How much does ISO 27001 cost a small UK business?

For a UK business of 10 to 50 people, getting ISO 27001 certified typically costs £8,000 to £25,000 in the first year (as of 2026), and then £2,000 to £10,000 a year to keep it. The biggest variables are whether you hire a consultant and how many people are in scope. The one cost you can't avoid is the certification audit itself.

This guide breaks the money down into the four things you actually pay for, so you can build a realistic budget before you speak to anyone selling anything.

The four costs

Cost	Typical range (10–50 staff, 2026)	Can you avoid it?
Certification audit (stage 1 + stage 2)	£3,500–£10,000	No
Yearly surveillance audits	£1,500–£3,000 a year	No
Consultant	£3,000–£25,000	Yes
Software or templates	£0–£15,000 a year	Partly
Your own people's time	Weeks of work	No, but you can cut it

Larger organisations (50 to 250 people) should expect the audit alone to be roughly £10,000 to £20,000.

1. The certification audit

ISO 27001 certificates are issued by certification bodies. In the UK, choose one accredited by UKAS. The certification body runs two audits:

Stage 1 checks your documentation: scope, risk assessment, Statement of Applicability, policies.
Stage 2 checks that your system is actually working: evidence, records, interviews.

Certification bodies charge by the audit day, and the number of days is set mainly by how many people are in your scope, under the rules in ISO/IEC 27006-1. A commonly quoted 2026 day rate is around £1,250; the best-known names charge more.

One real quote published for a small organisation in late 2025 came to £6,804 for the first certification: an application fee, one day of stage 1, two days of stage 2 and a programme management fee. Published ranges for under-50 organisations run from about £3,500 to £12,500.

What drives it: headcount in scope, number of sites, how complex your IT is, and which certification body you choose. Ask at least two or three for a quote.

2. Keeping the certificate

A certificate lasts three years, with a surveillance audit in years two and three, then a recertification audit. For a small organisation, surveillance typically costs £1,500 to £3,000 a year, often about a third of the initial audit fee.

You also have to keep the system running between audits: risk reviews, internal audits, management reviews, supplier checks, training and evidence. That isn't an invoice, but it is the cost most businesses underestimate.

3. Consultants

You don't have to use a consultant, but many small businesses do. Typical 2026 figures:

Day rates: roughly £800 to £1,500.
Fixed-price projects: from about £3,500 for coaching-style support, to £8,000 to £25,000 for a consultant to take a small organisation through to certification.
Year-one total with the audit: commonly quoted at £12,000 to £23,000 for a UK SME.

A good consultant saves you time and mistakes. The catch is that most projects end at certification, and the work of running the system every year then falls back on you.

4. Software and templates

Options range widely:

Template packs (Word and Excel) from a few hundred pounds. Cheap, but you write and maintain everything yourself.
Compliance platforms built for larger, often US, companies typically cost £10,000 to £40,000 a year.
Tools aimed at small businesses sit at roughly £1,000 to £6,000 a year.

Check whether the price is per user, whether it includes the certification audit (it usually doesn't), and whether you're locked into an annual contract.

5. Your own time

Whatever you buy, someone in your business has to understand the system, make the decisions and approve the documents. The certification body is assessing your organisation, so this can't be fully outsourced.

The alternative some businesses consider is hiring a dedicated person. Permanent UK roles that mention ISMS had a median salary of about £60,000 in the six months to September 2026, before employer costs.

Example budgets

These are illustrations, not quotes. Use them to sanity-check proposals.

A 20-person business, doing it with a consultant

Consultant project: £8,000–£15,000
Certification audit: £6,000–£8,000
Year one: about £14,000–£23,000. Year two onwards: £2,000–£3,000 surveillance, plus your time or more consultant days.

A 20-person business, doing it in-house with software

Software: £1,800–£3,600 a year
Certification audit: £6,000–£8,000
Year one: about £8,000–£12,000, plus your team's time. Year two onwards: software plus £2,000–£3,000 surveillance.

How to keep the cost down

Get the scope right. A tighter, sensible scope means fewer audit days. Don't include parts of the business that don't need to be in it.
Start from a draft, not a blank page. Writing a risk register and Statement of Applicability from nothing is where the time goes.
Get several audit quotes. Day rates and day counts vary between certification bodies.
Plan for year two from the start. A system that runs on tasks and owners is much cheaper to keep than one rebuilt before every audit.
Check what's included. Per-user pricing and annual lock-ins can double the real cost of software.

How ClearIMS helps

ClearIMS is for businesses that need ISO 27001 but don't want to build a compliance team to get there. You describe your business in plain English and it drafts your scope, risk register, risk treatments, Statement of Applicability, policies and tasks. A named person in your business reviews and approves every record; the AI never approves anything. Then it keeps the system running with owned, dated tasks.

The founding price is £150 a month, locked for 24 months (or £1,500 a year), with unlimited users and no VAT charged. The standard price is £300 a month. You still pay your certification body for the audit: your certificate is yours, awarded by them, and nobody can guarantee it.

Not sure where you stand? Take the 2-minute readiness check, or book a 20-minute call.