How much does ISO 27001 cost for a small business, and what drives the cost?

There is no single price for ISO 27001, because the cost depends on your business, not on the standard. What you pay is made up of a few separate things, and most of them move up or down depending on decisions you control. Understanding those decisions before you ask for quotes puts you in a much stronger position, and it helps you see what you're buying: a way to win bigger customers and answer their questions faster, not just a certificate.

This guide covers what drives the cost. For worked ranges with sources, see what ISO 27001 costs a UK business. We don't quote market prices here, because they vary and change.

The five things you pay for

1. The certification audit. A certification body assesses your system and issues the certificate. This is paid to them, not to a software vendor or an adviser, and you can't skip it if you want certification.
2. Keeping the certificate. Certification isn't a one-off. The certification body checks back at regular intervals, so there is a recurring audit cost as well as the first one.
3. Help with the work. Some businesses use a consultant, some use software, some do it with templates and their own time. Each has a different cost profile.
4. Tools. Software for keeping the records, reminders and evidence.
5. Your own people's time. The cost most businesses underestimate. Someone has to own the system, make decisions and keep it running.

What makes it cost more or less

• The scope. Covering one team or one service is usually simpler than covering the whole company. A scope that is honest and tightly drawn typically means less to assess. Don't shrink it so far that it no longer answers your customers' question.
• The number of people and sites. Certification bodies normally base audit time on how many people are in scope and how complex the organisation is, so bigger or more spread out generally costs more.
• How much you already have. A business that already has written policies, a supplier list and an incident process starts further along than one with nothing.
• Who does the work. A consultant buys speed and experience. Doing it yourself costs less in fees and more in time. Neither is wrong, but be clear which you're choosing; see can you get ISO 27001 without a consultant?
• How the system is kept running. A system that runs on owned, dated tasks is usually cheaper to maintain than one that is rebuilt in a rush before every audit.
• Pricing structure. Per-user pricing, annual lock-ins and add-ons can change what a tool really costs. Ask what's included before comparing.

The questions to ask before you budget

• Which customer, tender or contract is asking, and does it need a certificate or only evidence of a working system? Wording varies, so read it carefully.
• Who inside the business will own this, and how many hours can they genuinely give?
• Do we want a one-off project or a system we can run ourselves year after year?
• What happens to the cost when we grow, add staff or add users?

What ClearIMS costs

ClearIMS is £300 a month, billed monthly, cancel with 30 days' notice. That's one price per organisation, with unlimited users and all features, and no VAT charged. There is no per-seat pricing and no discounting, so you can work out the figure in advance. A Cyber Essentials-only plan is £39 a month.

Some businesses want help getting started. Optional setup consulting from SW Digital Services is £500 to £700 a day, quoted per job, for things like importing an existing ISMS or spreadsheets, setup sessions with your team, or a gap review before stage 1. It's a separate service and never bundled into the software price.

What the price doesn't include: your certification body's audit fees. Your certificate is yours, awarded by your certification body, and nobody can guarantee the outcome.

Questions people ask

Is the software price the total cost of ISO 27001? No. You also pay your certification body for the audit, and your own people spend time on the system.

Does a lower price mean a worse result? Not by itself. Look at what is included, who does the work, and how the system is kept running over the years.

Can we spread the cost? ClearIMS is billed monthly, so the software cost is spread over the year.

How ClearIMS helps

ClearIMS is designed for a business where an IT manager, or an individual or very small team, has been handed ISO 27001. Once AI drafting is activated for your organisation, the AI drafts your scope, risks, Statement of Applicability and policies from a plain-English description of your business. A named person approves every record; the AI never approves anything. Recurring, owned tasks keep the system running, so you aren't rebuilding it before every audit. For a business owner, that means less riding on one person.

See where your money would go in a 20-minute conversation: Book a 20-minute call or try the demo company first. If you sell to the public sector or the NHS, see our pages for public-sector suppliers and NHS suppliers; for telecoms, ISPs and altnets.