All services Every engagement has a fixed, published price. Book a strategy call
The real components of ISO 27001 cost in the UK: consultancy fees, certification body charges over the three year cycle, internal time, ongoing running costs, and where budgets quietly drift.
Ask five providers what ISO 27001 costs in the UK and you will get four refusals to say and one number that doubles once work starts. This guide sets out the real components: what the consultancy work costs, what the certification body charges, what your own time is worth in the calculation, and where budgets quietly drift. Every Intelance fee named here is published on our service pages, fixed in writing before work starts.
The short answer. For most UK organisations, ISO 27001 certification has three cost components: preparation and implementation with a consultancy (with Intelance, a gap assessment from £8,500 + VAT and full implementation from £25,000 + VAT, fixed by scope), the certification body itself (typically £4,000 to £12,000 over the three year cycle, paid to a UKAS accredited body), and your own team’s time. Ongoing, the system costs from £2,500 + VAT per month to run as a managed service, or your own effort plus an internal audit from £4,500 + VAT a year.
Four things move the number more than anything else. Scope: how many sites, people and systems the certificate covers. A single office SaaS business and a multi-entity group are different projects, which is why careful providers fix the fee only after scoping. Existing maturity: an organisation that already holds Cyber Essentials and runs basic controls starts several rungs up the ladder. Internal capacity: someone inside the business has to own the information security management system, the ISMS, and answer for it. Where nobody can, the implementation and the running cost more. What the ISMS is for: a system built to pass an audit costs less up front and far more over three years than one built to run, because shelf documentation gets rebuilt every audit season.
| Component | Fee | Notes |
|---|---|---|
| Gap assessment (readiness assessment) | From £8,500 + VAT | Every clause of ISO/IEC 27001:2022 and all 93 Annex A controls assessed, every gap costed and sequenced. One to two weeks. |
| Implementation (ISMS Foundations) | From £25,000 + VAT, fixed by scope | Scope, risk process, Statement of Applicability, controls and the operating rhythm, running before Stage 1. Three to six months. |
| Certification body (Stage 1, Stage 2, surveillance) | £4,000 to £12,000 over 3 years | Paid to the accredited body, priced by scope and headcount. This fee is separate from any consultancy. |
| Internal audit (clause 9.2) | From £4,500 + VAT | Required every cycle. Programmes and multi-site audits from £9,500 + VAT. |
| Managed ISMS | From £2,500 + VAT per month | The certified system run month by month: risk reviews, policy upkeep, evidence keeping, the internal audit cycle and audit season hosted. |
Your own team’s time is the component nobody invoices and everybody pays: attending workshops, providing evidence, owning risks and running the controls. A well designed implementation minimises it by building the ISMS around how the organisation already works rather than adding a parallel bureaucracy.
The certificate itself comes from a certification body, and in the UK the mark that matters is UKAS accreditation. The body charges for a Stage 1 audit (documentation and readiness), a Stage 2 audit (the certification audit proper), surveillance visits in years two and three, and recertification at the end of the cycle. Across the three years this typically totals £4,000 to £12,000 depending on the size and complexity of the scope.
Two warnings belong here. First, a consultancy that claims to sell you the certificate is selling something weaker: certification only comes from an accredited body, and the body must be independent of whoever helped you prepare. Second, certificates from unaccredited bodies exist and cost less, and enterprise customers increasingly check: a certificate that fails that check has bought you nothing.
Before budgeting anything, it helps to know where you stand. The free ISO 27001 and ISO 42001 readiness checker scores the clauses auditors test in about six minutes and estimates your timeline.
A typical first year for a mid-size UK organisation starting from limited maturity is composed of: a gap assessment from £8,500 + VAT to establish the true position, implementation from £25,000 + VAT fixed by scope, and the certification body’s Stage 1 and Stage 2 fees as the first slice of its three year total. Organisations that already run mature controls sometimes step straight from the gap assessment to certification support without full implementation, which is one reason the gap assessment comes first: it prices the rest of the journey from evidence, and with Intelance it is credited into the picture rather than repeated.
Certification is a three year cycle, and the running costs are where budgets are honest or not. The system must be operated: risks reviewed, policies kept current, evidence kept as it is produced, the clause 9.2 internal audit delivered every cycle, and surveillance visits hosted. Run internally, that is real staff time plus an independent internal audit from £4,500 + VAT. Run as a service, the Managed ISMS covers the whole rhythm from £2,500 + VAT per month with a named senior owner and no lock-in. The expensive third option is neglect: an ISMS that stops being run costs a rebuild at the next audit season.
Four patterns account for most overruns. Day-rate engagements without a fixed scope: the fee is only knowable at the end, which is why we publish floors and fix fees in writing before work starts. Documentation bought instead of a system built: template packs are cheap until the Stage 1 auditor asks who runs the machinery. Tools bought too early: the standard requires no software, and platforms bought before the ISMS design exist to serve the tool rather than the system. Failing Stage 1: going to audit unready buys a second audit. A readiness assessment exists precisely to make that outcome unlikely, and our readiness checklist covers what Stage 1 examines.
That depends on who is asking for it. Where enterprise customers, regulators or investors require ISO 27001, the certificate is the price of the revenue and the calculation is short. Where nobody requires it yet, Cyber Essentials delivers the security baseline at a fraction of the cost, and the sensible sequence is often Cyber Essentials now and ISO 27001 when a customer asks. Our comparison of Cyber Essentials against ISO 27001 covers that decision in detail.
Three components: consultancy support (with Intelance, a gap assessment from £8,500 + VAT and implementation from £25,000 + VAT fixed by scope), certification body fees of typically £4,000 to £12,000 over the three year cycle, and your own team’s time. Ongoing running costs from £2,500 + VAT per month as a managed service.
Three to six months for implementation with Intelance, sequenced backwards from your deadline, with the ISMS running before Stage 1. Larger and multi-entity estates take longer, and we say which at scoping.
Yes, with enough internal expertise and time: the standard is public and the certification body examines the system rather than who built it. The trade is your team’s months against a fixed consultancy fee, plus the risk of learning Stage 1’s expectations by failing it. A gap assessment is a low-commitment way to find out how far you are from ready.
No. The standard requires a working management system, and spreadsheets and existing tools can carry a small organisation through certification. Platforms help at scale, and they serve the system best when chosen after the ISMS is designed.
The certification body’s surveillance fees within its three year total, the clause 9.2 internal audit from £4,500 + VAT, and the running of the system itself: from £2,500 + VAT per month with a managed service, or your own team’s time.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
