How Much Does ISO 27001 Certification Cost in the UK? (2026 Prices by Company Size)

What ISO 27001 is and what actually gets certified

ISO/IEC 27001 is the international standard for setting up an information security management system (ISMS). What gets certified is that system: proof that the organisation has identified its risks, decided which controls to apply, put them in place and reviews them on a regular cycle. It doesn’t certify that you will never be attacked. It certifies that you manage security with a method.

The current version is ISO/IEC 27001:2022. Its Annex A lists 93 controls in four groups: organisational, people, physical and technological. You don’t have to apply all of them. You justify which ones apply in a document called the Statement of Applicability, and the auditor works from that. Certificates issued against the 2013 version stopped being valid when the transition period ended on 31 October 2025, so any quote you receive now should refer to the 2022 version.

More companies hold it every year. According to the ISO Survey, there were 96,709 valid ISO 27001 certificates worldwide in 2024. The pressure behind that number is easy to see in the UK: the government’s Cyber Security Breaches Survey 2025 found that 43% of businesses identified a breach or attack in the previous twelve months, rising to 67% of medium and 74% of large businesses. Larger customers have pushed that risk down to their suppliers, and ISO 27001 is the most widely recognised way to show you take it seriously.

What makes up the ISO 27001 certification cost

Be wary of anyone who gives you a fixed price without asking questions. The total comes from four separate items, and it pays to look at them one by one because each is charged by someone different.

Implementation consultancy

This is the largest item. It covers the gap analysis, the risk assessment, writing policies and procedures, the Statement of Applicability, staff training and the internal audit before certification. Some companies do it without outside help, but that only pays off if someone on the team has implemented an ISMS before.

Certification audit

An independent certification body carries it out in two stages: a documentation review (stage 1) and an on-site or remote assessment of how the system works in practice (stage 2). The price depends on auditor days, and auditor days depend mostly on how many people are in scope. Use a body accredited by UKAS, the UK’s national accreditation body. Certificates from unaccredited bodies are cheaper, but many procurement teams won’t accept them, and you may find out too late.

Tools and technical measures

This covers the platform you use to run the ISMS (plenty of companies start with spreadsheets, and that’s fine), endpoint protection or EDR, backups, multi-factor authentication and a vulnerability scan. If you already have a reasonable baseline, this item is small. If you don’t, it’s often the one that surprises people.

Internal staff time

It never appears on an invoice, but it’s real. Someone has to coordinate the project, and the teams involved have to give up hours for interviews, reviews and evidence. In a small business, plan for 4 to 8 hours a week from one person throughout the implementation.

ISO 27001 certification cost in the UK in 2026

These are the ranges we see in proposals from specialist companies and across the UK market in 2026, by organisation size, for a standard scope (the whole company, one or two sites):

Indicative market ranges, excluding VAT. The final price is set by the proposal from the company you choose, once it has seen your scope and starting point.

The “total first year” figure includes basic tools and some technical fixes. Annual upkeep covers the certification body’s surveillance audits (required in years two and three), the internal audit and a refresh of the risk assessment. In year three comes recertification, which usually costs 60% to 80% of the initial audit.

If you want a quick figure for the audit and assessment side of your own case, our cybersecurity audit cost calculator gives you a range in a couple of minutes.

Cyber Essentials: the cheaper certificate many UK customers ask for first

Before you commit to ISO 27001, check what your customer is actually asking for. In the UK, a lot of supplier questionnaires and public contracts start with Cyber Essentials, the government-backed scheme run by the NCSC. It covers five technical controls: firewalls, secure configuration, user access control, malware protection and security update management.

• Cyber Essentials is a verified self-assessment. The certification fee starts at £320 plus VAT for micro organisations and rises with company size. Some providers bundle in support and charge more.
• Cyber Essentials Plus adds hands-on technical testing by an assessor. In the market it usually costs between £1,500 and £5,000 for a small or mid-sized company, depending on the number of devices and sites, before any remediation work.

For central government work, Cyber Essentials has been required since the procurement policy note 09/14 for contracts that involve handling personal information and certain ICT services. Many private customers copy that requirement into their own supplier terms.

The two aren’t competitors. Cyber Essentials proves a technical baseline on your devices; ISO 27001 proves you run security as a managed system, with risk assessment, policies, supplier management and continual improvement. Plenty of UK companies get Cyber Essentials in a few weeks to unlock a contract, then work towards ISO 27001 over the following year. The controls overlap, so the first certificate is a head start on the second.

What pushes the budget up or down

Two companies of the same size can receive quotes that differ by a factor of two. These are the usual reasons:

• Scope. Certifying a single service or department costs far less than certifying the whole organisation. Many companies start with what the customer asks for and widen the scope later.
• Headcount and sites. This is what sets the number of auditor days. Each extra site adds auditor and consultant time.
• Starting point. If you already have an asset inventory, tested backups, access control and some written policies, you save weeks.
• Infrastructure. A company that runs almost everything in the cloud with certified providers has fewer physical and technical controls to justify than one with its own servers.
• In-house software development. If you build your own product, secure development, change management and testing controls come into play, and the work grows.
• Urgency. Squeezing implementation into three months needs more consultant hours per week and usually makes the project more expensive.

How long ISO 27001 certification takes

For a small or mid-sized business, six to twelve months from kick-off to certificate is normal. The typical route looks like this:

1. Gap analysis (2-4 weeks): where you stand against the standard and what’s missing.
2. Risk assessment and Statement of Applicability (1-2 months): what assets you have, what could happen to them and which controls you apply.
3. Implementing controls (2-6 months): policies, procedures, technical measures and training.
4. Running period: the auditor will want records showing the system works, normally for at least two or three months.
5. Internal audit and management review.
6. Certification audit, stage 1 and stage 2. Any nonconformities have to be closed before the certificate is issued.

The certificate lasts three years, with annual surveillance audits. It isn’t a one-off spend, so budget for upkeep from day one.

How to avoid overpaying

• Limit the scope to what you’re being asked for. If the customer needs certification for one service, start there.
• Reuse what you already have. Work done for UK GDPR (records of processing, security measures) and for Cyber Essentials carries over in large part.
• Get at least three quotes from certification bodies. Auditor days are fairly standardised, but day rates vary.
• Don’t buy a compliance platform on day one. Understand which controls apply to you first, then decide whether you need a tool.
• Keep consultancy and certification separate. Whoever helps you implement can’t be the body that certifies you, and it’s cleaner to have two clear contracts.

One practical point: the standard requires you to manage technical vulnerabilities, and a penetration test is among the evidence that works best with auditors. If you’re not sure what that adds to the budget, our guide to how much a penetration test costs in the UK has prices by type of test, and the penetration test cost calculator gives you a range for your own scope.

ISO 27001 vs Cyber Essentials vs Cyber Essentials Plus: which one you need

They’re often confused. Before asking for quotes, be clear about which one is being requested:

A note on NIS2 if you sell into the EU. The EU’s NIS2 Directive doesn’t apply in the UK, but it does reach UK companies that provide services in EU member states within its sectors, and their EU customers increasingly pass its requirements down to suppliers. There’s no NIS2 certificate. A well-run ISO 27001 system covers a large share of the risk management, incident handling and supply chain measures it expects, which is one more reason UK firms with EU clients tend to choose ISO 27001 over Cyber Essentials alone.

How Yeeply can help

At Yeeply we work with certified companies specialising in cybersecurity services for companies that guide ISO 27001 projects from gap analysis to the certification audit. We select and supervise them, put comparable proposals in front of you with clear scope, timeline and price, and follow the project until you have the certificate.

Our first option is a certified company based in the UK, familiar with UKAS bodies and with the customers and tenders you’re dealing with. If budget is tight, we also work with certified Spanish teams that deliver the same methodology for around 30% to 40% less, working remotely for most of the project.

If you’d like a proposal for your case, click “Receive price estimate” at the top right of yeeply.com/en or email us at sales@yeeply.com. Tell us how many people you have, how many sites, and who is asking for the certification.