October 2026. ‘What does ISO 27001 cost and how long does it take?’ is the question we hear most often. The honest answer is that it depends on your starting point, and that a fixed amount for everyone is misleading. What can be said: where the costs sit and what determines the timeline. Current indications are on our pages on cost and duration.
The four cost items
1. Internal hours: usually the biggest item. Building the ISMS, assessing risks, writing policy and collecting evidence takes your own people’s time. 2. Guidance or tooling: a consultant, software or both. 3. Technical measures: for example MFA, encryption, backups, logging and MDM, where you did not yet have them. 4. The certification audit: the certification body’s fees, which grow with size and complexity and recur annually for surveillance.
What raises the cost
A larger scope, more locations, a lot of in-house development, more suppliers, and low starting maturity. An organisation that already has processes, policies and controlled system management finishes sooner than one starting from zero.
What determines the timeline
In practice a programme usually takes from a few months to more than a year. Timeline is determined less by the standard than by available time, decision-making and the period you need to operate demonstrably: the auditor wants evidence of several months of operation, such as an internal audit and a management review.
How to control costs
Keep the scope deliberately limited to what the customer requires, reuse what you already have (for example from SOC 2, ISO 9001 or NEN 7510), automate evidence collection where possible, and choose a certification body with a clear three-year quote. See also automating evidence.
Start with a baseline
The best first step is a baseline: where do you stand, what gaps exist, and what does that mean for hours and budget? The readiness scan gives you that view quickly, with no obligation. To walk through the whole route, read the overview of ISO 27001 certification.