The short answer
A UK startup with up to 10 people should budget about £11,300 to £31,500 for ISO 27001 certification in the first year, ex VAT. That covers a Stage 1 and Stage 2 audit by a UKAS-accredited body (£3,500 to £6,000), software or a consultant, and a penetration test. With 11 to 50 people, budget about £14,800 to £38,000.
The low end is a UK platform or a fixed-fee consultant. The high end is a US platform such as Vanta or Drata. Team time comes on top: UK estimates put it at 150 to 300 hours on a supported project, and it's the line most founders forget.
All figures are current UK market ranges, checked on 22 October 2026. Each line names its sources, and where we combine sources or derive a figure, we say so. None of them are Kantis prices.
ISO 27001 costs in the UK at a glance
First-year costs, ex VAT. Prices from US vendors are converted at about $1.34 to £1.
| Cost line | Up to 10 people | 11-50 people | Sources |
|---|---|---|---|
| Certification audit, Stage 1 + Stage 2 (UKAS-accredited body) | £3,500-£6,000 | £4,500-£7,000 | ClauseWise, 2SB |
| Compliance software, one framework, per year | £5,300-£19,000 | £5,300-£19,000 | Hicomply pricing (from £5,300); Vendr (Vanta and Drata: about £9,000-£19,000 under 50 people) |
| Or: consultancy, fixed fee for implementation | £6,000-£10,000 | £6,000-£12,000 | 2SB, ClauseWise |
| Penetration test, one web app and API | £2,500-£6,500 | £5,000-£12,000 | JUMPSEC, Cyphere, Mecanik, ClauseWise |
| Year-one total, one route | £11,300-£31,500 | £14,800-£38,000 | Sum of the lines above |
| Team time | 150-300 hours | 150-300 hours and up | ClauseWise, Hicomply |
Size bands are our split of the sources' bands. The total assumes you pick one route, software or a consultant. Some teams buy both, and then the total rises by the cost of the second one.
The certification audit: what drives the fee
The certification body's fee is the one cost every route shares. It is set by audit days, not by a price list. The number of days comes from the ISO/IEC 27006 rules for certification bodies and depends mostly on headcount, scope and complexity (TÜV NORD).
- Day rates: roughly £1,200 a day at a smaller accredited body, £1,250 mid-market and up to £2,000 at the biggest names (Hicomply).
- Days: about 3 to 4 audit days for Stage 1 and Stage 2 at up to 10 people, 4 to 7 days at 11 to 50 people (ClauseWise).
- Split: Stage 1 is a shorter review of your documents and readiness. Stage 2 is the main audit of how the controls work in practice, and most of the fee.
The ranges in the table are ClauseWise's and 2SB's planning estimates, and fit a smaller or mid-market body. At 7 days and £1,250 a day, a mid-market quote can reach about £8,750. A brand-name body at about £2,000 a day can reach about £8,000 for a company of up to 10 people, or £14,000 at 50. Tables built from the full day counts sit at or above the top of our ranges: GRC Solutions shows £6,250 for one employee and £12,500 at 46 people, at £1,250 a day. ISO/IEC 27006 lets certification bodies go down to 70% of those days (GRC Solutions).
UK accredited bodies don't publish rate cards (ExpertSure checked them in October 2026), and quotes for the same scope can differ by 30 to 40% (ClauseWise). Ask two or three bodies for a quote on the same written scope.
UKAS-accredited or not
Non-accredited certificates sell online from about £1,295 plus VAT, then £295 a year (ExpertSure). They are cheap because no accredited body has audited you. If the request came from an enterprise customer, their procurement team will often check the certificate on UKAS CertCheck or IAF CertSearch, so a non-accredited certificate can cost you the deal it was meant to win. Outside the UK, a certificate from a body accredited by another IAF member, such as DAkkS in Germany, is recognised the same way.
After year one: surveillance and recertification
An ISO 27001 certificate lasts three years, with an audit every year.
| Year | Audit | Audit time | Up to 10 people | 11-50 people |
|---|---|---|---|---|
| 1 | Stage 1 + Stage 2 | Full initial audit | £3,500-£6,000 | £4,500-£7,000 |
| 2 | Surveillance | About a third of the initial audit | £1,200-£2,000 | £1,500-£2,300 |
| 3 | Surveillance | About a third of the initial audit | £1,200-£2,000 | £1,500-£2,300 |
| Before expiry | Recertification | About two thirds of the initial audit | £2,300-£4,000 | £3,000-£4,700 |
Surveillance at about a third of the initial audit time comes from TÜV NORD and Schellman, and recertification at about two thirds from Schellman. The surveillance and recertification figures apply those ratios to the year-one fee, so treat them as estimates. Some bodies charge more: ClauseWise budgets £2,000 to £3,500 a year for surveillance at 10 to 50 people, and ClauseWise and Hicomply budget recertification close to the cost of the first audit.
Software subscriptions and penetration tests usually repeat every year too. If you use software and test every year, those lines cost several times the audit fees over three years.
Software, consultancy or both
This is the line with the widest spread, because it depends on how much of the work you want to do yourself.
| Route | What you pay for | Typical UK cost | Who does the work |
|---|---|---|---|
| Do it yourself | Templates, a copy of the standard (£120 from BSI) | Low cash, 600-1,000 hours of team time (Hicomply) | Your team, all of it |
| Consultant | Advice, policies, a gap analysis, often the internal audit | £6,000-£12,000 fixed fee, or £600-£1,400 a day (2SB and ClauseWise fixed fees; ClauseWise day rates) | Shared; evidence and fixes often stay with you |
| Compliance platform | Monitoring, evidence workflows, policy templates | £5,300-£19,000 a year for one framework (Hicomply, Vendr) | Your team, guided by the software |
| Platform plus hands-on support (Kantis) | Software and people who do the preparation with you | Ask for a quote on your scope | Kantis does most of the preparation; your team makes the decisions and runs the controls |
Software is a yearly cost and consultancy is mostly a one-off. If you also want SOC 2 or GDPR work, most platforms charge per framework, so check that before you sign.
If you are weighing Vanta, Drata, Sprinto or Delve, read our comparison for European startups. The useful comparison is total cost: licence, auditor, team time and how much of the work someone else actually does.
Team time: the cost that never shows on an invoice
Every route needs your team. Someone has to decide the scope, approve policies, connect systems, fix what the gap assessment finds and answer the auditor.
- With a platform: 150 to 300 hours (Hicomply). ClauseWise gives the same range for a 20 to 30 person company and prices it at £3,000 to £5,000 of salary.
- Doing it yourself: 600 to 1,000 hours (Hicomply).
Salary cost undersells it. At a startup these are founder and CTO hours that would otherwise go into selling and building.
What it looked like for our customers
- Centinel Analytica, a German bot-detection startup, reached ISO 27001 in under two months. The team spent 15-20 hours in total, because Kantis ran the internal audit, evidence mapping and auditor coordination. Read the Centinel case study.
- Qorelo, a German AI platform for SAP operations, got ISO 27001 in about six weeks with 0 non-conformities, then completed a SOC 2 Type I examination. Read the Qorelo case study.
- Orbion, which builds AI for protein research, led its own implementation and audit preparation using the Kantis platform and support, and passed its Stage 2 audit with zero non-conformities. Its team did substantial hands-on work. Read the Orbion case study.
Costs founders forget
- Penetration test: ISO 27001 doesn't make one mandatory, but you must manage technical vulnerabilities (Annex A 8.8), and enterprise customers often ask for a recent report. A single web app and API costs £2,500 to £6,500 (JUMPSEC, Cyphere, Mecanik, ClauseWise). A larger cloud SaaS platform can run £6,000 to £20,000 (Cyphere).
- Fixing gaps: device management for laptops, single sign-on, backups or logging you don't have yet. Each is small, and they add up.
- Training: every employee needs security awareness training, and most auditors expect a yearly refresher. An online course keeps this small.
- The standard itself: £120 for a digital copy from the BSI shop, if you want to read it.
How to keep the cost down
- Keep the scope tight. One product, one cloud environment, the people who touch it. Scope is the biggest lever on audit days.
- Be ready before you book Stage 1. A major non-conformity at Stage 2 can mean a paid follow-up visit and a later certificate. Fix what you can before you book.
- Get two or three quotes from accredited bodies on the same written scope.
- Pay for one route, not two. A platform plus a consultant plus your own team doing the evidence is how budgets double.
- Plan for three years, not one. Compare routes on the full cycle: three audits, three years of software, three pen tests.
How to budget before you start
Answer five questions first:
- Which product and legal entity are in scope?
- Which customers or deals are driving the requirement, and by when?
- Do they need an accredited certificate? (Usually yes: accredited by UKAS in the UK, or by another IAF member abroad.)
- How many hours a week can your founder and CTO actually give it?
- Is ISO 27001 enough, or do you also need GDPR or SOC 2?
If the answers aren't clear, start with a gap assessment before you buy software or book the audit. For the full process, from scope to certificate, read our ISO 27001 for startups guide.
Where Kantis fits
Kantis combines the software with hands-on support: the gap assessment, policies that match how you actually work, evidence collection, the internal audit and coordination with your certification body. The certification body runs the audit and issues the certificate, and you pay it directly.
Book a free gap assessment and you'll leave with your scope, a realistic budget for each line above and the fastest credible route to the certificate. Calls are in English.