UK pricing guide
ISO 27001 certification cost UK
Written and reviewed by the Cost of Compliance editorial teamLast reviewed: October 2026
A small UK organisation should usually budget £6,000 to £25,000 before VAT for its first year. The certification audit is only one part of that total. Scope, readiness, consultant support and internal time can move the final cost much further.
Typical UK cost ranges
| Cost area | Indicative UK range | What changes it |
|---|---|---|
| Stage 1 and Stage 2 audit | £5,000 to £20,000 | Headcount, scope, sites and certification body |
| Consultant support | £8,000 to £40,000 | Readiness and how much work stays in house |
| Surveillance audit each year | £1,500 to £6,000 | Initial audit effort and changes to scope |
| Internal audit | £1,500 to £5,000 | Whether trained staff can perform it |
| Supporting tools and testing | £2,000 to £25,000 | Existing systems and technical gaps |
These are wide market ranges, not official tariffs. UKAS does not set certification prices. Each accredited certification body calculates audit time from the number of people in scope and adjusts it for complexity, sites, technology and risk.
UK auditor day rates in 2026
Published UK market guides put certification body rates at roughly £700 to £1,600 a day. Smaller UKAS accredited bodies often sit around £700 to £1,000. Larger certification brands commonly sit around £1,100 to £1,600. A lower day rate does not guarantee a lower quote because the body may assign more audit days.
Consultant rates are separate. An experienced UK ISO 27001 consultant commonly costs £800 to £2,000 a day. A prepared team may buy only a gap review and internal audit. A first time team may buy ten to thirty five days covering scope, risk assessment, the Statement of Applicability, policies, evidence and management review.
UKAS accreditation matters
Check that the certificate will be issued by a UKAS accredited certification body if customers, tenders or regulators expect recognised certification. Cheaper non UKAS certificates are sold from about £1,295 plus VAT, but they may not satisfy procurement requirements. Ask the buyer before choosing solely on price.
UKAS accreditation does not mean UKAS audits your company. UKAS accredits and oversees the certification body. That body then performs Stage 1, Stage 2 and the annual surveillance audits.
What happens over three years
Stage 1 reviews the management system design and readiness. Stage 2 tests whether the system operates in practice. After certification, the body returns for surveillance in years two and three. A recertification audit begins the next cycle. Budgeting only for Stage 1 and Stage 2 understates the commitment.
For an established small business, the certification body may charge £6,000 to £10,000 for the first audit and £1,500 to £4,000 for each surveillance visit. A wider or more complex organisation can spend £10,000 to £20,000 on the first audit and up to £6,000 a year on surveillance.
The costs outside the audit quote
Internal time is often the largest cost. Someone must own the risk register, supplier reviews, incidents, training, objectives, internal audit and management review. Software can organise evidence, but it cannot make risk decisions or operate controls for you.
Technical gaps also matter. Multi factor authentication, device management, logging, backup testing and penetration testing can add thousands of pounds. Do not treat every tool as an ISO requirement. Buy what your risks and chosen controls justify.
VAT and quote comparison
UK business prices are normally shown before VAT. Add 20 percent when planning cash spend unless the quote says VAT is included. A VAT registered organisation may be able to reclaim it. Confirm treatment with your accountant.
Compare the proposed scope, audit days, travel, certificate fee and surveillance schedule rather than comparing one headline number. Ask whether the body is UKAS accredited for ISO 27001 and whether the quote assumes remote or on site work. Keep certification independent from consultancy so the auditor is not checking its own advice.
A sensible first budget
A prepared company with fewer than fifty people may complete the first year for £6,000 to £15,000 before VAT if staff do most of the work. A team that needs substantial consultant help, new systems and technical testing can reach £25,000 to £60,000. Larger or multi site scopes can go beyond that range.
If ISO 27001 is more than customers need today, the Cyber Essentials Plus calculator prices a narrower UK technical certification. If international buyers are also asking for an attestation, compare the paths in the ISO 27001 vs SOC 2 guide.