What will ISO 27001 actually cost you?
Four questions, no signup and no email gate. You get the Goldline route that fits, our published price band for it, and a separate estimate of what your certification body will charge.
Certification body days follow ISO/IEC 27006:2015 Table B.1, understood to be carried into ISO/IEC 27006-1:2024 Annex C.
Not company headcount. Only the people doing work inside the boundary, contractors included. If you are certifying the whole company, that is the same number.
This changes the price more than almost anything else. Somebody has to own the management system, because the auditor will audit yours, not a consultant's.
ISO 27001 Sprint, Tier 1
£14,000 to £22,000
Goldline fee, plus VAT. Fixed once the boundary is agreed.
A single boundary of this size with a straightforward footprint. Full implementation by a senior practitioner, with the timeline agreed at scoping.
YOUR CERTIFICATION BODY, PAID SEPARATELY
- Audit days, Stage 1 and Stage 2
- 6 to 9
- Year one
- £9,100 to £12,850
- Three years
- £15,300 to £21,550
The low end is the 30 per cent reduction a certification body may apply where it justifies the reason. The high end is the table figure adjusted for your complexity. A compliant quotation should land inside that range.
Start with the ISO 27001 Readiness Assessment, from £1,950. It sets the boundary properly, and it credits in full against a Sprint, so it costs nothing if you go on.
The staircase
Four rungs, and you do not have to start at the bottom. Each one is a complete piece of work with a published price, and each one credits into the next where it applies.
ISO 27001 Readiness Assessment
From £1,950
Sets the boundary, tests what you have against the clauses and Annex A, and gives you the gap list and the timetable. Credits in full against a Sprint.
See what it covers →RUNG 02ISO 27001 Guided
£7,000
Your team writes and implements. Goldline sets the scope, reviews every artefact against the standard, and holds the line before the audit. Single entity, roughly fifty people or fewer in scope, and a named internal owner.
See how Guided works →RUNG 03ISO 27001 Sprint, Tier 1
£14,000 to £22,000
Audit-ready delivery on a fixed scope, timeline agreed at scoping. Full implementation delivered by a senior practitioner, with the tier confirmed at scoping and the price fixed after that.
See the Sprint plan →RUNG 04ISO 27001 Sprint, Tier 2 and 3
£22,000 and above
Larger or multi-entity boundaries, regulated environments, and anything needing a phased risk treatment plan rather than a single run. Scoped individually.
See the tier table →Start here. On these answers the boundary is not settled yet, and the ISO 27001 Readiness Assessment is the cheapest way to settle it. It credits in full against whatever you buy next, so it costs nothing if you go on.
Want the answer checked by a person?
Forty five minutes, free, with the practitioner who would deliver the work. Bring the questionnaire, the clause or the customer email. You leave with a written note the same day, whether or not you buy anything.
How this works. The Goldline range is our published price band for the route that fits, and nothing else is ever quoted. Certification body days come from the audit time table at ISO/IEC 27006:2015 Table B.1, understood to be carried into ISO/IEC 27006-1:2024 Annex C, keyed on the number of people doing work inside the ISMS scope. A body may reduce that figure by up to 30 per cent where it justifies and records the reason, and no compliant body may go below it, which is why the estimate is a range. Priced at about £1,250 a day for a mid-market UKAS accredited body, with the application fee, programme management and annual management fee included. Auditor travel and subsistence, the certificate or licence fee, non-conformity closure and any re-audit are charged on top, and contract length varies by body. Day rates are market estimates, not published rates, because no UK certification body publishes one. This is an estimate of what a compliant body should arrive at, not a quotation, and it does not bind any certification body. Goldline does not issue certificates, and will not sell implementation and certification to the same organisation for the same scope.