Key Takeaways
- The figures on this page are typical market benchmarks for consultant-led projects, not Kertos prices. Kertos does not publish a list price and quotes after a scoping exercise.
- Typical market cost for ISO 27001 certification in the first year is EUR 23,000 to 49,000 for startups under 50 employees and EUR 37,000 to 80,000 for scale-ups with 50 to 200 employees. That covers gap analysis, ISMS implementation and the certification body's audit fees.
- The annual surveillance audit is not included. From year two it typically costs EUR 4,000 to 7,000 for a startup and EUR 6,000 to 10,000 for a scale-up.
- No vendor reduces the certification body's fees. Preparation and implementation are reducible, because that is where the manual effort sits.
The ranges below describe the market for consultant-led ISO 27001 projects, meaning a project run with an external consultant and without automation (as of August 2026, net prices, euros). They are intended as orientation for your own budgeting, not as a Kertos price list. What a project with Kertos costs depends on scope and is covered further down.
What does ISO 27001 certification cost in the first year on the open market?
Typical market cost of a consultant-led ISO 27001 project, as of August 2026, net prices in euros. These are industry benchmarks, not Kertos prices.
| Cost block |
Startup (under 50 employees) |
Scale-up (50 to 200 employees) |
| Gap analysis and preparation |
EUR 5,000 to 15,000 |
EUR 10,000 to 25,000 |
| Implementation |
EUR 10,000 to 20,000 |
EUR 15,000 to 35,000 |
| Certification audit fees |
EUR 8,000 to 14,000 |
EUR 12,000 to 20,000 |
| Typical year 1 total, consultant-led route |
EUR 23,000 to 49,000 |
EUR 37,000 to 80,000 |
| Annual surveillance audit (from year 2) |
EUR 4,000 to 7,000 |
EUR 6,000 to 10,000 |
The year 1 total covers preparation, implementation and the certification audit. The surveillance audit sits below it deliberately, because it does not fall due until the following year.
Why do quotes differ so widely?
Scope drives the number more than anything else. An ISMS covering a single SaaS product in one cloud environment is a different exercise from a scope spanning several sites and legal entities. Next comes documentation maturity: if policies, a risk register and evidence are already partly in place, the gap analysis costs a fraction of a project starting from nothing.
The audit fees follow no price list but the number of audit days, which ISO/IEC 27006 derives largely from the headcount inside the scope, multiplied by the certification body's day rate. Two quotes usually differ on that day rate rather than on the underlying effort.
What does ISO 27001 cost after certification?
The certificate is valid for three years. A surveillance audit falls due in each of the two following years, and in the third year a recertification audit re-examines the full scope. Budgeting only for year one understates the true cost by the maintenance effort across the entire three-year cycle.
What does ISO 27001 certification cost with Kertos?
The figures above describe the market, not the Kertos offer. Kertos does not publish a list price, because the effort depends on headcount, system landscape and the state of your documentation. You get a fixed budget based on a scoping exercise. The Essential, Pro and Premium packages differ in how much work stays with your team: the AI agent KAIA and more than 100 integrations handle inventory, evidence collection and documentation, and in Pro and Premium Kertos certified experts also take the judgement calls, up to an external CISO mandate.
The certification body's fees are unaffected. They apply on every route to certification and are settled directly with the auditor, not through Kertos. What shifts is the effort inside preparation and implementation: customers reduce their manual compliance effort by around 80 percent.
What do customers say about ISO 27001 certification with Kertos?
"It's helping us to achieve ISO 27001 and GDPR compliance fast and affordably."
Lennard G., Co-Founder & CTO, G2
"With Kertos, we had a clear roadmap, centralized documentation, and automated compliance checks. As a result, we obtained our ISO certification in a fraction of the expected time."
Lennart P., CTO, G2
"It helps us keep track of all the to-dos during onboarding and certification. Afterwards, it reduces our admin work to a minimum."
Verified User, Environmental Services, G2
Kertos supports European tech companies with a 100 percent audit pass rate and 98 percent customer satisfaction. AskUI reached ISO 27001 in 8 to 10 weeks, without external consultants. For what the standard requires and how the process runs, see ISO 27001 with Kertos. For a budget against your own scope, request a quote.
