SOC 2 Cost and Budget
How much does ISO 27001 cost?
How much does ISO 27001 cost?
For a company under 200 people, ISO 27001 typically costs $15,000 to $50,000 in the first year. Roughly $10,000 to $30,000 of that is certification body audit fees across Stage 1 and Stage 2, and the remainder is implementation: building the management system, closing gaps, tooling, and internal time. The cost scales with headcount, number of locations, and how wide you draw the scope.
Where the money goes
| Line item | Typical range | Notes |
|---|---|---|
| Certification body, Stage 1 + Stage 2 | $10,000 to $30,000 | Scales with headcount, sites, and scope |
| Surveillance audit, years 2 and 3 | ~1/3 of initial fee each | Mandatory to keep the certificate |
| Recertification, year 3 | Close to initial | The cycle restarts |
| Implementation support or platform | $6,000 to $30,000 | Consultant, platform, or both |
| Internal time | Frequently the largest | Rarely counted, always spent |
The three-year cycle is the real budget
ISO 27001 is not a one-time purchase. The certificate runs on a three-year cycle: certification audit in year one, surveillance audits in years two and three, then recertification. Budgeting only for year one understates the commitment by roughly half.
Two rules that affect the price
Your certification body must be independent of your implementer. A firm that helped you build the ISMS cannot certify it. This is unlike the US consulting market and it catches people out when they discover the friendly consultant cannot sign the certificate.
Scope drives cost more than anything else. The audit is priced on the scope statement: which entities, which locations, which systems. A scope covering one product and one office costs materially less than one covering the whole company. Narrow scope honestly, then widen it later.
What makes ISO 27001 cost more than SOC 2 to implement
The audit fees are broadly comparable. The implementation is not, because ISO requires a management system that SOC 2 has no equivalent for:
- A defined scope and information security policy
- A documented risk assessment methodology, applied
- A Statement of Applicability covering all 93 Annex A controls, each included or excluded with justification
- Internal audit, performed by someone independent of the work
- Management review at planned intervals
Those five are the deliverables that consume the time.
Where a platform changes the number
Screenata is $499/month per framework for a company up to 50 employees, $1,000/month at 51 to 200. If you already run SOC 2 with us, ISO 27001 is 70% of the base rate for your size, because the two share most of their evidence through a NIST 800-53 hub and one access-control test can satisfy both.
That covers the implementation and evidence side. The certification body fee is separate and paid to them, not to us, and we do not sell audits or take referral fees from auditors, so the firm you choose is your decision.