so do not shrink it for price alone.
2. Be ready before Stage 1. An ISMS with a completed risk assessment, internal audit and management review gives the auditor less to chase. Our guide on how to get ISO certified walks through the preparation.
3. Document role categories. If you want the identical-activity reduction considered, show which people share the same role, tools and access. The certification body still decides, but it needs evidence to decide on.
4. Combine audits. If you also need a standard such as ISO 22301 for business continuity, ask whether the audits can be planned together so shared processes are reviewed once.
5. Ask for the audit-time justification. ISO/IEC 17021-1 clause 9.1.4 requires documented procedures for determining audit time, with the duration and its justification recorded. You can ask for that justification with your quote and compare providers on the same basis.

Costs outside the audit fee

Some of the largest costs never appear on the certification body's invoice.

Penetration testing. ISO/IEC 27001:2022 does not name a penetration test as a requirement. Annex A 8.8, management of technical vulnerabilities, requires a risk-based process for finding and handling vulnerabilities. Read against that control, a pentest is one common way to evidence it. The method is your choice, not the standard's.

Tools. Many companies buy a compliance platform, a policy management tool or security software during implementation. These are optional purchases. Price them against the internal time they save.

Internal time. Someone has to own the ISMS, run the risk assessment, conduct internal audits, attend management review and host the auditors. For a small company, that time is often the cost to plan for most carefully, because it competes with product and sales work.

Next step

Start your budget with an honest headcount: employees, contractors and freelancers in scope, grouped by role. With that list, a certification body can show you the starting band, any reduction it would consider, and the complexity factors it sees. See our ISO 27001 certification page for how the audit works, or contact us for a quote with the audit-time justification included.

Sources

• ISO, ISO/IEC 27006-1:2024 Information security, cybersecurity and privacy protection: Requirements for bodies providing audit and certification of information security management systems: Part 1: General. Published 1 March 2024; replaces ISO/IEC 27006:2015. Retrieved 23 October 2026. Annex C band figures are as reported by secondary sources.
• ISO, ISO/IEC 17021-1:2015 Conformity assessment: Requirements for bodies providing audit and certification of management systems, clauses 9.1.3.2 and 9.1.4. Retrieved 23 October 2026.
• ISO, ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems: Requirements. Published 25 October 2022; price CHF 155; Amendment 1:2024 free. Retrieved 23 October 2026.
• Transition end date for ISO/IEC 27001:2013 (31 October 2025), as published consistently by certification bodies including SGS and BSI. Retrieved 23 October 2026.

About the author

Ersin Çetin is a lead auditor with more than 25 years of experience in management system audits, including ISO 9001, ISO 14001 and ISO/IEC 27001. This article explains the published standards as of 23 October 2026; it does not reproduce ISO text and is not legal or financial advice. EUROTECH Certification, the publisher of this article, offers ISO 27001 certification.

Editorial standards: we cite ISO publications directly, give edition or retrieval dates for every reference, label practice separately from requirements, and mark examples as hypothetical. If you spot an error, tell us through our contact page and we will correct it.