Short answer: For most Australian organisations with 5 to 50 people, ISO/IEC 27001 certification with us costs between $16,800 and $30,600 for the full three-year cycle, excluding GST, for a typical scope at one site. Year one, the certification audit and certificate, is $6,500 to $12,500. The price is set by audit time, and audit time is set by the number of people in scope, the complexity of the system and the number of sites, following ISO/IEC 27006-1.
ISO 27001 certification prices by organisation size
One site, every auditor qualified, typical complexity (some sensitive information, cloud services and varied IT):
| People in scope | Year one | Each surveillance year | Recertification | Three-year total |
|---|---|---|---|---|
| 5 | $6,500 | $2,800 | $4,700 | $16,800 |
| 15 | $7,700 | $2,800 | $5,900 | $19,200 |
| 30 | $10,700 | $4,000 | $7,700 | $26,400 |
| 50 | $12,500 | $4,600 | $8,900 | $30,600 |
| 100 | $14,900 | $5,200 | $10,700 | $36,000 |
| 250 | $17,300 | $6,400 | $11,900 | $42,000 |
A straightforward scope (one main activity, standard IT, not heavily regulated) costs less, and a complex or regulated one costs more:
| People in scope | Straightforward | Typical | Complex or regulated |
|---|---|---|---|
| 5 | $15,000 | $16,800 | $19,200 |
| 30 | $25,200 | $26,400 | $31,800 |
| 100 | $33,600 | $36,000 | $43,200 |
What is included?
Every figure on this page is the full three-year certification cycle, in Australian dollars, excluding GST. It covers:
- the stage 1 and stage 2 certification audit;
- the certification decision and certificate;
- a surveillance audit in year two and in year three, with the annual certification fee;
- the recertification audit before the certificate expires.
There is no application fee. Travel is charged at cost and shown in the quote. Prices are as at October 2026.
What drives the price of ISO 27001 certification?
- People in scope. ISO/IEC 27006-1 sets a starting audit time by headcount. For example, 1 to 10 people starts at 5 auditor days and 26 to 45 people at 8.5 days, before adjustment. Count everyone who works under the system, on all shifts, including contractors.
- Complexity. The criticality of the information, how regulated you are, how much IT and outsourcing you rely on and whether you develop software can move audit time up or down. It can never go more than 30 per cent below the table.
- Sites. Extra sites add time. Where every site does similar work under one centrally run system, a sample can be audited instead of every site. In our example, 30 people across four similar sites costs $27,600, against $30,600 when every site must be visited.
- Other standards. Auditing ISO 27001 together with ISO 9001, ISO/IEC 27701 or ISO/IEC 42001 as one integrated system can reduce the combined time by up to 20 per cent, as IAF MD 11 allows.
What is not in the certification price?
Your own costs sit outside the certification fee: staff time to run the management system, any tools you choose, and any outside help you buy to build the system. As a certification body, we audit and certify. We do not design, implement or maintain management systems, and we do not recommend consultants, because that would compromise the independence of the audit.
How do I get a fixed price?
Use the price calculator for an estimate in under a minute, with no call and no email needed. Then send us your scope, sites and headcount. We confirm one fixed price for the full three-year cycle in writing, and it changes only if your scope changes or a major nonconformity needs a return visit to verify. See our commitments.
Common questions
Is ISO 27001 certification cheaper for a small business?
Yes. Audit time scales with headcount, so a business of 5 people pays much less than one of 250. With us, a typical 5-person scope at one site is $16,800 for the full three years, excluding GST, and $6,500 of that falls in year one.
Why do ISO 27001 certification quotes vary so much?
Some quotes cover only year one, some leave out surveillance or recertification, and some reduce audit time below what the standard requires. Compare the full three-year cost and ask how many audit days each quote is based on. We never cut audit time to reach a price.
How much is an ISO 27001 surveillance audit?
Each surveillance audit is about one third of the initial audit time. With us that is $2,800 to $4,600 a year for 5 to 50 people at typical complexity, including the annual certification fee.
Is the ISO 27001 certification price fixed?
Yes. After a short scope review we confirm one price for the full three-year cycle in writing. It changes only if your scope changes, or if a major nonconformity needs a return visit to verify.
Does ISO 27001 certification cost more with multiple sites?
Usually a little. Sites that do similar work under one centrally run system can be sampled. Sites that do different work must each be audited, which adds time.
Related information:
- ISO/IEC 27001 certification
- How long ISO 27001 certification takes
- How sites and remote teams affect a quote
- Auditing ISO 9001 and ISO 27001 together
- ISO 9001 certification cost in Australia
- ISO 42001 certification cost in Australia
- ISO certification price calculator
- Our commitments
- Start an enquiry
Sources
Prices are estimates for the scope described, in Australian dollars excluding GST, as at October 2026. Your fixed price is confirmed in writing after a short scope review, and the signed agreement governs.