What's Inside

ISO 27001 certification is growing in popularity. Applications are up 22% when compared to the previous decade. As the volume of certifications rises, more organizations are getting up to speed on what they can expect when they pursue this certification.

Keep reading for a break down what to expect when budgeting for an ISO 27001 certification.

Why Get an ISO 27001 Certification?

Taking this on makes sense from an information security and financial standpoint. Getting your certification will allow you to build trust and save money later down the line while minimizing potential risks that lead to data loss.

Main ISO 27001 Certification Cost Factors to Consider

There are several different components that influence the cost of ISO 27001 certification, but there’s one high-level consideration we recommend looking at first:

Company Size and Complexity

The cost of ISO 27001 certification depends on the state of your organization and how much work you need to do to achieve certification. This is largely because the actual time it takes to perform an audit varies depending on the complexity of the information security management system.

The initial certification cost, which includes a Stage 1 and Stage 2 audit performed by an ISO 27001 certification body (i.e external auditor), for a small company with less than 50 employees is likely to come in at less than $15,000. In contrast, companies with hundreds or thousands of employees can expect costs to be at least $20,000 for the initial certification.

Preparation

One of the expenses to plan for is going to be a certification audit from an accredited certification body. An external auditor performs tests on your systems and procedures to ensure that they’re up to par with ISO standards.

The audit process also takes time, so it’s important to think about how that may impact your organization and when you can expect to get the certification. The number of controls you need to implement can also affect the time it takes for you to achieve certification. 

Internal Audits

Before you achieve certification, you’ll need to go through an internal audit. Internal audits are required by the ISO 27001 standard as a means of monitoring the effectiveness of your information security management system (ISMS). As a result of the internal audit, you will be required to implement corrective actions for any nonconformities identified.

The individual performing the internal audit must be independent of the personnel operating the ISMS. An employee of your organization can perform the internal audit, but if they are not considered independent, then you will have to hire an outside party to perform the internal audit on your behalf.

The cost of an ISO 27001 internal for a small to medium size company will cost $5,000 to $15,000. An internal audit is required each year in order to obtain and maintain certification.  

Implementation

Implementation will consist of training, documentation, and overseeing changes, which can add up to your overall cost to certification quickly. Let’s take a close look at how each one of these may impact your budget.

Documentation

There are specific pieces of documentation you need to get ISO 27001 certification, which will require additional time and resources.

Some of the requirements include:

• 4.3 The scope of the ISMS

• 5.2 Information security policy

• 6.1.2 Information security risk assessment process

• 6.1.3 Information security risk treatment plan

• 6.1.3 The Statement of Applicability

• 6.2 Information security objectives

• 7.5.3 Control of documented information

• 8.1 Operational planning and control

• 8.2 Results of the information security risk assessment

• 8.3 Results of the information security risk treatment

• 9.1 Evidence of the monitoring and measurement of results

• 9.2 An internal audit process

• 9.2 Evidence of the audit programs and the audit results

• 9.3 Evidence of the results of management reviews

• 10.1 Evidence of any non-conformities and corrective actions taken

Think through the time it will take for your company to collect and organize all this information. Every organization will be in a different place when it comes to managing and collecting these details.

Training

As you take on this initiative, you’ll need to provide security awareness training to the people in your organization. In addition to the upfront cost of the training program, you’ll also need to factor in the time spent by your employees to complete their training and any downturn in productivity.

Establishing New Processes

New processes and controls will need to be implemented, some of which may be corrective actions that are critical to meet compliance. They will likely come with a bit of a learning curve for everyone on your team, which again, could have an impact on productivity.

Security Tools and Tests

New security tools such as access control systems, DDoS protection, and encryption software, as well as, penetration tests, and vulnerability scanning also factor into ISO 27001 costs.

For example, penetration testing, which gives you a detailed report of potential vulnerabilities and how much damage they could do, allowing you to prioritize fixes based on risk level can start at as low as $4,000, but increase significantly with complexity.

Vulnerability scanning, which gives you a view of potential holes in your security without going into detail about what those holes might be or how much damage they could cause typically costs about $2,500.

Maintenance and Surveillance 

The ongoing investment costs associated with ISO 27001 certification are minimal, but they do exist. Developing and updating your risk assessment and risk treatment plan, as well as annual reviews of these documents, will require resources. 

You’ll also need to develop an internal audit plan and a process to maintain your security policy. Additionally—and most importantly—certification itself requires renewal every three years, which comes at an additional cost.

Finally, you’ll need to plan for the fees that come with surveillance audits, which take place each year between your ISO 27001 certification audits. Surveillance audits will cost your organization between $5,000-$10,000 each.

ISO 27001 certification has the potential to be a great investment for your company. It can help ensure your security program’s effectiveness, build trust with new customers, and achieve better business outcomes.

Drata can streamline your journey to ISO 27001 certification and many other frameworks by eliminating hundreds of hours of manual work.