About ISO27001Cost.com
An independent reference for what ISO 27001 certification actually costs, and for the more useful question underneath it: which parts of that cost anybody publishes at all. Operated by Digital Signet, founded by Oliver Wakefield-Smith.
Why this site exists
Most of the top-ranking pages on the ISO 27001 cost question belong to GRC platforms, certification bodies and consultancies with something to sell you, and most of them will give you a confident total. The totals are not real. An ISO 27001 audit fee is audit days multiplied by a day rate, and neither input is published anywhere: no accredited certification body publishes a rate card, and the audit-time tables that determine the days sit in ISO/IEC 27006-1:2024 Annex C, which ISO sells rather than publishes. Any precise fee you have been shown was assembled from assumptions.
So this site does something narrower and more useful. It reports the prices that are genuinely published, with the source and the date we read it. It names the parts that are paywalled and the parts that are quote-only, and explains why. And where no public number exists, it gives you the structure instead: what drives your quote, what to ask for, and how to make competing quotes comparable. A buyer who understands the drivers and asks the right questions ends up with a better number than one who arrived anchored to somebody's invented average.
What this site publishes
- Published GRC platform pricing. List dimensions read off vendors' public AWS Marketplace listings, each with the band the listing states and the date we checked it. This is the one layer of an ISO 27001 budget with real public prices.
- Published Cyber Essentials pricing. The UK scheme publishes certification bands by organisation size on the operator's own site. We report them, and we report that Cyber Essentials Plus publishes nothing.
- Accreditation status, from registers. Read off accreditation bodies' own public registers, never off a certification body's marketing material.
- The mechanics that decide your quote. What governs audit time, what drives it, the three-year cycle, and what to ask a certification body.
What it deliberately does not publish
- Certification-body day rates and audit fees. None are published. We report no figure we would have to invent.
- Audit-day tables. They sit in ISO/IEC 27006-1:2024 Annex C. ISO sells that standard, we have not read the tables, so we neither reproduce nor reconstruct them.
- Consultant day rates. Consultancies quote per engagement and publish no rate. There is nothing to report.
- Headline totals built by summing published dimensions. AWS publishes separate dimensions and no combined figure. Any sum is our arithmetic, is labelled as ours, and never appears in a heading or a stat tile.
- Offer or price structured data. We are not the seller of any third party's product, so we do not emit their prices as machine-readable Offer markup under our name.
The full sourcing standard is on the methodology page.
Who runs the site
Oliver runs Digital Signet, an independent AI-development studio that builds data-led pricing and decision tools using public datasets. After 20 years as a solutions architect and tech lead across media, utilities, satellite, and data, he founded Digital Signet to apply autonomous AI development methodology to real software at scale.
Reach Oliver: [email protected]. Profile: LinkedIn.
About Digital Signet
This site is operated by Digital Signet, an independent AI-development studio founded by Oliver Wakefield-Smith. It is part of a portfolio of cost-reference and calculator sites we run as a live R&D lab for our Signet methodology, an autonomous AI development team that ships real software at scale.
Digital Signet does not sell ISO 27001 certification, does not act as a certification body, does not run a GRC platform, and does not accept paid placements from any vendor in the compliance space. No vendor named on this site has any influence over what it says about them. Editorial direction is set by Oliver. Drafts are produced via Digital Signet's autonomous AI development methodology and reviewed against the sourcing standard before publication.
For consulting enquiries (fractional CTO, AI product strategy, autonomous-dev-team setup): see digitalsignet.com.
Other sites we operate
Digital Signet runs other independent reference sites in the security and compliance cost space, including iso27001certificationcost.com, iso27001auditcost.com, soc2compliancecost.com, pcicompliancecost.com, hipaacompliancecost.com and gdprcompliancecost.com. We list them here as a disclosure of who operates what, not as a reading recommendation.
They are not sources for anything on this site. No figure here is supported by a citation to another site we own, because citing ourselves would be circular and a number does not become verified by being republished under a different domain. Every externally attributed figure on this page and every other page resolves to a primary surface we read, with its URL and a check date.
What this site covers
How audit time is determined, and why no body publishes a rate.
What scales with headcount, and what does not.
Phase by phase, from scoping to Stage 2.
Models, and what to ask before you sign.
The three routes, on published figures where they exist.
Surveillance, recertification, ongoing maintenance.
What most budget estimates miss entirely.
UKAS accreditation and what it means in procurement.
The go or no-go decision that sets your scope.
Phases, dependencies, and the constraint that will not compress.
Certification versus attestation, and who asks for which.
All controls across the four themes.
Editorial principles
- Primary surfaces, with dates. Every externally attributed figure is read off the surface that publishes it and carries the date we checked it. If we could not read it, it is not here.
- Absence is reported, not filled. Where no public number exists we say so and explain why, rather than producing an estimate that would look like a fact.
- No paid placements. We do not sell certification, do not act as a certification body, do not run a GRC platform, and accept no paid placement from any vendor in this space.
- Our arithmetic is labelled as ours. Where a calculator or a page adds published figures together, the working is visible and the sum is identified as ours rather than as anyone's published price.
- Update when the surface changes. Figures move when the listing, scheme or standard behind them moves. Cosmetic date bumps are not made.
Corrections
If something here disagrees with the source it cites, tell us and we will fix it. That invitation extends to the vendors and certification bodies we write about: [email protected].